Skip to content

UI: move escaping in charts from consumers to renderer (46966) #11119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thibsy merged 2 commits into from
Feb 26, 2026
Merged

UI: move escaping in charts from consumers to renderer (46966) #11119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb11820
UI: move escaping in charts from consumers to renderer (46966)
schmitz-ilias Feb 13, 2026
b2ac21d
UI: unit tests for escaping in bar charts
schmitz-ilias Feb 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 2 additions & 7 deletions components/ILIAS/Poll/classes/BlockGUI/Results/class.ilPollResultsRenderer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ protected function renderStackedChart(
$tooltips = [];
$color_index = 0;
foreach ($results->getOrderedAnswerIds() as $id) {
$label = $this->htmlSpecialCharsAsEntities($results->getAnswerText($id));
$label = nl2br($results->getAnswerText($id));
$total_votes = $results->getAnswerTotal($id);
$tooltip = $total_votes . ' (' . round($results->getAnswerPercentage($id)) . '%)';
$bar_config = new BarConfig();
Expand Down Expand Up @@ -135,7 +135,7 @@ protected function renderBarChart(
$dataset = $this->data_factory->dataset([$votes_label => $c_dimension]);

foreach ($results->getOrderedAnswerIds() as $id) {
$label = $this->htmlSpecialCharsAsEntities($results->getAnswerText($id));
$label = nl2br($results->getAnswerText($id));
$total_votes = $results->getAnswerTotal($id);
$tooltip = $total_votes . ' (' . round($results->getAnswerPercentage($id)) . '%)';
$dataset = $dataset->withPoint($label, [$votes_label => $total_votes])
Expand All @@ -151,9 +151,4 @@ protected function renderBarChart(
->withBarConfigs([$votes_label => $bar_config]);
$tpl->setVariable('CHART', $this->ui_renderer->render($chart));
}

protected function htmlSpecialCharsAsEntities(string $string): string
{
return $this->refinery->encode()->htmlSpecialCharsAsEntities()->transform(nl2br($string));
}
}
20 changes: 11 additions & 9 deletions components/ILIAS/UI/src/Implementation/Component/Chart/Bar/Renderer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ function ($id) use ($options, $data, $y_labels, $tooltips) {

protected function renderBasics(Bar\Bar $component, Template $tpl): void
{
$tpl->setVariable("TITLE", $component->getTitle());
$tpl->setVariable("TITLE", $this->convertSpecialCharacters($component->getTitle()));
$height = "";
if ($component instanceof Bar\Horizontal) {
$height = $this->determineHeightForHorizontal($component);
Expand Down Expand Up @@ -166,30 +166,32 @@ protected function getAccessibilityList(

foreach ($points_per_dimension as $dimension_name => $item_points) {
$entries = [];
foreach ($item_points as $messeaurement_item_label => $point) {
if (isset($tooltips_per_dimension[$dimension_name][$messeaurement_item_label])) {
foreach ($item_points as $measurement_item_label => $point) {
// use numeric value as default
if (isset($tooltips_per_dimension[$dimension_name][$measurement_item_label])) {
// use custom tooltips if defined
$entries[] = $messeaurement_item_label . ": " . $tooltips_per_dimension[$dimension_name][$messeaurement_item_label];
$entry = $measurement_item_label . ": " . $tooltips_per_dimension[$dimension_name][$measurement_item_label];
} elseif (is_array($point)) {
// handle range values
$range = "";
foreach ($point as $p) {
$range .= $p . " - ";
}
$range = rtrim($range, " -");
$entries[] = $messeaurement_item_label . ": " . $range;
$entry = $measurement_item_label . ": " . $range;
} elseif (is_null($point)) {
// handle null values
$entries[] = $messeaurement_item_label . ": -";
$entry = $measurement_item_label . ": -";
} elseif (!empty($value_labels) && is_int($point) && !empty($value_labels[$point - $lowest])) {
// use custom value labels if defined
$entries[] = $messeaurement_item_label . ": " . $value_labels[$point - $lowest];
$entry = $measurement_item_label . ": " . $value_labels[$point - $lowest];
} else {
// use numeric value for all other cases
$entries[] = $messeaurement_item_label . ": " . $point;
$entry = $measurement_item_label . ": " . $point;
}
$entries[] = $this->convertSpecialCharacters($entry);
}
$list_items[$dimension_name] = $ui_fac->listing()->unordered($entries);
$list_items[$this->convertSpecialCharacters($dimension_name)] = $ui_fac->listing()->unordered($entries);
}

