fix(charts): strip ECharts navigation sinks from .chart documents

Merged
WA
2mo ago
+51-4

Summary

  • confineOptionToCanvas closed the ECharts DOM sinks (tooltip innerHTML, toolbox dataView/saveAsImage) but left the navigation ones open — title.link, title.sublink, and a link on a treemap or sunburst data item each reach windowOpen, which assigns the URL to location.href
  • A .chart document is author-controlled and rendered with setOption() straight into the app document (unsandboxed, unlike the HTML preview alongside it), including on the anonymous /f/<token> share route — so a javascript: URL in one executed script on the app origin on a single click
  • Drop link/sublink everywhere in the walk alongside toolbox. A chart has no reason to navigate its viewer, so they're stripped rather than scheme-checked, which would still leave an open redirect on an authenticated origin
  • target/subtarget are left alone — all four call sites are guarded on a truthy link, so removing the link is sufficient and avoids collateral on any unrelated target key

Type of Change

  • Bug fix

Testing

  • apps/sim/lib/charts/spec.test.ts — 23/23 passing; the two new tests were confirmed red against the unpatched sanitizer first
  • One test pins the sanitizer output (title link/sublink plus treemap and sunburst item links, including under baseOption and media); the other renders through real echarts and asserts the title component resolves no link/sublink to hand to windowOpen
  • bun run lint, bun run check:audits (39/39), check-block-registry all pass

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)