Sanitise string embedded in tooltip - #1536

c3.js

@@ -3913,15 +3913,15 @@
             if (! (d[i] && (d[i].value || d[i].value === 0))) { continue; }
 
             if (! text) {
-                title = titleFormat ? titleFormat(d[i].x) : d[i].x;
+                title = sanitise(titleFormat ? titleFormat(d[i].x) : d[i].x);
                 text = "<table class='" + $$.CLASS.tooltip + "'>" + (title || title === 0 ? "<tr><th colspan='2'>" + title + "</th></tr>" : "");
             }
 
-            value = valueFormat(d[i].value, d[i].ratio, d[i].id, d[i].index, d);
+            value = sanitise(valueFormat(d[i].value, d[i].ratio, d[i].id, d[i].index, d));
             if (value !== undefined) {
                 // Skip elements when their name is set to null
                 if (d[i].name === null) { continue; }
-                name = nameFormat(d[i].name, d[i].ratio, d[i].id, d[i].index);
+                name = sanitise(nameFormat(d[i].name, d[i].ratio, d[i].id, d[i].index));
                 bgcolor = $$.levelColor ? $$.levelColor(d[i].value) : color(d[i].id);
 
                 text += "<tr class='" + $$.CLASS.tooltipName + "-" + $$.getTargetSelectorSuffix(d[i].id) + "'>";
@@ -6100,6 +6100,9 @@
             });
             return found;
         },
+        sanitise = c3_chart_internal_fn.sanitise = function (str) {
+            return typeof str === 'string' ? str.replace(/</g, '&lt;').replace(/>/g, '&gt;') : str;
+        },
         getPathBox = c3_chart_internal_fn.getPathBox = function (path) {
             var box = path.getBoundingClientRect(),
                 items = [path.pathSegList.getItem(0), path.pathSegList.getItem(1)],

src/tooltip.js

@@ -55,15 +55,15 @@ c3_chart_internal_fn.getTooltipContent = function (d, defaultTitleFormat, defaul
         if (! (d[i] && (d[i].value || d[i].value === 0))) { continue; }
 
         if (! text) {
-            title = titleFormat ? titleFormat(d[i].x) : d[i].x;
+            title = sanitise(titleFormat ? titleFormat(d[i].x) : d[i].x);
             text = "<table class='" + $$.CLASS.tooltip + "'>" + (title || title === 0 ? "<tr><th colspan='2'>" + title + "</th></tr>" : "");
         }
 
-        value = valueFormat(d[i].value, d[i].ratio, d[i].id, d[i].index, d);
+        value = sanitise(valueFormat(d[i].value, d[i].ratio, d[i].id, d[i].index, d));
         if (value !== undefined) {
             // Skip elements when their name is set to null
             if (d[i].name === null) { continue; }
-            name = nameFormat(d[i].name, d[i].ratio, d[i].id, d[i].index);
+            name = sanitise(nameFormat(d[i].name, d[i].ratio, d[i].id, d[i].index));
             bgcolor = $$.levelColor ? $$.levelColor(d[i].value) : color(d[i].id);
 
             text += "<tr class='" + $$.CLASS.tooltipName + "-" + $$.getTargetSelectorSuffix(d[i].id) + "'>";

src/util.js

@@ -38,6 +38,9 @@ var isValue = c3_chart_internal_fn.isValue = function (v) {
         });
         return found;
     },
+    sanitise = c3_chart_internal_fn.sanitise = function (str) {
+        return typeof str === 'string' ? str.replace(/</g, '&lt;').replace(/>/g, '&gt;') : str;
+    },
     getPathBox = c3_chart_internal_fn.getPathBox = function (path) {
         var box = path.getBoundingClientRect(),
             items = [path.pathSegList.getItem(0), path.pathSegList.getItem(1)],