Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make the Chart Name field html 'clean'. #239

Merged
merged 4 commits into from
Sep 18, 2017
Merged

Make the Chart Name field html 'clean'. #239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
977e5b2
Make the Chart Name field html 'clean'.
jpwhite4 Sep 13, 2017
0207e86
Style fixes for linter
jpwhite4 Sep 13, 2017
40ac55f
Whoops missed change from the installed code
jpwhite4 Sep 14, 2017
c0a5139
Added integration test for the queries endpoint
jpwhite4 Sep 14, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions classes/NewRest/Controllers/MetricExplorerControllerProvider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ public function getQueries(Request $request, Application $app)

foreach ($data as &$query) {
$this->removeRoleFromQuery($user, $query);
$query['name'] = htmlspecialchars($query['name'], ENT_COMPAT, 'UTF-8', false);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quick question, was there a problem when including the default ENT_HTML401 flag?

}

$payload['data'] = $data;
Expand Down Expand Up @@ -171,6 +172,7 @@ public function getQueryById(Request $request, Application $app, $id)

if (isset($query)) {
$payload['data'] = $query;
$payload['data']['name'] = htmlspecialchars($query['name'], ENT_COMPAT, 'UTF-8', false);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as the one above re: ENT_HTML401.

$payload['success'] = true;
$statusCode = 200;
} else {
Expand Down
42 changes: 22 additions & 20 deletions html/gui/js/modules/metric_explorer/MetricExplorer.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2236,7 +2236,7 @@ Ext.extend(XDMoD.Module.MetricExplorer, XDMoD.PortalModule, {

}

this.chartNameTextbox.setValue(queryName);
this.chartNameTextbox.setValue(Ext.util.Format.htmlDecode(queryName));
this.chartOptionsButton.setText(truncateText(queryName, XDMoD.Module.MetricExplorer.CHART_OPTIONS_MAX_TEXT_LENGTH));
this.chartOptionsButton.setTooltip(queryName);
}, //createQueryFunc
Expand Down Expand Up @@ -3355,24 +3355,26 @@ Ext.extend(XDMoD.Module.MetricExplorer, XDMoD.PortalModule, {
*/
change: function(textbox, newValue, oldValue) {

var isValid = this.chartNameTextbox.validate();
if (!isValid) {
this.chartNameTextbox.focus();
return;
}
var isValid = this.chartNameTextbox.validate();
if (!isValid) {
this.chartNameTextbox.focus();
return;
}

XDMoD.TrackEvent('Metric Explorer', 'Updated the Chart Name', Ext.encode({
original_name: oldValue,
new_name: newValue
}));
var newHtml = Ext.util.Format.htmlEncode(newValue);

if (this.currentQueryRecord) {
this.chartOptionsButton.setText(truncateText(newValue, XDMoD.Module.MetricExplorer.CHART_OPTIONS_MAX_TEXT_LENGTH));
this.chartOptionsButton.setTooltip(newValue);
this.currentQueryRecord.set('name', newValue);
this.currentQueryRecord.stack.add(this.currentQueryRecord.data);
}
} // change
XDMoD.TrackEvent('Metric Explorer', 'Updated the Chart Name', Ext.encode({
original_name: oldValue,
new_name: newValue
}));

if (this.currentQueryRecord) {
this.chartOptionsButton.setText(truncateText(newHtml, XDMoD.Module.MetricExplorer.CHART_OPTIONS_MAX_TEXT_LENGTH));
this.chartOptionsButton.setTooltip(newHtml);
this.currentQueryRecord.set('name', newHtml);
this.currentQueryRecord.stack.add(this.currentQueryRecord.data);
}
} // change
}
});
// ---------------------------------------------------------
Expand Down Expand Up @@ -4881,7 +4883,7 @@ Ext.extend(XDMoD.Module.MetricExplorer, XDMoD.PortalModule, {
XDMoD.TrackEvent('Metric Explorer', 'Selected chart from list', r.data.name);
Ext.menu.MenuMgr.hideAll();

this.chartNameTextbox.setValue(r.data.name);
this.chartNameTextbox.setValue(Ext.util.Format.htmlDecode(r.data.name));
this.chartOptionsButton.setText(truncateText(r.data.name, XDMoD.Module.MetricExplorer.CHART_OPTIONS_MAX_TEXT_LENGTH));
this.chartOptionsButton.setTooltip(r.data.name);

