Merge branch 'main' into current_plugin_persistence

CHANGELOG.md

@@ -13,6 +13,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - [Legacy Maps Plugin] Prevent reverse-tabnabbing ([#2540](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2540))
 - Eliminate dependency on `got` versions older than 11.8.5 ([#2801](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2801))
 - [Multi DataSource] Add explicit no spellcheck on password fields ([#2818](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2818))
+- [CVE-2022-25912] Bumps simple-git from 3.4.0 to 3.15.0 ([#3036](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3036))
 
 ### 📈 Features/Enhancements
 
@@ -74,7 +75,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - [Build] Fixed "Last Access Time" not being set by `scanCopy` on Windows ([#2964](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2964))
 - [Vis Builder] Add global data persistence for vis builder #2896 ([#2896](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2896))
 - Update `leaflet-vega` and fix its usage ([#3005](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3005))
-
+- [Table Visualization][BUG] Fix Url content display issue in table ([#2918](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2918))
 
 ### 🚞 Infrastructure
 
@@ -97,6 +98,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ### 🛠 Maintenance
 
 - Adding @zhongnansu as maintainer. ([#2590](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2590))
+- Removes `minimatch` manual resolution ([#3019](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3019))
 
 ### 🪛 Refactoring
 
@@ -111,6 +113,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Fix incorrect validation of time values in JUnit Reporter ([#2965](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2965))
 - Make tests covering plugin installation on cluster snapshots work across platforms ([#2994](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2994))
 - Correct the linting logic for `no-restricted-path` to ignore trailing slashes ([#3020](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3020))
+- [Tests] Bumps `chromedriver` to v107 ([#3017](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3017))
 
 ## [2.x]
 

Dockerfile

@@ -13,7 +13,7 @@ RUN apt-get update && \
 # Specify the version of Chrome that matches the version of chromedriver in the package.json.
 # A list of Chrome versions can be found here:
 # https://www.ubuntuupdates.org/package/google_chrome/stable/main/base/google-chrome-stable
-ARG CHROME_VERSION=100.0.4896.127-1
+ARG CHROME_VERSION=107.0.5304.121-1
 RUN curl -sSL https://dl.google.com/linux/linux_signing_key.pub | apt-key add - \
   && wget -O /tmp/chrome.deb https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}_amd64.deb \
   && apt-get update \

MAINTAINERS.md

@@ -1,26 +1,26 @@
 # OpenSearch-Dashboards Maintainers
 
 ## Maintainers
-| Maintainer | GitHub ID | Affiliation |
-| --------------- | --------- | ----------- |
-| Anan | [ananzh](https://github.com/ananzh) | Amazon |
-| Bishoy Boktor | [boktorbb-amzn](https://github.com/boktorbb-amzn) | Amazon |
-| Mihir Soni | [mihirsoni](https://github.com/mihirsoni) | Amazon |
-| Rocky | [kavilla](https://github.com/kavilla) | Amazon |
-| Sean Neumann | [seanneumann](https://github.com/seanneumann) | Amazon | 
-| Miki Barahmand | [AMoo-Miki](https://github.com/AMoo-Miki) | Amazon |
-| Ashwin P Chandran | [ashwin-pc](https://github.com/ashwin-pc) | Amazon |
-| Josh Romero | [joshuarrrr](https://github.com/joshuarrrr) | Amazon |
-| Abby Hu | [abbyhu2000](https://github.com/abbyhu2000) | Amazon |
-| Yan Zeng | [zengyan-amazon](https://github.com/zengyan-amazon) | Amazon |
-| Kristen Tian | [kristenTian](https://github.com/kristenTian) | Amazon |
-| Zhongnan Su | [zhongnansu](https://github.com/zhongnansu) | Amazon |
-| Manasvini B Suryanarayana | [manasvinibs](https://github.com/manasvinibs) | Amazon |
+| Maintainer                | GitHub ID                                           | Affiliation |
+| ------------------------- | --------------------------------------------------- | ----------- |
+| Anan Zhuang               | [ananzh](https://github.com/ananzh)                 | Amazon      |
+| Bishoy Boktor             | [boktorbb](https://github.com/boktorbb)             | Amazon      |
+| Mihir Soni                | [mihirsoni](https://github.com/mihirsoni)           | Amazon      |
+| Kawika (Rocky) Avilla     | [kavilla](https://github.com/kavilla)               | Amazon      |
+| Sean Neumann              | [seanneumann](https://github.com/seanneumann)       | Amazon      | 
+| Miki Barahmand            | [AMoo-Miki](https://github.com/AMoo-Miki)           | Amazon      |
+| Ashwin P Chandran         | [ashwin-pc](https://github.com/ashwin-pc)           | Amazon      |
+| Josh Romero               | [joshuarrrr](https://github.com/joshuarrrr)         | Amazon      |
+| Abby Hu                   | [abbyhu2000](https://github.com/abbyhu2000)         | Amazon      |
+| Yan Zeng                  | [zengyan-amazon](https://github.com/zengyan-amazon) | Amazon      |
+| Kristen Tian              | [kristenTian](https://github.com/kristenTian)       | Amazon      |
+| Zhongnan Su               | [zhongnansu](https://github.com/zhongnansu)         | Amazon      |
+| Manasvini B Suryanarayana | [manasvinibs](https://github.com/manasvinibs)       | Amazon      |
 
