Add activity balance history view to visuals#150
Conversation
✅ Deploy Preview for wyrrdmaek ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| showTooltip(event, entry, segment) { | ||
| const percentValue = Math.round(segment.percentage * 100); | ||
| const durationLabel = formatDuration(Math.round(segment.minutes)); | ||
| const headerParts = []; | ||
| if (entry.label) { | ||
| headerParts.push(`<strong>${entry.label}</strong>`); | ||
| } | ||
| if (entry.timestampLabel) { | ||
| headerParts.push(`<span class="meta">${entry.timestampLabel}</span>`); | ||
| } | ||
| const header = headerParts.join(''); | ||
| this.tooltip.innerHTML = `${header}<span>${segment.label}</span><span>${durationLabel}</span><span>${percentValue}%</span>`; | ||
| this.tooltip.hidden = false; |
There was a problem hiding this comment.
The new ActivityBalanceHistory tooltip builds HTML strings with user‑controlled fields (entry.label, entry.timestampLabel, and segment.label) and assigns them directly via innerHTML. Activity labels originate from schedule data, so a user can supply values like <img src=x onerror=alert(1)>, run the generator, hover a history segment, and have that markup executed in the visuals tab. This introduces a cross‑site scripting hole that did not exist before this component was added. Please render these values via textContent (or escape them) instead of concatenating raw strings.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
Codex Task