bito-code-review[bot] commented on PR #43397: URL: https://github.com/apache/superset/pull/43397#issuecomment-5372423636
<!-- Bito Reply --> The reviewer's concern regarding the rejection of all tooltip formatters containing `<` is valid. ECharts supports HTML in tooltips, and a blanket rejection of all markup breaks legitimate use cases like `<br/>` or `<b>` tags. To resolve this, you should replace the strict rejection with a sanitization approach. Instead of rejecting the string, use a library like `DOMPurify` to sanitize the HTML content, allowing only safe, benign tags while stripping potentially malicious scripts or attributes. This maintains security while preserving the intended layout functionality. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
