Julius Volz a4d5f98f42 UI: Fix stored XSS via unescaped metric names and labels ...

Metric names, label names, and label values containing HTML/JavaScript were
inserted into `innerHTML` without escaping in several UI code paths, enabling
stored XSS attacks via crafted metrics. This mostly becomes exploitable in
Prometheus 3.x, since it defaults to allowing any UTF-8 characters in metric
and label names.

Apply `escapeHTML()` to all user-controlled values before innerHTML
insertion in:

* Mantine UI chart tooltip
* Old React UI chart tooltip
* Old React UI metrics explorer fuzzy search
* Old React UI heatmap tooltip

See https://github.com/prometheus/prometheus/security/advisories/GHSA-vffh-x6r8-xx99

Signed-off-by: Julius Volz <julius.volz@gmail.com>

2026-04-04 12:19:55 +02:00

..

public

fix some typos (#12498)

2023-06-29 12:28:13 +02:00

src

UI: Fix stored XSS via unescaped metric names and labels

2026-04-04 12:19:55 +02:00

.env

Fix broken prefixed asset links in webpack build (#9586)

2021-10-25 12:52:13 +02:00

.eslintrc.json

Update React 16->17, TypeScript, and some other node deps

2021-09-14 15:46:59 +02:00

.gitignore

Integrate beginning of React UI (#5694)

2019-10-17 14:38:09 +02:00

package-lock.json

Migrate Mantine v7 -> v8 (#17402)

2025-11-06 09:38:27 +01:00

package.json

Upgraded npm dependencies pre 3.4.0-rc.0 (#16493)

2025-04-29 17:19:23 +02:00

tsconfig.json

upgrade react-app to typescript 4

2021-09-07 10:51:59 +02:00