From 518f607db32894dcf45d9a4fa44acb0f59170692 Mon Sep 17 00:00:00 2001
From: Fine0830 <fanxue0830@gmail.com>
Date: Wed, 16 Jul 2025 16:44:49 +0800
Subject: [PATCH 1/3] fix tracing profiling (#477)

---
 .../related/trace/components/D3Graph/Index.vue      |  2 ++
 .../dashboard/related/trace/components/Table.vue    | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/views/dashboard/related/trace/components/D3Graph/Index.vue b/src/views/dashboard/related/trace/components/D3Graph/Index.vue
index 78d71e09..ae261070 100644
--- a/src/views/dashboard/related/trace/components/D3Graph/Index.vue
+++ b/src/views/dashboard/related/trace/components/D3Graph/Index.vue
@@ -69,6 +69,7 @@ limitations under the License. -->
     type: { type: String, default: TraceGraphType.LIST },
     headerType: { type: String, default: "" },
   });
+  const emits = defineEmits(["select"]);
   const appStore = useAppStoreWithOut();
   const loading = ref<boolean>(false);
   const showDetail = ref<boolean>(false);
@@ -130,6 +131,7 @@ limitations under the License. -->
     refParentSpans.value = [];
     if (props.type === TraceGraphType.TABLE) {
       currentSpan.value = i;
+      emits("select", i);
     } else {
       currentSpan.value = i.data;
     }
diff --git a/src/views/dashboard/related/trace/components/Table.vue b/src/views/dashboard/related/trace/components/Table.vue
index 8ec36c47..171f0e5c 100644
--- a/src/views/dashboard/related/trace/components/Table.vue
+++ b/src/views/dashboard/related/trace/components/Table.vue
@@ -12,7 +12,13 @@ See the License for the specific language governing permissions and
 limitations under the License. -->
 <template>
   <div class="trace-table-charts">
-    <Graph :data="data" :traceId="traceId" :type="TraceGraphType.TABLE" :headerType="headerType" />
+    <Graph
+      :data="data"
+      :traceId="traceId"
+      :type="TraceGraphType.TABLE"
+      :headerType="headerType"
+      @select="getSelectedSpan"
+    />
   </div>
 </template>
 <script lang="ts" setup>
@@ -26,6 +32,11 @@ limitations under the License. -->
     traceId: { type: String, default: "" },
     headerType: { type: String, default: "" },
   });
+  const emits = defineEmits(["select"]);
+
+  function getSelectedSpan(span: Span) {
+    emits("select", span);
+  }
 </script>
 <style lang="scss" scoped>
   .trace-table-charts {

From 5d311a41a24e15fd0a3b43a8029113ee19d83391 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 17 Jul 2025 09:59:23 +0800
Subject: [PATCH 2/3] build(deps): bump vue-i18n from 9.14.3 to 9.14.5 (#479)

