@grafana/viz-contract 1.1.0

package/fixtures/error-unsupported-spec-version/state.json

@@ -0,0 +1,8 @@
+{
+  "state": "error",
+  "error": {
+    "code": "unsupported-spec-version",
+    "message": "This viz spec version (99) is not supported. Supported versions: 1."
+  },
+  "notices": []
+}

package/fixtures/hostile-label/args.json

@@ -0,0 +1,14 @@
+{
+  "datasourceUid": "lgtm-prometheus",
+  "queries": [
+    {
+      "refId": "A",
+      "expr": "sum by (handler) (rate(grafana_http_request_duration_seconds_count[5m]))",
+      "legendFormat": "{{handler}}",
+      "format": "time_series"
+    }
+  ],
+  "from": "now-24h",
+  "to": "now",
+  "unit": "reqps"
+}

package/fixtures/hostile-label/meta.json

@@ -0,0 +1,4 @@
+{
+  "now": 1790353477294,
+  "capturedAt": 1790353477806
+}

package/fixtures/hostile-label/request.json

@@ -0,0 +1,17 @@
+{
+  "from": "now-24h",
+  "to": "now",
+  "queries": [
+    {
+      "refId": "A",
+      "expr": "sum by (handler) (rate(grafana_http_request_duration_seconds_count[5m]))",
+      "legendFormat": "{{handler}}",
+      "format": "time_series",
+      "datasource": {
+        "uid": "lgtm-prometheus"
+      },
+      "maxDataPoints": 1000,
+      "intervalMs": 86400
+    }
+  ]
+}

