Remove dangerouslySetInnerHTML in StackTraceMessage component (#4373)

Druid sometimes returns error message that are contained in "<>", as in
`<urlopen error [Errno 61] Connection refused>`. Since Superset's
approach is often to bubble up messages coming from external library,
it's impossible to predict whether it will contain special characters.

There are some cases where our error handling does return some html
(presto?),
but we should manage that upstream. Plus the current setup has security concerns,
so let's move away from that.
This commit is contained in:
Maxime Beauchemin 2018-02-07 14:32:45 -08:00 committed by GitHub
parent 803738436e
commit 90d9616f2b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 8 deletions

View File

@ -26,20 +26,13 @@ class StackTraceMessage extends React.PureComponent {
}
render() {
const msg = (
<div>
<p
dangerouslySetInnerHTML={{ __html: this.props.message }}
/>
</div>);
return (
<div className={`stack-trace-container${this.hasTrace() ? ' has-trace' : ''}`}>
<Alert
bsStyle="warning"
onClick={() => this.setState({ showStackTrace: !this.state.showStackTrace })}
>
{msg}
{this.props.message}
</Alert>
{this.hasTrace() &&
<Collapse in={this.state.showStackTrace}>