[
https://issues.apache.org/jira/browse/ATLAS-5370?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Prasad P. Pawar updated ATLAS-5370:
-----------------------------------
Affects Version/s: 2.5.0
> Atlas UI : Encode text in D3 graph tooltips Lineage and Profile charts
> ----------------------------------------------------------------------
>
> Key: ATLAS-5370
> URL: https://issues.apache.org/jira/browse/ATLAS-5370
> Project: Atlas
> Issue Type: Bug
> Components: atlas-webui
> Affects Versions: 3.0.0, 2.5.0
> Reporter: Prasad P. Pawar
> Assignee: Prasad P. Pawar
> Priority: Major
> Attachments: Screenshot 2026-08-10 at 4.32.42 PM.png
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> User-provided or API-sourced text shown in D3-based tooltips was inserted
> into tooltip HTML without encoding. Special characters (e.g. {{{}<{}}},
> {{{}>{}}}, {{{}&{}}}, quotes) could cause incorrect tooltip rendering or
> unexpected HTML behavior in the browser.
> Affected areas
> * Lineage graph — React UI and classic UI (atlas-lineage library)
> * Profile bar chart — classic UI only ({{{}ProfileBarChart.js{}}})
> Root cause
> Both components use {{d3-tip}} with {{{}.html(){}}}, which assigns content
> via {{{}innerHTML{}}}. Values such as entity display names, type names, query
> text, and profile chart labels were concatenated directly into HTML strings
> without encoding.
> Solution
> * Introduced a shared {{escapeHtml()}} helper in atlas-lineage Utils
> * Applied encoding to all dynamic tooltip fields before HTML assembly
> * Applied the same pattern to Profile bar chart tooltips ({{{}d.value{}}},
> chart type, {{{}d.count{}}})
> * Rebuilt the legacy atlas-lineage webpack bundle for classic UI
> Testing
> * Unit tests for {{escapeHtml}} (special characters, null/undefined, plain
> text)
> * React dashboard build verification
> * Apache RAT license check on new/changed files
> * Manual verification: hover lineage nodes and profile chart bars; confirm
> tooltips render user text correctly
> Out of scope
> * MUI/Recharts tooltips (already use React text nodes)
> * Components using {{sanitizeHtmlContent}} (e.g. HtmlRenderer, Business
> Metadata tab)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
