Repository navigation
Conversation
The URL metadata of a report row is based on tracked data and can use any scheme, so it is filtered through UrlHelper::isLookLikeSafeUrl() before it becomes part of the treemap data, checked again in the browser, and opened without giving the new window access to the opener document. The 5.x guard around window.vueSanitizeUrl is dropped here, since every Matomo this branch supports ships the helper. (cherry picked from commit a2eddfb)
A blank url metadata passes isLookLikeSafeUrl() and picks up the http:// prefix, so a row such as "Page URL not defined" gains a link icon that opens the bare scheme. The same fix is still owed on 5.x-dev.
AltamashShaikh
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Forward-ports #102 to
6.x-dev, so a treemap only opens node URLs that are safe to open.A row's
urlmetadata comes from tracked data and can use any scheme, and the treemap opens it when a node is clicked. It is now filtered throughUrlHelper::isLookLikeSafeUrl()before it becomes part of the treemap data, a URL without a scheme is prefixed withhttp://so it is not resolved against the Matomo URL, the browser checks it again withwindow.vueSanitizeUrl(), and the new window no longer gets access to the opener document.Two deliberate differences from the 5.x change:
window.vueSanitizeUrlonly where it exists, because the plugin supports Matomo 5.0 and the helper arrived in 5.11. Every Matomo this branch supports ships it, so the guard is dropped.urlmetadata passed the safety check and picked up thehttp://prefix, which put a link icon on rows such as "Page URL not defined" — that is what moved the screenshot on 5.x. The second commit drops blank URLs instead, so those rows render as they did before and the 6.x baseline is left as it is. The same fix is still owed on5.x-dev.Released as 6.0.1, since 6.0.0 is already out.
Verified locally: PHPCS and PHPStan clean on the changed files, and the plugin's unit tests pass (9/9).
Issue No
AS-706 — forward-port of #102.
Steps to Replicate the Issue
See #102; the behaviour and the tests are the same on this branch.
Checklist