Splunk Apps » Lookup Editor

• I am using updateTable() to override the cell values.
• The cell contents are getting executed before my render even gets called.
• This line is where the issue is coming from:

        // Append nodes to the HTML
        for (j = 0; j < obj.options.data.length; j++) {
            // Create row
            var tr = obj.createRow(j, obj.options.data[j]);
            // Append line to the table
            if (j >= startNumber && j < finalNumber) {
                obj.tbody.appendChild(tr);
            }
        }

• Where is the XSS getting executed?
  • Just passing the data causes this
• Does jexcel have some sort of XSS protection I ought to be enabling?
  • https://github.com/paulhodel/jexcel/issues/959
• Can I disable formulas?
  • https://github.com/paulhodel/jexcel/issues/102
• Does it work if I remove my custom renderer?
  • No, my custom renderer was actually improving things somehow
• Does removing custom columns help?
  • Nope
• Does 4.0 have this issue?
  • Cannot get it loaded

Jexcel 4 doesn't load: Module name "jsuites/dist/jsuites.css" has not been loaded yet for context: _. Use require([])

• Why is the module named "jsuites/dist/jsuites.css"? I don't have it under dist
• Why is it complaining for _"

• jsuites is trying to load it:

if (! jSuites && typeof(require) === 'function') {
    var jSuites = require('jsuites');
    require('jsuites/dist/jsuites.css');

• Put jexcel in a require("jexcel") call
  • Nope
• Move jsuites under jexcel directory
• Remove jsuites css require call
  • This fixed it

• https://requirejs.org/docs/errors.html#notloaded