Skip to content

fix: render HTML entities in grid cells after XSS fix #525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bluestreak01 merged 3 commits into from
Jan 11, 2026
+18 −2
Merged

fix: render HTML entities in grid cells after XSS fix #525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b44e730
fix: render HTML entities like   in grid cells
bluestreak01 Jan 9, 2026
2d206ce
sync questdb
bluestreak01 Jan 11, 2026
f21be10
Merge remote-tracking branch 'origin/main' into vi_fix_nbsp
bluestreak01 Jan 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion e2e/questdb
Open in desktop
Submodule questdb updated 105 files
5 changes: 4 additions & 1 deletion src/js/console/grid.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
*
******************************************************************************/
import { copyToClipboard } from "../../utils/copyToClipboard"
import { unescapeHtml } from "../../utils/escapeHtml"

const hashString = (str) => {
let hash = 0
Expand Down Expand Up @@ -1153,7 +1154,9 @@ export function grid(rootElement, _paginationFn, id) {
if (cellData !== null) {
const layoutEntry = getLayoutEntry()
const columnWidth = layoutEntry.deviants[column.name] ?? null
cell.textContent = getDisplayedCellValue(column, cellData, columnWidth)
cell.textContent = unescapeHtml(
getDisplayedCellValue(column, cellData, columnWidth),
)

cell.classList.remove("qg-null")

Expand Down
13 changes: 13 additions & 0 deletions src/utils/escapeHtml.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,16 @@ export const escapeHtml = (text: string): string => {

return text.replace(/[&<>"']/g, (m) => map[m])
}

export const unescapeHtml = (text: string): string => {
const map: Record<string, string> = {
"&amp;": "&",
"&lt;": "<",
"&gt;": ">",
"&quot;": '"',
"&#039;": "'",
"&nbsp;": "\u00A0",
}

return text.replace(/&(amp|lt|gt|quot|#039|nbsp);/g, (m) => map[m])
}