Skip to content

Commit

Permalink
Remove dangerouslySetInnerHTML in StackTraceMessage component
Browse files Browse the repository at this point in the history
Druid sometimes returns error message that are contained in "<>", as in
`<urlopen error [Errno 61] Connection refused>`. Since Superset's
approach is often to bubble up messages coming from external library,
it's impossible to predict whether it will contain special characters.

There are some cases where our error handling does return some html
(presto?),
but we should manage that upstream. Plus the current setup has security concerns,
so let's move away from that.
  • Loading branch information
mistercrunch committed Feb 7, 2018
1 parent 31a0b6e commit a842a9b
Showing 1 changed file with 1 addition and 8 deletions.
9 changes: 1 addition & 8 deletions superset/assets/javascripts/components/StackTraceMessage.jsx
Original file line number Diff line number Diff line change
Expand Up @@ -26,20 +26,13 @@ class StackTraceMessage extends React.PureComponent {
}

render() {
const msg = (
<div>
<p
dangerouslySetInnerHTML={{ __html: this.props.message }}
/>
</div>);

return (
<div className={`stack-trace-container${this.hasTrace() ? ' has-trace' : ''}`}>
<Alert
bsStyle="warning"
onClick={() => this.setState({ showStackTrace: !this.state.showStackTrace })}
>
{msg}
{this.props.message}
</Alert>
{this.hasTrace() &&
<Collapse in={this.state.showStackTrace}>
Expand Down

0 comments on commit a842a9b

Please sign in to comment.