Handle url specials from cell data in addLinksToTables#32
Open
pwildani wants to merge 1 commit intomode:masterfrom
Open
Handle url specials from cell data in addLinksToTables#32pwildani wants to merge 1 commit intomode:masterfrom
pwildani wants to merge 1 commit intomode:masterfrom
Conversation
When the cell contents includes URL-special characters, they should probably
not be interpreted as multiple query parameters or other such errors.
For example, with a addLinksToTables({link_columns: ["col"], link_urls: ["http://modeanalytics?param_foo={{col}}"]}):
Cell Contents: `A+B&securityhole=true`
Before: `http://modeanalytics/?param_foo=A+B&securityhole=true`
After: `http://modeanalytics/?param_foo=A%2bB%26securityhole=true`
So this avoids data that is potentially sourced from external users getting
injected into the super dangerous "securityhole" parameter on another report
unintentionally.
Or more practically, when the data contains a +, it doesn't get re-interpreted
as a space by the browser.
IMO, interpreting data from a single cell in a table as multiple parameters
should be a special case that needs more coding. The simple case of expecting
the cell contents to be a single scalar value should be the default.
Contributor
|
Hi @pwildani! Thanks for the PR. I think this code change assumes that the cell content will be the value of a query string. However, there are cases where the cell content are a URLs, like this report: https://modeanalytics.com/modeanalytics/reports/0bc75fadb03e/runs/d94183dc4088 In this case, the line encodeURIComponent(content) would encode the whole URL, which would make the link broken. |
Author
|
Tricky. Handling that difference might need a real behavior controlling flag or a separate top level function. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This probably addresses #31, but I encountered it independently.
When the cell contents includes URL-special characters, they should probably
not be interpreted as multiple query parameters or other such errors.
For example, with a
addLinksToTables({link_columns: ["col"], link_urls: ["http://modeanalytics?param_foo={{col}}"]}):A+B&securityhole=truehttp://modeanalytics/?param_foo=A+B&securityhole=truehttp://modeanalytics/?param_foo=A%2BB%26securityhole=trueSo this avoids data that is potentially sourced from external users getting
injected into the super dangerous "securityhole" parameter on another report
unintentionally.
Or more practically, when the data contains a +, it doesn't get re-interpreted
as a space by the browser.
IMO, interpreting data from a single cell in a table as multiple parameters
should be a special case that needs more coding. The simple case of expecting
the cell contents to be a single scalar value should be the default.