Refactor span formatter function to use a html template to generate autoescaped HTML #5280
Conversation
AkhigbeEromo
commented
Mar 15, 2024
•
AkhigbeEromo
commented
- Refactored the spanRowFormatter function to utilize HTML templates for auto-escaping HTML, ensuring protection against Cross-site Scripting (XSS) vulnerabilities. under issue#4451. zpages: G203: The used method does not auto-escape HTML #4451
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5280 +/- ##
=======================================
- Coverage 61.2% 61.2% -0.1%
=======================================
Files 185 185
Lines 11207 11214 +7
=======================================
Hits 6865 6865
- Misses 4142 4149 +7
Partials 200 200
|
CHANGELOG.md
Outdated
| @@ -11,6 +11,8 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm | |||
| ### Added | |||
|
|
|||
| - Add the new `go.opentelemetry.io/contrib/instrgen` package to provide auto-generated source code instrumentation. (#3068, #3108) | |||
| - Add a new package `go.opentelemetry.io/contrib/zpages/internal` to enable the use of internal.Templates within the parseTemplate function. | |||
There was a problem hiding this comment.
This needs to be removed. It is not included in these changes.
CHANGELOG.md
Outdated
| @@ -11,6 +11,8 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm | |||
| ### Added | |||
|
|
|||
| - Add the new `go.opentelemetry.io/contrib/instrgen` package to provide auto-generated source code instrumentation. (#3068, #3108) | |||
| - Add a new package `go.opentelemetry.io/contrib/zpages/internal` to enable the use of internal.Templates within the parseTemplate function. | |||
| - Refactored the spanRowFormatter function to utilize HTML templates for auto-escaping HTML, ensuring protection against Cross-site Scripting (XSS) vulnerabilities. (#4451) | |||
There was a problem hiding this comment.
Please rewrite this in terms that an end-user will understand and move to the "### Fixed" section.
Reference: https://keepachangelog.com/en/1.1.0/
| tpl = fmt.Sprintf(`trace_id: <b style="color:%s">%s</b> span_id: %s `, col, template.HTMLEscapeString(r.SpanContext.TraceID().String()), template.HTMLEscapeString(r.SpanContext.SpanID().String())) | ||
| } | ||
|
|
||
| t := template.Must(template.New("spanRow").Parse(tpl)) |
There was a problem hiding this comment.
what would you advise i do?
There was a problem hiding this comment.
Really grateful for your corrections @MrAlias
There was a problem hiding this comment.
would it be better if i just
return template.HTML(fmt.Sprintf(tpl))
|
Please address lint failures. |
|
Okay, will work on it@MrAlias |
|
Closing, as this has been fixed in #5327 |