$list = $ui_fac->listing()->descriptive($list_items);
Expand Down
97 changes: 94 additions & 3 deletions components/ILIAS/UI/tests/Component/Chart/Bar/ChartBarTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@

declare(strict_types=1);

require_once(__DIR__ . "/../../../../../../../vendor/composer/vendor/autoload.php");
require_once(__DIR__ . "/../../../Base.php");

use ILIAS\UI\Component as C;
use ILIAS\UI\Implementation as I;

Expand Down Expand Up @@ -394,6 +391,100 @@ public function testRenderVertical(): void
</dd>
</dl>
</div>
EOT;

$this->assertHTMLEquals("<div>" . $expected_html . "</div>", "<div>" . $html . "</div>");
}

public static function provideRiskyData(): array
{
return [
"ampersand" => ["this&that", "this&amp;that"],
"single quote" => ["it's a kind of magic", "it&#039;s a kind of magic"],
"double quote" => ['Dwayne "The Rock" Johnson', 'Dwayne &quot;The Rock&quot; Johnson'],
"tags" => ['<script>alert("XSS")</script>', '&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;'],
];
}

/**
* @dataProvider provideRiskyData
*/
public function testRenderConvertSpecialCharactersInDatasetLabel(
string $risky_datum,
string $expected_in_html
): void {
$r = $this->getDefaultRenderer();
$f = $this->getFactory();
$df = $this->getDataFactory();

$c_dimension = $df->dimension()->cardinal();

$dataset = $df->dataset([$risky_datum => $c_dimension]);
$dataset = $dataset->withPoint("Item", [$risky_datum => 123]);

$vertical = $f->vertical(
"bar123",
$dataset
);

$html = $r->render($vertical);

$expected_html = <<<EOT
<div class="il-chart-bar-vertical">
<canvas id="id_1" height="150px" aria-label="bar123" role="img"></canvas>
</div>
<div class="sr-only">
<dl>
<dt>$expected_in_html</dt>
<dd>
<ul>
<li>Item: 123</li>
</ul>
</dd>
</dl>
</div>
EOT;

$this->assertHTMLEquals("<div>" . $expected_html . "</div>", "<div>" . $html . "</div>");
}

/**
* @dataProvider provideRiskyData
*/
public function testRenderConvertSpecialCharactersInItemLabel(
string $risky_datum,
string $expected_in_html
): void {
$r = $this->getDefaultRenderer();
$f = $this->getFactory();
$df = $this->getDataFactory();

$c_dimension = $df->dimension()->cardinal();

$dataset = $df->dataset(["Dataset" => $c_dimension]);
$dataset = $dataset->withPoint($risky_datum, ["Dataset" => 123]);

$vertical = $f->vertical(
"bar123",
$dataset
);

$html = $r->render($vertical);

$expected_html = <<<EOT
<div class="il-chart-bar-vertical">
<canvas id="id_1" height="150px" aria-label="bar123" role="img"></canvas>
</div>
<div class="sr-only">
<dl>
<dt>Dataset</dt>
<dd>
<ul>
<li>$expected_in_html: 123</li>
</ul>
</dd>
</dl>
</div>
EOT;

$this->assertHTMLEquals("<div>" . $expected_html . "</div>", "<div>" . $html . "</div>");
Expand Down