---
 package-lock.json | 74 ++++++++++++++++++++++-------------------------
 package.json      |  2 +-
 2 files changed, 36 insertions(+), 40 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 293b120f..16b55868 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,7 +18,7 @@
         "vis-timeline": "^7.5.1",
         "vue": "^3.2.45",
         "vue-grid-layout": "^3.0.0-beta1",
-        "vue-i18n": "^9.14.3",
+        "vue-i18n": "^9.14.5",
         "vue-router": "^4.1.6",
         "vue-types": "^4.1.1"
       },
@@ -1966,13 +1966,12 @@
       "integrity": "sha512-sZAW08CkqgvqRjUIaLRjScjObcCzN9D75yekLA21EClYAZIhi4A+GEt2z/WqOCOksTaEPLYmQyhkpXcboc0LhQ=="
     },
     "node_modules/@intlify/core-base": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-9.14.3.tgz",
-      "integrity": "sha512-nbJ7pKTlXFnaXPblyfiH6awAx1C0PWNNuqXAR74yRwgi5A/Re/8/5fErLY0pv4R8+EHj3ZaThMHdnuC/5OBa6g==",
-      "license": "MIT",
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-9.14.5.tgz",
+      "integrity": "sha512-5ah5FqZG4pOoHjkvs8mjtv+gPKYU0zCISaYNjBNNqYiaITxW8ZtVih3GS/oTOqN8d9/mDLyrjD46GBApNxmlsA==",
       "dependencies": {
-        "@intlify/message-compiler": "9.14.3",
-        "@intlify/shared": "9.14.3"
+        "@intlify/message-compiler": "9.14.5",
+        "@intlify/shared": "9.14.5"
       },
       "engines": {
         "node": ">= 16"
@@ -1982,12 +1981,11 @@
       }
     },
     "node_modules/@intlify/message-compiler": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-9.14.3.tgz",
-      "integrity": "sha512-ANwC226BQdd+MpJ36rOYkChSESfPwu3Ss2Faw0RHTOknYLoHTX6V6e/JjIKVDMbzs0/H/df/rO6yU0SPiWHqNg==",
-      "license": "MIT",
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-9.14.5.tgz",
+      "integrity": "sha512-IHzgEu61/YIpQV5Pc3aRWScDcnFKWvQA9kigcINcCBXN8mbW+vk9SK+lDxA6STzKQsVJxUPg9ACC52pKKo3SVQ==",
       "dependencies": {
-        "@intlify/shared": "9.14.3",
+        "@intlify/shared": "9.14.5",
         "source-map-js": "^1.0.2"
       },
       "engines": {
@@ -1998,10 +1996,9 @@
       }
     },
     "node_modules/@intlify/shared": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-9.14.3.tgz",
-      "integrity": "sha512-hJXz9LA5VG7qNE00t50bdzDv8Z4q9fpcL81wj4y4duKavrv0KM8YNLTwXNEFINHjTsfrG9TXvPuEjVaAvZ7yWg==",
-      "license": "MIT",
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-9.14.5.tgz",
+      "integrity": "sha512-9gB+E53BYuAEMhbCAxVgG38EZrk59sxBtv3jSizNL2hEWlgjBjAw1AwpLHtNaeda12pe6W20OGEa0TwuMSRbyQ==",
       "engines": {
         "node": ">= 16"
       },
@@ -13254,13 +13251,12 @@
       }
     },
     "node_modules/vue-i18n": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-9.14.3.tgz",
-      "integrity": "sha512-C+E0KE8ihKjdYCQx8oUkXX+8tBItrYNMnGJuzEPevBARQFUN2tKez6ZVOvBrWH0+KT5wEk3vOWjNk7ygb2u9ig==",
-      "license": "MIT",
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-9.14.5.tgz",
+      "integrity": "sha512-0jQ9Em3ymWngyiIkj0+c/k7WgaPO+TNzjKSNq9BvBQaKJECqn9cd9fL4tkDhB5G1QBskGl9YxxbDAhgbFtpe2g==",
       "dependencies": {
-        "@intlify/core-base": "9.14.3",
-        "@intlify/shared": "9.14.3",
+        "@intlify/core-base": "9.14.5",
+        "@intlify/shared": "9.14.5",
         "@vue/devtools-api": "^6.5.0"
       },
       "engines": {
@@ -14956,27 +14952,27 @@
       "integrity": "sha512-sZAW08CkqgvqRjUIaLRjScjObcCzN9D75yekLA21EClYAZIhi4A+GEt2z/WqOCOksTaEPLYmQyhkpXcboc0LhQ=="
     },
     "@intlify/core-base": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-9.14.3.tgz",
-      "integrity": "sha512-nbJ7pKTlXFnaXPblyfiH6awAx1C0PWNNuqXAR74yRwgi5A/Re/8/5fErLY0pv4R8+EHj3ZaThMHdnuC/5OBa6g==",
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-9.14.5.tgz",
+      "integrity": "sha512-5ah5FqZG4pOoHjkvs8mjtv+gPKYU0zCISaYNjBNNqYiaITxW8ZtVih3GS/oTOqN8d9/mDLyrjD46GBApNxmlsA==",
       "requires": {
-        "@intlify/message-compiler": "9.14.3",
-        "@intlify/shared": "9.14.3"
+        "@intlify/message-compiler": "9.14.5",
+        "@intlify/shared": "9.14.5"
       }
     },
     "@intlify/message-compiler": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-9.14.3.tgz",
-      "integrity": "sha512-ANwC226BQdd+MpJ36rOYkChSESfPwu3Ss2Faw0RHTOknYLoHTX6V6e/JjIKVDMbzs0/H/df/rO6yU0SPiWHqNg==",
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-9.14.5.tgz",
+      "integrity": "sha512-IHzgEu61/YIpQV5Pc3aRWScDcnFKWvQA9kigcINcCBXN8mbW+vk9SK+lDxA6STzKQsVJxUPg9ACC52pKKo3SVQ==",
       "requires": {
-        "@intlify/shared": "9.14.3",
+        "@intlify/shared": "9.14.5",
         "source-map-js": "^1.0.2"
       }
     },
     "@intlify/shared": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-9.14.3.tgz",
-      "integrity": "sha512-hJXz9LA5VG7qNE00t50bdzDv8Z4q9fpcL81wj4y4duKavrv0KM8YNLTwXNEFINHjTsfrG9TXvPuEjVaAvZ7yWg=="
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-9.14.5.tgz",
+      "integrity": "sha512-9gB+E53BYuAEMhbCAxVgG38EZrk59sxBtv3jSizNL2hEWlgjBjAw1AwpLHtNaeda12pe6W20OGEa0TwuMSRbyQ=="
     },
     "@jridgewell/gen-mapping": {
       "version": "0.3.8",
@@ -23097,12 +23093,12 @@
       }
     },
     "vue-i18n": {
-      "version": "9.14.3",
-      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-9.14.3.tgz",
-      "integrity": "sha512-C+E0KE8ihKjdYCQx8oUkXX+8tBItrYNMnGJuzEPevBARQFUN2tKez6ZVOvBrWH0+KT5wEk3vOWjNk7ygb2u9ig==",
+      "version": "9.14.5",
+      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-9.14.5.tgz",
+      "integrity": "sha512-0jQ9Em3ymWngyiIkj0+c/k7WgaPO+TNzjKSNq9BvBQaKJECqn9cd9fL4tkDhB5G1QBskGl9YxxbDAhgbFtpe2g==",
       "requires": {
-        "@intlify/core-base": "9.14.3",
-        "@intlify/shared": "9.14.3",
+        "@intlify/core-base": "9.14.5",
+        "@intlify/shared": "9.14.5",
         "@vue/devtools-api": "^6.5.0"
       }
     },
diff --git a/package.json b/package.json
index efec4b01..304600dd 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
     "vis-timeline": "^7.5.1",
     "vue": "^3.2.45",
     "vue-grid-layout": "^3.0.0-beta1",
-    "vue-i18n": "^9.14.3",
+    "vue-i18n": "^9.14.5",
     "vue-router": "^4.1.6",
     "vue-types": "^4.1.1"
   },