package/fixtures/hostile-label/response.json

@@ -0,0 +1,420 @@
+{
+  "status": 200,
+  "body": {
+    "results": {
+      "A": {
+        "status": 200,
+        "frames": [
+          {
+            "schema": {
+              "refId": "A",
+              "meta": {
+                "type": "timeseries-multi",
+                "typeVersion": [
+                  0,
+                  1
+                ]
+              },
+              "fields": [
+                {
+                  "name": "Time",
+                  "type": "time",
+                  "typeInfo": {
+                    "frame": "time.Time"
+                  }
+                },
+                {
+                  "name": "Value",
+                  "type": "number",
+                  "typeInfo": {
+                    "frame": "float64"
+                  },
+                  "labels": {
+                    "handler": "<img src=x onerror=alert(1)>"
+                  },
+                  "config": {
+                    "displayNameFromDS": "<img src=x onerror=alert(1)>"
+                  }
+                }
+              ]
+            },
+            "data": {
+              "values": [
+                [
+                  1790351737294,
+                  1790351797294,
+                  1790351857294,
+                  1790351917294,
+                  1790351977294,
+                  1790352037294,
+                  1790352097294,
+                  1790352157294,
+                  1790352217294,
+                  1790352277294,
+                  1790352337294,
+                  1790352397294,
+                  1790352457294,
+                  1790352517294,
+                  1790352577294,
+                  1790352637294,
+                  1790352697294,
+                  1790352757294,
+                  1790352817294,
+                  1790352877294,
+                  1790352937294,
+                  1790352997294,
+                  1790353057294,
+                  1790353117294,
+                  1790353177294,
+                  1790353237294,
+                  1790353297294,
+                  1790353357294,
+                  1790353417294,
+                  1790353477294
+                ],
+                [
+                  10,
+                  10.65,
+                  11.24,
+                  11.68,
+                  11.94,
+                  11.99,
+                  11.82,
+                  11.45,
+                  10.91,
+                  10.28,
+                  9.62,
+                  9,
+                  8.49,
+                  8.14,
+                  8,
+                  8.08,
+                  8.37,
+                  8.84,
+                  9.44,
+                  10.1,
+                  10.75,
+                  11.31,
+                  11.73,
+                  11.97,
+                  11.98,
+                  11.77,
+                  11.38,
+                  10.82,
+                  10.18,
+                  9.52
+                ]
+              ]
+            }
+          },
+          {
+            "schema": {
+              "refId": "A",
+              "meta": {
+                "type": "timeseries-multi",
+                "typeVersion": [
+                  0,
+                  1
+                ]
+              },
+              "fields": [
+                {
+                  "name": "Time",
+                  "type": "time",
+                  "typeInfo": {
+                    "frame": "time.Time"
+                  }
+                },
+                {
+                  "name": "Value",
+                  "type": "number",
+                  "typeInfo": {
+                    "frame": "float64"
+                  },
+                  "labels": {
+                    "handler": "</script><script>alert(2)</script>"
+                  },
+                  "config": {
+                    "displayNameFromDS": "</script><script>alert(2)</script>"
+                  }
+                }
+              ]
+            },
+            "data": {
+              "values": [
+                [
+                  1790351737294,
+                  1790351797294,
+                  1790351857294,
+                  1790351917294,
+                  1790351977294,
+                  1790352037294,
+                  1790352097294,
+                  1790352157294,
+                  1790352217294,
+                  1790352277294,
+                  1790352337294,
+                  1790352397294,
+                  1790352457294,
+                  1790352517294,
+                  1790352577294,
+                  1790352637294,
+                  1790352697294,
+                  1790352757294,
+                  1790352817294,
+                  1790352877294,
+                  1790352937294,
+                  1790352997294,
+                  1790353057294,
+                  1790353117294,
+                  1790353177294,
+                  1790353237294,
+                  1790353297294,
+                  1790353357294,
+                  1790353417294,
+                  1790353477294
+                ],
+                [
+                  14.68,
+                  14.94,
+                  14.99,
+                  14.82,
+                  14.45,
+                  13.91,
+                  13.28,
+                  12.62,
+                  12,
+                  11.49,
+                  11.14,
+                  11,
+                  11.08,
+                  11.37,
+                  11.84,
+                  12.44,
+                  13.1,
+                  13.75,
+                  14.31,
+                  14.73,
+                  14.97,
+                  14.98,
+                  14.77,
+                  14.38,
+                  13.82,
+                  13.18,
+                  12.52,
+                  11.91,
+                  11.42,
+                  11.11
+                ]
+              ]
+            }
+          },
+          {
+            "schema": {
+              "refId": "A",
+              "meta": {
+                "type": "timeseries-multi",
+                "typeVersion": [
+                  0,
+                  1
+                ]
+              },
+              "fields": [
+                {
+                  "name": "Time",
+                  "type": "time",
+                  "typeInfo": {
+                    "frame": "time.Time"
+                  }
+                },
+                {
+                  "name": "Value",
+                  "type": "number",
+                  "typeInfo": {
+                    "frame": "float64"
+                  },
+                  "labels": {
+                    "handler": "{{constructor.constructor(\"alert(3)\")()}}"
+                  },
+                  "config": {
+                    "displayNameFromDS": "{{constructor.constructor(\"alert(3)\")()}}"
+                  }
+                }
+              ]
+            },
+            "data": {
+              "values": [
+                [
+                  1790351737294,
+                  1790351797294,
+                  1790351857294,
+                  1790351917294,
+                  1790351977294,
+                  1790352037294,
+                  1790352097294,
+                  1790352157294,
+                  1790352217294,
+                  1790352277294,
+                  1790352337294,
+                  1790352397294,
+                  1790352457294,
+                  1790352517294,
+                  1790352577294,
+                  1790352637294,
+                  1790352697294,
+                  1790352757294,
+                  1790352817294,
+                  1790352877294,
+                  1790352937294,
+                  1790352997294,
+                  1790353057294,
+                  1790353117294,
+                  1790353177294,
+                  1790353237294,
+                  1790353297294,
+                  1790353357294,
+                  1790353417294,
+                  1790353477294
+                ],
+                [
+                  17.82,
+                  17.45,
+                  16.91,
+                  16.28,
+                  15.62,
+                  15,
+                  14.49,
+                  14.14,
+                  14,
+                  14.08,
+                  14.37,
+                  14.84,
+                  15.44,
+                  16.1,
+                  16.75,
+                  17.31,
+                  17.73,
+                  17.97,
+                  17.98,
+                  17.77,
+                  17.38,
+                  16.82,
+                  16.18,
+                  15.52,
+                  14.91,
+                  14.42,
+                  14.11,
+                  14,
+                  14.11,
+                  14.43
+                ]
+              ]
+            }
+          },
+          {
+            "schema": {
+              "refId": "A",
+              "meta": {
+                "type": "timeseries-multi",
+                "typeVersion": [
+                  0,
+                  1
+                ]
+              },
+              "fields": [
+                {
+                  "name": "Time",
+                  "type": "time",
+                  "typeInfo": {
+                    "frame": "time.Time"
+                  }
+                },
+                {
+                  "name": "Value",
+                  "type": "number",
+                  "typeInfo": {
+                    "frame": "float64"
+                  },
+                  "labels": {
+                    "handler": "\"><svg onload=alert(4)>"
+                  },
+                  "config": {
+                    "displayNameFromDS": "\"><svg onload=alert(4)>"
+                  }
+                }
+              ]
+            },
+            "data": {
+              "values": [
+                [
+                  1790351737294,
+                  1790351797294,
+                  1790351857294,
+                  1790351917294,
+                  1790351977294,
+                  1790352037294,
+                  1790352097294,
+                  1790352157294,
+                  1790352217294,
+                  1790352277294,
+                  1790352337294,
+                  1790352397294,
+                  1790352457294,
+                  1790352517294,
+                  1790352577294,
+                  1790352637294,
+                  1790352697294,
+                  1790352757294,
+                  1790352817294,
+                  1790352877294,
+                  1790352937294,
+                  1790352997294,
+                  1790353057294,
+                  1790353117294,
+                  1790353177294,
+                  1790353237294,
+                  1790353297294,
+                  1790353357294,
+                  1790353417294,
+                  1790353477294
+                ],
+                [
+                  19.28,
+                  18.62,
+                  18,
+                  17.49,
+                  17.14,
+                  17,
+                  17.08,
+                  17.37,
+                  17.84,
+                  18.44,
+                  19.1,
+                  19.75,
+                  20.31,
+                  20.73,
+                  20.97,
+                  20.98,
+                  20.77,
+                  20.38,
+                  19.82,
+                  19.18,
+                  18.52,
+                  17.91,
+                  17.42,
+                  17.11,
+                  17,
+                  17.11,
+                  17.43,
+                  17.93,
+                  18.54,
+                  19.2
+                ]
+              ]
+            }
+          }
+        ]
+      }
+    }
+  }
+}