@vaadin/vaadin-charts 6.3.4 → 6.3.5

package/package.json

@@ -10,7 +10,7 @@
   "repository": "vaadin/vaadin-charts",
   "homepage": "https://vaadin.com/charts",
   "name": "@vaadin/vaadin-charts",
-  "version": "6.3.4",
+  "version": "6.3.5",
   "main": "vaadin-chart.js",
   "author": "Vaadin Ltd",
   "license": "SEE LICENSE IN LICENSE.txt",
@@ -32,6 +32,7 @@
   "dependencies": {
     "highcharts": "6.1.4",
     "@polymer/polymer": "^3.0.0",
+    "dompurify": "2.0.5",
     "@vaadin/vaadin-themable-mixin": "^1.5.2",
     "@vaadin/vaadin-license-checker": "^2.1.0",
     "@vaadin/vaadin-element-mixin": "^2.3.2"

package/src/vaadin-chart.js

@@ -31,6 +31,107 @@ import 'highcharts/js/es-modules/masters/modules/heatmap.src.js';
 import 'highcharts/js/es-modules/masters/modules/solid-gauge.src.js';
 import 'highcharts/js/es-modules/masters/modules/treemap.src.js';
 import 'highcharts/js/es-modules/masters/modules/no-data-to-display.src.js';
+import DOMPurify from 'dompurify';
+window.sanitizeHighchartsAPI = (Highcharts, DOMPurify) => {
+  var isIE11 = !!window.MSInputMethodContext && !!document.documentMode;
+  if (isIE11) {
+    DOMPurify.setConfig({
+      FORCE_BODY: true,
+    });
+  }
+  // This function will recursively sanitize all strings in the options object
+  // Source: https://jsfiddle.net/highcharts/zd3wcm5L/
+  function stripHTMLRecurse(obj) {
+    if (obj === null || obj === undefined) {
+      return obj;
+    }
+
+    if (typeof obj === 'string') {
+      return DOMPurify.sanitize(obj);
+    }
+
+    if (typeof obj !== 'object') {
+      return obj;
+    }
+
+    Object.keys(obj).forEach((key) => {
+      if (typeof obj[key] === 'string') {
+        obj[key] = DOMPurify.sanitize(obj[key]);
+      } else if (Array.isArray(obj[key])) {
+        obj[key].forEach((item, i) => {
+          obj[key][i] = stripHTMLRecurse(item);
+        });
+      } else if (typeof obj[key] === 'object') {
+        obj[key] = stripHTMLRecurse(obj[key]);
+      }
+    });
+    return obj;
+  }
+
+  const update = Highcharts.Chart.prototype.update;
+  Highcharts.Chart.prototype.update = function(
+    options,
+    redraw,
+    oneToOne,
+    animation
+  ) {
+    options = stripHTMLRecurse(options);
+    return update.call(this, options, redraw, oneToOne, animation);
+  };
+
+  const newChart = Highcharts.chart;
+  Highcharts.chart = function(renderTo, options, callback) {
+    options = stripHTMLRecurse(options);
+    return newChart.call(this, renderTo, options, callback);
+  };
+
+  const newHighstock = Highcharts.stockChart;
+  Highcharts.stockChart = function(renderTo, options, callback) {
+    options = stripHTMLRecurse(options);
+    return newHighstock.call(this, renderTo, options, callback);
+  };
+
+  const axisUpdate = Highcharts.Axis.prototype.update;
+  Highcharts.Axis.prototype.update = function(options, redraw) {
+    options = stripHTMLRecurse(options);
+    return axisUpdate.call(this, options, redraw);
+  };
+
+  const seriesUpdate = Highcharts.Series.prototype.update;
+  Highcharts.Series.prototype.update = function(options, redraw) {
+    options = stripHTMLRecurse(options);
+    return seriesUpdate.call(this, options, redraw);
+  };
+
+  const legendUpdate = Highcharts.Legend.prototype.update;
+  Highcharts.Legend.prototype.update = function(options, redraw) {
+    options = stripHTMLRecurse(options);
+    return legendUpdate.call(this, options, redraw);
+  };
+
+  const addCredits = Highcharts.Chart.prototype.addCredits;
+  Highcharts.Chart.prototype.addCredits = function(credits) {
+    credits = stripHTMLRecurse(credits);
+    return addCredits.call(this, credits);
+  };
+
+  const setTitle = Highcharts.Chart.prototype.setTitle;
+  Highcharts.Chart.prototype.setTitle = function(
+    titleOptions,
+    subtitleOptions,
+    redraw
+  ) {
+    titleOptions = stripHTMLRecurse(titleOptions);
+    subtitleOptions = stripHTMLRecurse(subtitleOptions);
+    return setTitle.call(this, titleOptions, subtitleOptions, redraw);
+  };
+
+  const tooltipUpdate = Highcharts.Tooltip.prototype.update;
+  Highcharts.Tooltip.prototype.update = function(options) {
+    options = stripHTMLRecurse(options);
+    return tooltipUpdate.call(this, options);
+  };
+};
 
 /** @private */
 // eslint-disable-next-line no-unused-vars
@@ -89,6 +190,9 @@ if (!PolymerElement) {
   console.warn(`Unexpected Polymer version ${Polymer.version} is used, expected v2.0.0 or later.`);
 }
 
+// eslint-disable-next-line no-undef
+sanitizeHighchartsAPI(Highcharts, DOMPurify);
+
 /**
  * `<vaadin-chart>` is a Web Component for creating high quality charts.
  *
@@ -380,7 +484,7 @@ class ChartElement extends ElementMixin(ThemableMixin(PolymerElement)) {
   }
 
   static get version() {
-    return '6.3.4';
+    return '6.3.5';
   }
 
   static get cvdlName() {