Image src urls incorrectly rendered with html entity encodings

[waddles]

What went wrong?

What happened: When triggering a formatted_webhook url for a LibreNMS integration, the payload includes an image_url field but when that url contains url params such as https://avatars.githubusercontent.com/u/5791783?a=b&foo=bar the output is rendered as https://avatars.githubusercontent.com/u/5791783?a=b&foo=bar

This breaks LibreNMS graph urls (server returns a 500), eg.

https://localhost/graph.php?type=device_bits&device=5&height=150&width=300&legend=no&title=yes

The original payload shows correctly when you click the <> button in GroupedIncidentsList.

What did you expect to happen: Images src attributes should not be html entity encoded. It should use the raw url from the JSON payload.

How do we reproduce it?

1. Fire a webhook payload containing an image_url field that has url parameters
2. View the Incidents in Alert Groups page
3. Inspect the element containing the image and see the src attribute has been html entity encoded

See https://github.com/grafana/oncall/blob/0c7281a2559f59e34a7a8870cceddc78540b5160/grafana-plugin/src/pages/incident/Incident.tsx#L652 and https://github.com/grafana/oncall/blob/0c7281a2559f59e34a7a8870cceddc78540b5160/grafana-plugin/src/pages/incident/Incident.tsx#L772

Grafana OnCall Version

v1.3.37

Product Area

Chatops

Grafana OnCall Platform?

None

User's Browser?

No response

Anything else to add?

No response

[Matvey-Kuk]

Thank you for the report! Looks like we need to introduce {% unsafe_url var %} jinja built-in function.

[vadimkerr]

I was able to reproduce the issue, this seems to be a backend bug in OnCall. As a workaround, you can try setting the image_url template to the following value:

{{ payload.image_url | replace("&", "%26") }}

Let me know if this helps 🙂

[luistilingue]

I was able to reproduce the issue, this seems to be a backend bug in OnCall. As a workaround, you can try setting the image_url template to the following value:

{{ payload.image_url | replace("&", "%26") }}

Let me know if this helps 🙂

@vadimkerr is doesn't render image, even encoding the &.