fix(tooltip): fix tooltip XSS issue when legend name is HTML string

apache · Jun 18, 2024 · ad947d6 · ad947d6
1 parent a282471
commit ad947d6
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 24 deletions.
diff --git a/src/util/graphic.ts b/src/util/graphic.ts
@@ -67,6 +67,7 @@ import {
 } from 'zrender/src/core/util';
 import { getECData } from './innerStore';
 import ComponentModel from '../model/Component';
+import { encodeHTML } from 'zrender/src/core/dom';
 
 
 import {
@@ -600,10 +601,11 @@ export function setTooltipConfig(opt: {
     const ecData = getECData(opt.el);
     ecData.componentMainType = mainType;
     ecData.componentIndex = componentIndex;
+
     ecData.tooltipConfig = {
         name: itemName,
         option: defaults({
-            content: itemName,
+            content: encodeHTML(itemName),
             formatterParams: formatterParams
         }, itemTooltipOptionObj)
     };

diff --git a/test/tooltip.html b/test/tooltip.html