 ## Emeritus
 
-| Maintainer | GitHub ID | Affiliation |
-| --------------- | --------- | ----------- |
-| Tommy Markley | [tmarkley](https://github.com/tmarkley) | Amazon | 
+| Maintainer                | GitHub ID                                           | Affiliation |
+| ------------------------- | --------------------------------------------------- | ----------- |
+| Tommy Markley             | [tmarkley](https://github.com/tmarkley)             | Amazon      | 
 
 [This document](https://github.com/opensearch-project/.github/blob/main/MAINTAINERS.md) explains what maintainers do, and how they should be doing it. If you're interested in contributing, see [CONTRIBUTING](CONTRIBUTING.md).

package.json

@@ -81,7 +81,6 @@
     "**/@types/node": "^14.17.32",
     "**/ansi-regex": "^5.0.1",
     "**/async": "^3.2.3",
-    "**/axios": "^0.27.2",
     "**/d3-color": "^3.1.0",
     "**/glob-parent": "^6.0.0",
     "**/hoist-non-react-statics": "^3.3.2",
@@ -93,8 +92,7 @@
     "**/qs": "^6.10.3",
     "**/trim": "^0.0.3",
     "**/typescript": "4.0.2",
-    "**/unset-value": "^2.0.1",
-    "**/minimatch": "^3.0.5"
+    "**/unset-value": "^2.0.1"
   },
   "workspaces": {
     "packages": [
@@ -260,12 +258,12 @@
     "@types/bluebird": "^3.1.1",
     "@types/chance": "^1.0.0",
     "@types/cheerio": "^0.22.31",
-    "@types/chromedriver": "^81.0.0",
     "@types/color": "^3.0.0",
     "@types/d3": "^3.5.43",
     "@types/dedent": "^0.7.0",
     "@types/deep-freeze-strict": "^1.1.0",
     "@types/delete-empty": "^2.0.0",
+    "@types/dompurify": "^2.3.3",
     "@types/elasticsearch": "^5.0.33",
     "@types/enzyme": "^3.10.7",
     "@types/eslint": "^6.1.3",
@@ -347,13 +345,14 @@
     "chai": "3.5.0",
     "chance": "1.0.18",
     "cheerio": "0.22.0",
-    "chromedriver": "^100.0.0",
+    "chromedriver": "^107.0.3",
     "classnames": "2.3.1",
     "compare-versions": "3.5.1",
     "d3": "3.5.17",
     "d3-cloud": "1.2.5",
     "dedent": "^0.7.0",
     "delete-empty": "^2.0.0",
+    "dompurify": "^2.4.1",
     "enzyme": "^3.11.0",
     "enzyme-adapter-react-16": "^1.15.5",
     "enzyme-to-json": "^3.5.0",
@@ -439,7 +438,7 @@
     "reselect": "^4.0.0",
     "resize-observer-polyfill": "^1.5.1",
     "selenium-webdriver": "^4.0.0-alpha.7",
-    "simple-git": "^3.4.0",
+    "simple-git": "^3.15.0",
     "sinon": "^7.4.2",
     "strip-ansi": "^6.0.0",
     "stylelint": "^14.5.2",

packages/osd-opensearch/package.json

@@ -22,7 +22,7 @@
     "getopts": "^2.2.5",
     "glob": "^7.1.7",
     "node-fetch": "^2.6.7",
-    "simple-git": "^3.4.0",
+    "simple-git": "^3.15.0",
     "tar-fs": "^2.1.0",
     "tree-kill": "^1.2.2",
     "yauzl": "^2.10.0"

src/plugins/vis_type_table_new/public/components/table_vis_component.tsx

@@ -5,6 +5,7 @@
 
 import React, { useCallback, useMemo } from 'react';
 import { orderBy } from 'lodash';
+import dompurify from 'dompurify';
 import { EuiDataGridProps, EuiDataGrid, EuiDataGridSorting, EuiTitle } from '@elastic/eui';
 
 import { IInterpreterRenderHandlers } from 'src/plugins/expressions';
@@ -50,9 +51,18 @@ export const TableVisComponent = ({
       const rawContent = sortedRows[rowIndex][columnId];
       const colIndex = columns.findIndex((col) => col.id === columnId);
       const column = columns[colIndex];
-      // use formatter to format raw content
-      // this can format date and percentage data
-      const formattedContent = column.formatter.convert(rawContent, 'text');
+      const htmlContent = column.formatter.convert(rawContent, 'html');
+      const formattedContent = (
+        /*
+         * Justification for dangerouslySetInnerHTML:
+         * This is one of the visualizations which makes use of the HTML field formatters.
+         * Since these formatters produce raw HTML, this visualization needs to be able to render them as-is, relying
+         * on the field formatter to only produce safe HTML.
+         * `htmlContent` is created by converting raw data via HTML field formatter, so we need to make sure this value never contains
+         * any unsafe HTML (e.g. by bypassing the field formatter).
+         */
+        <div dangerouslySetInnerHTML={{ __html: dompurify.sanitize(htmlContent) }} /> // eslint-disable-line react/no-danger
+      );
       return sortedRows.hasOwnProperty(rowIndex) ? formattedContent || null : null;
     }) as EuiDataGridProps['renderCellValue'];
   }, [sortedRows, columns]);