Skip to content

fix(dashboards): Prevent double HTML-escaping in chart tooltips #111022

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gggritso merged 2 commits into from
Mar 19, 2026
Merged

fix(dashboards): Prevent double HTML-escaping in chart tooltips #111022

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eb0ad25
fix(dashboards): Prevent double HTML-escaping in chart tooltips
gggritso Mar 18, 2026
bea9f0f
fix(dashboards): Escape alias values in tooltip nameFormatter
gggritso Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions static/app/views/dashboards/widgets/timeSeriesWidget/timeSeriesWidgetVisualization.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ import type {
EChartHighlightHandler,
ReactEchartsRef,
} from 'sentry/types/echarts';
import {defined} from 'sentry/utils';
import {defined, escape} from 'sentry/utils';
import {uniq} from 'sentry/utils/array/uniq';
import type {AggregationOutputType} from 'sentry/utils/discover/fields';
import {RangeMap, type Range} from 'sentry/utils/number/rangeMap';
Expand Down Expand Up @@ -348,8 +348,17 @@ export function TimeSeriesWidgetVisualization(props: TimeSeriesWidgetVisualizati
return defined(sampleId) ? sampleId.toString() : seriesName;
}

const name = aliases[seriesName] ?? seriesName;
return truncationFormatter(name, true);
const alias = aliases[seriesName];
if (alias) {
// The alias value comes from `plottable.label` and is not
// HTML-escaped. Escape it for safe insertion into raw HTML
// tooltip strings.
return escape(truncationFormatter(alias, true, false));
}
// `seriesName` is already HTML-escaped by `getFormatter`, so
// skip escaping to avoid double-encoding (e.g., `>` → `>`
// → `>`).
return truncationFormatter(seriesName, true, false);
},
valueFormatter: function (value, _field, valueFormatterParams) {
// Use the series to figure out the corresponding `Plottable`, and get the field type. From that, use whichever unit we chose for that field type.
Expand Down
Loading