sadpandajoe commented on code in PR #45575:
URL: https://github.com/apache/superset/pull/45575#discussion_r4366897544
##########
superset-frontend/plugins/plugin-chart-echarts/test/Rose/transformProps.test.ts:
##########
@@ -193,3 +196,27 @@ test('renders when __timestamp is serialized as a
non-epoch string', () => {
expect(seriesNames).toEqual(['East', 'West']);
expect(series[0].data.map((d: any) => d.value)).toEqual([30, 10]);
});
+
+test.each([true, false])(
+ 'escapes literal series text in Rose tooltips (rich=%s)',
+ richTooltip => {
+ const name = 'Love <3 charts & <img src=x>';
+ const props = new ChartProps({
+ width: 800,
+ height: 600,
+ formData: { ...formData, richTooltip },
Review Comment:
Both parametrized tooltip modes keep `dateTimeFormat: 'smart_date'`, so the
new `escapeHtml(period.label)` calls in the rich-tooltip and plain-tooltip
formatters never see markup. Removing either escape would still pass; only the
drilled test covers the third site. Could this test set `dateTimeFormat` to
something like `'<b>period</b>'` and assert the label text survives literally
with exactly one structural `<b>`?
##########
superset-frontend/plugins/plugin-chart-echarts/test/Bullet/transformProps.test.ts:
##########
@@ -424,3 +424,38 @@ test('keeps exact-case dimensions and uses per-index
fallbacks for short labels'
.map(series => series.markLine?.data[0].label.formatter()),
).toEqual(['stretch', '260.0']);
});
+
+test('escapes literal comparison text in every Bullet tooltip', () => {
+ const label = 'Users <30 & <img src=x>';
+ const metric = 'Total <3';
Review Comment:
The metric `Total <3` is parsed as plain text even when
`escapeHtml(metricLabel)` is removed, because `<3` is not a tag. The assertion
on `textContent` still passes, so a regression that drops that escape goes
unnoticed while the other labels use `<img src=x>`. Could the metric include an
allowed tag such as `<b>Total</b>` and assert the literal text survives in the
first tooltip?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
