fix(tooltip): fix tooltip XSS issue when legend name is HTML string

apache · Jun 18, 2024 · ad947d6 · ad947d6
1 parent a282471
commit ad947d6
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 24 deletions.
diff --git a/src/util/graphic.ts b/src/util/graphic.ts
@@ -67,6 +67,7 @@ import {
 } from 'zrender/src/core/util';
 import { getECData } from './innerStore';
 import ComponentModel from '../model/Component';
+import { encodeHTML } from 'zrender/src/core/dom';
 
 
 import {
@@ -600,10 +601,11 @@ export function setTooltipConfig(opt: {
  const ecData = getECData(opt.el);
  ecData.componentMainType = mainType;
  ecData.componentIndex = componentIndex;
+
  ecData.tooltipConfig = {
  name: itemName,
  option: defaults({
- content: itemName,
+ content: encodeHTML(itemName),
  formatterParams: formatterParams
  }, itemTooltipOptionObj)
  };

diff --git a/test/tooltip.html b/test/tooltip.html