From 8e936e00e7b4e0e82ecf74ba7ee05f705eef16bf Mon Sep 17 00:00:00 2001 From: rusackas Date: Tue, 28 Jul 2026 04:51:27 -0700 Subject: [PATCH] fix(drilldetail): sanitize explore URL before navigation CodeQL flagged a DOM-XSS taint path (js/xss-through-dom) from DashboardPageIdContext into window.location.href via generateExploreUrl. Wrap the generated URL in sanitizeUrl(), matching the existing convention used elsewhere for window.location.href assignments (e.g. ResultSet, SaveDatasetModal, navigationUtils). Co-Authored-By: Claude --- .../src/components/Chart/DrillDetail/DrillDetailModal.tsx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/superset-frontend/src/components/Chart/DrillDetail/DrillDetailModal.tsx b/superset-frontend/src/components/Chart/DrillDetail/DrillDetailModal.tsx index 8da32eafae4..5dbbeebd4d3 100644 --- a/superset-frontend/src/components/Chart/DrillDetail/DrillDetailModal.tsx +++ b/superset-frontend/src/components/Chart/DrillDetail/DrillDetailModal.tsx @@ -18,6 +18,7 @@ */ import { useContext, useMemo, useState } from 'react'; +import { sanitizeUrl } from '@braintree/sanitize-url'; import { BinaryQueryObjectFilterClause, css, @@ -171,7 +172,7 @@ export default function DrillDetailModal({ }, ); - window.location.href = url; + window.location.href = sanitizeUrl(url); } catch (error) { console.error('Failed to generate chart explore URL:', error); addDangerToast(t('Failed to generate chart explore URL'));