[
https://issues.apache.org/jira/browse/ATLAS-5370?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18103344#comment-18103344
]
ASF subversion and git services commented on ATLAS-5370:
--------------------------------------------------------
Commit b4e8f06cdc377dedd400f99ed07cf7abfa55ee3a in atlas's branch
refs/heads/ATLAS-5370 from Prasad Pawar
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=b4e8f06cd ]
ATLAS-5370: Atlas UI : Encode text in D3 graph tooltips Lineage and Profile
charts
> Atlas UI : Encode text in D3 graph tooltips Lineage and Profile charts
> ----------------------------------------------------------------------
>
> Key: ATLAS-5370
> URL: https://issues.apache.org/jira/browse/ATLAS-5370
> Project: Atlas
> Issue Type: Bug
> Components: atlas-webui
> Affects Versions: 3.0.0
> Reporter: Prasad P. Pawar
> Assignee: Prasad P. Pawar
> Priority: Major
>
> User-provided or API-sourced text shown in D3-based tooltips was inserted
> into tooltip HTML without encoding. Special characters (e.g. {{{}<{}}},
> {{{}>{}}}, {{{}&{}}}, quotes) could cause incorrect tooltip rendering or
> unexpected HTML behavior in the browser.
> Affected areas
> * Lineage graph — React UI and classic UI (atlas-lineage library)
> * Profile bar chart — classic UI only ({{{}ProfileBarChart.js{}}})
> Root cause
> Both components use {{d3-tip}} with {{{}.html(){}}}, which assigns content
> via {{{}innerHTML{}}}. Values such as entity display names, type names, query
> text, and profile chart labels were concatenated directly into HTML strings
> without encoding.
> Solution
> * Introduced a shared {{escapeHtml()}} helper in atlas-lineage Utils
> * Applied encoding to all dynamic tooltip fields before HTML assembly
> * Applied the same pattern to Profile bar chart tooltips ({{{}d.value{}}},
> chart type, {{{}d.count{}}})
> * Rebuilt the legacy atlas-lineage webpack bundle for classic UI
> Testing
> * Unit tests for {{escapeHtml}} (special characters, null/undefined, plain
> text)
> * React dashboard build verification
> * Apache RAT license check on new/changed files
> * Manual verification: hover lineage nodes and profile chart bars; confirm
> tooltips render user text correctly
> Out of scope
> * MUI/Recharts tooltips (already use React text nodes)
> * Components using {{sanitizeHtmlContent}} (e.g. HtmlRenderer, Business
> Metadata tab)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
