tooltips xss问题

[MayRay822]

Version

5.0.2

Steps to reproduce

复现地址：https://codepen.io/ruimei/pen/zYombvZ
触发tooltips时候会触发脚本

What is expected?

希望能正常运行

What is actually happening?

xss

[echarts-bot]

Hi! We've received your issue and please be patient to get responded. 🎉
The average response time is expected to be within one day for weekdays.

In the meanwhile, please make sure that you have posted enough image to demo your request. You may also check out the API and chart option to get the answer.

If you don't get helped for a long time (over a week) or have an urgent question to ask, you may also send an email to dev@echarts.apache.org. Please attach the issue link if it's a technical question.

If you are interested in the project, you may also subscribe our mailing list.

Have a nice day! 🍵

[echarts-bot]

@RuiMM It seems you are not using English, I've helped translate the content automatically. To make your issue understood by more people, we'd like to suggest using English next time. 🤗

TRANSLATED

TITLE

Tooltips XSS problem

BODY

Version

5.0.2

steps to reproduce

Reclaim address: https://codepen.io/ruimei/pen/zyombvz
Trigger scripts when triggering tooltips

What is expected?

I hope to run normally

What is actually happens?

XSS

[susiwen8]

It should be fixed in 97db80a echarts-bot[bot] <notifications@github.com> 于2021年3月9日周二 下午3:04写道：

…

@RuiMM <https://github.com/RuiMM> It seems you are not using English, I've helped translate the content automatically. To make your issue understood by more people, we'd like to suggest using English next time. 🤗 *TRANSLATED* *TITLE* Tooltips XSS problem *BODY* Version 5.0.2 steps to reproduce Reclaim address: https://codepen.io/ruimei/pen/zyombvz Trigger scripts when triggering tooltips What is expected? I hope to run normally What is actually happens? XSS — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#14429 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE3ATEH5O43VYZIBP4UTMCLTCXCAPANCNFSM4Y25NDEQ> .

[susiwen8]

No, it doesn't. We will look into it.

[echarts-bot]

This issue is labeled with priority: high, which means it's a frequently asked problem and we will fix it ASAP.

[100pah]

I think it is not an issue.
When the tooltip.formatter is totally defined by user,
user should do that encodeHTML when assemble html text.
For example:

    tooltip: {
        trigger: 'axis',
        formatter(params) {
            const name = params[0] && params[0].name;
            const fmt = `${name}${
                params.map((param, i) => {

                return `<br/>
                      <span class="serie-label" style="display:inline-block;margin-right:5px;border-radius:10px;width:10px;height:10px;
                        background-color:${param.color};"></span>
                    ${encodeHTML(param.seriesName)} : ${encodeHTML(param.value)}`;
            }).join('')
          }`;

          return fmt

        }
    }

function encodeHTML(source) {
    return source == null
        ? ''
        : (source + '').replace(/([&<>"'])/g, function (str, c) {
            return {
                '&': '&amp;',
                '<': '&lt;',
                '>': '&gt;',
                '"': '&quot;',
                '\'': '&#39;'
            }[c];
        });
}

echarts should not make param.seriesName and param.value encoded internally, because:

• If echarts encode them internally, users can only get the encoded param.seriesName and param.value and can not do anything others to that string.
• encodeHTML only make sense in html tooltip (renderMode: html), but if renderMode is richText, we can not make the encoded string display correctly
• Theoretically all of the properties in tooltip.formatter args can be assembled into html. echarts does not know which properties users really need. If encodeHTML internally, echarts need to encode all of the possible properties internally, especial the complex structure params.data. It's too complicated.