From 1421f95ad3cec360bc9baad32d7bb54c1136d150 Mon Sep 17 00:00:00 2001
From: Fine0830 <fanxue0830@gmail.com>
Date: Thu, 17 Jul 2025 10:41:15 +0800
Subject: [PATCH 3/3] fix: restrict and validate url for widgets (#480)

---
 src/styles/theme.scss                         |  5 +-
 .../dashboard/configuration/ThirdPartyApp.vue | 84 ++++++++++++++++++-
 .../dashboard/controls/ThirdPartyApp.vue      |  2 +
 3 files changed, 86 insertions(+), 5 deletions(-)

diff --git a/src/styles/theme.scss b/src/styles/theme.scss
index 1f90f734..72c04efc 100644
--- a/src/styles/theme.scss
+++ b/src/styles/theme.scss
@@ -150,6 +150,7 @@ $theme-background: var(--theme-background);
 $active-background: var(--el-color-primary);
 $font-size-smaller: 12px;
 $font-size-normal: 14px;
+$error-color: #e66;
 
 .opt:hover {
   background-color: var(--sw-list-hover) !important;
@@ -208,9 +209,9 @@ div.vis-tooltip {
 }
 
 .vis-item.Error {
-  background-color: #e66;
+  background-color: $error-color;
   opacity: 0.8;
-  border-color: #e66;
+  border-color: $error-color;
   color: var(--sw-event-vis-selected) !important;
 }
 