Expand Down Expand Up @@ -4966,7 +4968,7 @@ Ext.extend(XDMoD.Module.MetricExplorer, XDMoD.PortalModule, {
// to the width of the GridPanel.
if (name.length > 73) {
/* eslint-disable no-param-reassign */
metaData.attr += 'ext:qtip="' + name + '"';
metaData.attr += 'ext:qtip="' + Ext.util.Format.htmlEncode(name) + '"';
/* eslint-enable no-param-reassign */
}
return name;
Expand Down Expand Up @@ -6292,7 +6294,7 @@ Ext.extend(XDMoD.Module.MetricExplorer, XDMoD.PortalModule, {
}
}
this.currentQueryRecord.endEdit();
this.chartNameTextbox.setValue(chartData.name);
this.chartNameTextbox.setValue(Ext.util.Format.htmlDecode(chartData.name));
this.chartOptionsButton.setText(truncateText(chartData.name, XDMoD.Module.MetricExplorer.CHART_OPTIONS_MAX_TEXT_LENGTH));
this.chartOptionsButton.setTooltip(chartData.name);
this.loadQuery(JSON.parse(chartData.config), true);
Expand Down
89 changes: 89 additions & 0 deletions open_xdmod/modules/xdmod/integration_tests/lib/Controllers/MetricExplorerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,4 +104,93 @@ public function testGetDimensionFilters()
$this->assertEquals($response[1]['content_type'], 'application/json');
$this->assertEquals($response[1]['http_code'], 401);
}

/**
* @dataProvider chartDataProvider
*/
public function testChartQueryEndpoint($chartSettings)
{
$settings = array(
'name' => 'Test &lt; <img src="test.gif" onerror="alert()" />',
'ts' => microtime(true),
'config' => $chartSettings
);
$this->helper->authenticate('cd');
$response = $this->helper->post('rest/v1/metrics/explorer/queries', null, array('data' => json_encode($settings)));

$this->assertEquals($response[1]['content_type'], 'application/json');
$this->assertEquals($response[1]['http_code'], 200);

$querydata = $response[0];
$this->assertArrayHasKey('data', $querydata);
$this->assertArrayHasKey('recordid', $querydata['data']);
$this->assertArrayHasKey('name', $querydata['data']);
$this->assertArrayHasKey('ts', $querydata['data']);
$this->assertArrayHasKey('config', $querydata['data']);

$recordid = $querydata['data']['recordid'];

$allcharts = $this->helper->get('rest/v1/metrics/explorer/queries');
$this->assertTrue($allcharts[0]['success']);

$seenchart = false;
foreach($allcharts[0]['data'] as $chart)
{
if ($chart['recordid'] == $recordid) {
$this->assertEquals("Test &lt; &lt;img src=&quot;test.gif&quot; onerror=&quot;alert()&quot; /&gt;", $chart['name']);
$seenchart = true;
}
}
$this->assertTrue($seenchart);

$justthischart = $this->helper->get('rest/v1/metrics/explorer/queries/' . $recordid);
$this->assertTrue($justthischart[0]['success']);
$this->assertEquals("Test &lt; &lt;img src=&quot;test.gif&quot; onerror=&quot;alert()&quot; /&gt;", $justthischart[0]['data']['name']);

$cleanup = $this->helper->delete('rest/v1/metrics/explorer/queries/' . $recordid);
$this->assertTrue($cleanup[0]['success']);
}

public function chartDataProvider()
{
$emptyChart = <<< EOF
{
"featured": false,
"trend_line": false,
"x_axis": {},
"y_axis": {},
"legend": {},
"defaultDatasetConfig": {
"display_type": "column"
},
"swap_xy": false,
"share_y_axis": false,
"hide_tooltip": true,
"show_remainder": false,
"timeseries": false,
"title": "Test",
"legend_type": "bottom_center",
"font_size": 3,
"show_filters": true,
"show_warnings": true,
"data_series": {
"data": [ ],
"total": 0
},
"aggregation_unit": "Auto",
"global_filters": {
"data": [ ],
"total": 0
},
"timeframe_label": "Previous month",
"start_date": "2017-08-01",
"end_date": "2017-08-31",
"start": 0,
"limit": 10
}
EOF;
return array(
array($emptyChart)
);
}
}