Prasad P. Pawar created ATLAS-5370:
--------------------------------------
Summary: Atlas UI : Encode text in D3 graph tooltips Lineage and
Profile charts
Key: ATLAS-5370
URL: https://issues.apache.org/jira/browse/ATLAS-5370
Project: Atlas
Issue Type: Bug
Components: atlas-webui
Affects Versions: 3.0.0
Reporter: Prasad P. Pawar
Assignee: Prasad P. Pawar
User-provided or API-sourced text shown in D3-based tooltips was inserted into
tooltip HTML without encoding. Special characters (e.g. {{{}<{}}}, {{{}>{}}},
{{{}&{}}}, quotes) could cause incorrect tooltip rendering or unexpected HTML
behavior in the browser.
Affected areas
* Lineage graph — React UI and classic UI (atlas-lineage library)
* Profile bar chart — classic UI only ({{{}ProfileBarChart.js{}}})
Root cause
Both components use {{d3-tip}} with {{{}.html(){}}}, which assigns content via
{{{}innerHTML{}}}. Values such as entity display names, type names, query text,
and profile chart labels were concatenated directly into HTML strings without
encoding.
Solution
* Introduced a shared {{escapeHtml()}} helper in atlas-lineage Utils
* Applied encoding to all dynamic tooltip fields before HTML assembly
* Applied the same pattern to Profile bar chart tooltips ({{{}d.value{}}},
chart type, {{{}d.count{}}})
* Rebuilt the legacy atlas-lineage webpack bundle for classic UI
Testing
* Unit tests for {{escapeHtml}} (special characters, null/undefined, plain
text)
* React dashboard build verification
* Apache RAT license check on new/changed files
* Manual verification: hover lineage nodes and profile chart bars; confirm
tooltips render user text correctly
Out of scope
* MUI/Recharts tooltips (already use React text nodes)
* Components using {{sanitizeHtmlContent}} (e.g. HtmlRenderer, Business
Metadata tab)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
