codeant-ai-for-open-source[bot] commented on code in PR #22604:
URL: https://github.com/apache/superset/pull/22604#discussion_r3444113589
##########
superset-frontend/plugins/plugin-chart-table/src/transformProps.ts:
##########
@@ -693,6 +695,28 @@ const transformProps = (
: '';
const [metrics, percentMetrics, columns] = processColumns(chartProps);
+
+ const columnUrlLinks = getTextFromValues(urlLink) ?? [];
Review Comment:
**Suggestion:** This change now forwards user-configured URL templates
directly into table link rendering without protocol validation, which allows
`javascript:` or other dangerous schemes to be persisted and executed on click.
Normalize/validate generated links to an allowlist (for example `http:`,
`https:`, `mailto:`) before exposing them to the chart props. [security]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Table links can execute arbitrary JavaScript via javascript: URLs.
- ⚠️ Compromised charts risk XSS for unsuspecting dashboard viewers.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. In the Table chart Explore UI, configure the `Url Link` control
registered in the
control panel
(superset-frontend/plugins/plugin-chart-table/src/controlPanel.tsx:872-878)
and, via the `UrlLinkPopoverContent` form
(superset-frontend/src/explore/components/controls/UrlLinkControl/UrlLinkPopoverContent.tsx:64-88),
set `linkSchema` to `javascript:alert(1)` with a valid `columnName` and
`linkText`; the
form only enforces required fields and performs no URL scheme validation.
2. Save the chart so that the configuration is stored in
`rawFormData.url_link`
(superset-frontend/plugins/plugin-chart-table/src/types.ts:14-16) and later
passed to the
table plugin's `transformProps`
(superset-frontend/plugins/plugin-chart-table/src/transformProps.ts:93-137),
which
computes `const columnUrlLinks = getTextFromValues(urlLink) ?? [];`
(transformProps.ts:300).
3. `getTextFromValues` in
`packages/superset-ui-chart-controls/src/utils/getUrlLinks.ts:23-41` builds
`columnUrlLinks` entries where `getTextFromValues` closes over the
configured `linkSchema`
and calls `genLinkHref(values, linkSchema!)`; for a schema without `${}`
placeholders,
`genLinkHref` simply returns the original string `javascript:alert(1)`
(getUrlLinks.ts:25-31).
4. At render time, `TableChart` finds the configured URL link for the column
and sets
`urlLinkHref = matchedUrlLink.getTextFromValues(value as number,
row.original);`
(superset-frontend/plugins/plugin-chart-table/src/TableChart.tsx:1262-1271),
then renders
`<a target="_blank" href={urlLinkHref} rel="noreferrer">`
(TableChart.tsx:1274-1279);
clicking the cell link navigates the browser to `javascript:alert(1)`,
executing arbitrary
JavaScript in the viewer's context.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=21c48e6f8f304eb5a3831b692cddd7ab&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=21c48e6f8f304eb5a3831b692cddd7ab&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset-frontend/plugins/plugin-chart-table/src/transformProps.ts
**Line:** 699:699
**Comment:**
*Security: This change now forwards user-configured URL templates
directly into table link rendering without protocol validation, which allows
`javascript:` or other dangerous schemes to be persisted and executed on click.
Normalize/validate generated links to an allowlist (for example `http:`,
`https:`, `mailto:`) before exposing them to the chart props.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F22604&comment_hash=669373e692e81ce65cd8efd91c7be38d91d0ea7932fbba4b68c0a2b346c77cb1&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F22604&comment_hash=669373e692e81ce65cd8efd91c7be38d91d0ea7932fbba4b68c0a2b346c77cb1&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