diff --git a/src/views/dashboard/configuration/ThirdPartyApp.vue b/src/views/dashboard/configuration/ThirdPartyApp.vue
index 6e1c7a36..59f2721f 100644
--- a/src/views/dashboard/configuration/ThirdPartyApp.vue
+++ b/src/views/dashboard/configuration/ThirdPartyApp.vue
@@ -13,13 +13,14 @@ limitations under the License. -->
 <template>
   <div class="item">
     <span class="label">{{ t("iframeSrc") }}</span>
-    <el-input class="input" v-model="url" size="small" @change="changeConfig({ url: encodeURIComponent(url) })" />
+    <el-input class="input" v-model="url" size="small" @change="handleUrlChange" :class="{ error: urlError }" />
+    <div v-if="urlError" class="error-message">{{ urlError }}</div>
   </div>
   <div class="footer">
     <el-button size="small" @click="cancelConfig">
       {{ t("cancel") }}
     </el-button>
-    <el-button size="small" type="primary" @click="applyConfig">
+    <el-button size="small" type="primary" @click="applyConfig" :disabled="!!urlError">
       {{ t("apply") }}
     </el-button>
   </div>
@@ -28,24 +29,89 @@ limitations under the License. -->
   import { useI18n } from "vue-i18n";
   import { ref } from "vue";
   import { useDashboardStore } from "@/store/modules/dashboard";
+
   const { t } = useI18n();
   const dashboardStore = useDashboardStore();
   const originConfig = dashboardStore.selectedGrid;
   const widget = originConfig.widget || {};
   const url = ref(widget.url || "");
+  const urlError = ref("");
+
+  // URL validation function to prevent XSS
+  function validateAndSanitizeUrl(inputUrl: string): { isValid: boolean; sanitizedUrl: string; error: string } {
+    if (!inputUrl.trim()) {
+      return { isValid: true, sanitizedUrl: "", error: "" };
+    }
+
+    try {
+      // Create URL object to validate the URL format
+      const urlObj = new URL(inputUrl);
+
+      // Only allow HTTP and HTTPS protocols to prevent XSS
+      if (!["http:", "https:"].includes(urlObj.protocol)) {
+        return {
+          isValid: false,
+          sanitizedUrl: "",
+          error: "Only HTTP and HTTPS URLs are allowed",
+        };
+      }
+
+      // Additional security checks
+      const dangerousProtocols = ["javascript:", "data:", "vbscript:", "le:"];
+      const lowerUrl = inputUrl.toLowerCase();
+
+      for (const protocol of dangerousProtocols) {
+        if (lowerUrl.includes(protocol)) {
+          return {
+            isValid: false,
+            sanitizedUrl: "",
+            error: "Dangerous protocols are not allowed",
+          };
+        }
+      }
+
+      // Return the sanitized URL (using the URL object to normalize it)
+      return {
+        isValid: true,
+        sanitizedUrl: urlObj.href,
+        error: "",
+      };
+    } catch (error) {
+      return {
+        isValid: false,
+        sanitizedUrl: "",
+        error: "Please enter a valid URL",
+      };
+    }
+  }
+
+  function handleUrlChange() {
+    const validation = validateAndSanitizeUrl(url.value);
+    urlError.value = validation.error;
+
+    if (validation.isValid) {
+      changeConfig({ url: validation.sanitizedUrl });
+    }
+  }
+
   function changeConfig(param: { [key: string]: string }) {
     const key = Object.keys(param)[0];
     if (!key) {
       return;
     }
+
     const { selectedGrid } = dashboardStore;
     const widget = {
       ...dashboardStore.selectedGrid.widget,
-      [key]: decodeURIComponent(param[key]),
+      [key]: param[key], // Use the sanitized URL directly, no need for decodeURIComponent
     };
     dashboardStore.selectWidget({ ...selectedGrid, widget });
   }
+
   function applyConfig() {
+    if (urlError.value) {
+      return; // Don't apply if there's a validation error
+    }
     dashboardStore.setConfigPanel(false);
     dashboardStore.setConfigs(dashboardStore.selectedGrid);
   }
@@ -76,6 +142,18 @@ limitations under the License. -->
     margin-bottom: 10px;
   }
 
+  .url-input.error {
+    :deep(.el-input__inner) {
+      border-color: $error-color;
+    }
+  }
+
+  .error-message {
+    color: $error-color;
+    font-size: 12px;
+    margin-top: 4px;
+  }
+
   .footer {
     position: fixed;
     bottom: 0;
diff --git a/src/views/dashboard/controls/ThirdPartyApp.vue b/src/views/dashboard/controls/ThirdPartyApp.vue
index 3103fc1f..9fcf8842 100644
--- a/src/views/dashboard/controls/ThirdPartyApp.vue
+++ b/src/views/dashboard/controls/ThirdPartyApp.vue
@@ -37,6 +37,8 @@ limitations under the License. -->
         height="100%"
         scrolling="no"
         style="border: none"
+        sandbox="allow-scripts allow-same-origin allow-forms allow-popups"
+        referrerpolicy="no-referrer"
       ></iframe>
       <div v-else class="tips">{{ t("iframeWidgetTip") }}</div>
     </div>