Repository navigation
Conversation
The URL of a Canvas node was interpolated and passed to window.open() without the verification done for the other links of the plugins (sanitizeUrl), so a javascript: or data: URL, written in the panel or provided by a variable, was opened. As the window is opened with noopener, such a URL doesn't run in the Perses origin, but the panel shouldn't rely on it. The URL is now verified with sanitizeUrl once the variables are interpolated, and a node whose URL uses a disallowed scheme doesn't open anything. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Augustin Husson <augustin.husson@amadeus.com>
|
React Doctor found no new issues. 🎉 Reviewed by React Doctor for commit |
This was referenced Nov 10, 2026
adrianSepiol
approved these changes
Nov 10, 2026
ibakshay
approved these changes
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up of #910 / #912, which restricted the trace panel links to relative URLs and the allowed schemes: the Canvas panel has the same kind of link sink, which wasn't covered.
When a node with a
urlis clicked,PanelNodeLayerinterpolates the dashboard variables into the URL and passes the result towindow.open()without checking its scheme. Ajavascript:ordata:URL, written in the panel or provided by a variable, was therefore opened.This isn't exploitable as such: the window is opened with
noopener, so the URL doesn't run in the Perses origin. I checked it with Chrome 157, Firefox 142 and WebKit 26: Chrome and Firefox don't run it, WebKit runs it in an opaque (null) origin without access to the Perses cookies. But the panel shouldn't depend on that.The URL is now verified with
sanitizeUrlfrom@perses-dev/componentsonce the variables are interpolated, like the other link sinks. A node whose URL uses a disallowed scheme doesn't open anything.Tests: the new
PanelNodeLayer.test.tsxcovers an interpolated URL, a relative URL,javascript:(also obfuscated with mixed case, a leading space and a tab),data:, and a scheme provided by a variable. Without the fix, the 4 unsafe cases fail.npm run lint -w canvas: no new warning (the only one is the existingsrc/setup-tests.tswarning)npm run type-check -w canvas: passesnpm run test -w canvas: 17 files, 189 tests passnpm run format:check: passesThis targets
main; it can be cherry-picked torelease/v0.56if we want it in the v0.56 plugins.Screenshots
N/A: a node with a safe URL behaves as before.
Checklist
[<catalog_entry>] <commit message>naming convention using one of thefollowing
catalog_entryvalues:FEATURE,ENHANCEMENT,BUGFIX,BREAKINGCHANGE,DOC,IGNORE.UI Changes