rusackas opened a new pull request, #43397: URL: https://github.com/apache/superset/pull/43397
### SUMMARY Several chart plugins build tooltip/popup HTML by interpolating creator-configured or query-result strings directly into a template without escaping. This brings each of them in line with the escaping pattern already used elsewhere in the same plugins/packages: - TimeTable's URL column and the shared `MetricOption` link component now restrict rendered `href` values to safe schemes (http/https/relative). - The ECharts custom-options schema now rejects markup in tooltip formatter strings and constrains title links to safe schemes. - Radar chart tooltips now escape series name, metric label, and value before building the tooltip HTML. - The Calendar heatmap's tooltip callbacks now escape formatter output. - World Map's hover popup now escapes the country name and formatter output. - Cartodiagram's OpenLayers layer attribution is now escaped before reaching the map's Attribution control. ### TESTING INSTRUCTIONS `npm test` in `superset-frontend/` for the affected packages/plugins — new/extended tests per change, each demonstrating the previously-unescaped interpolation and passing once fixed. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
