fix(charts): strip ECharts navigation sinks from .chart documents

[waleedlatif1]

Summary

• confineOptionToCanvas closed the ECharts DOM sinks (tooltip innerHTML, toolbox dataView/saveAsImage) but left the navigation ones open — title.link, title.sublink, and a link on a treemap or sunburst data item each reach windowOpen, which assigns the URL to location.href
• A .chart document is author-controlled and rendered with setOption() straight into the app document (unsandboxed, unlike the HTML preview alongside it), including on the anonymous /f/<token> share route — so a javascript: URL in one executed script on the app origin on a single click
• Drop link/sublink everywhere in the walk alongside toolbox. A chart has no reason to navigate its viewer, so they're stripped rather than scheme-checked, which would still leave an open redirect on an authenticated origin
• target/subtarget are left alone — all four call sites are guarded on a truthy link, so removing the link is sufficient and avoids collateral on any unrelated target key

Type of Change

• Bug fix

Testing

• apps/sim/lib/charts/spec.test.ts — 23/23 passing; the two new tests were confirmed red against the unpatched sanitizer first
• One test pins the sanitizer output (title link/sublink plus treemap and sunburst item links, including under baseOption and media); the other renders through real echarts and asserts the title component resolves no link/sublink to hand to windowOpen
• bun run lint, bun run check:audits (39/39), check-block-registry all pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 30, 2026 7:02pm

[greptile-apps]

Greptile Summary

This PR strengthens .chart document confinement by removing ECharts navigation sinks before rendering author-controlled chart options in the application document.

• Strips link and sublink throughout chart options alongside the existing toolbox removal.
• Preserves arbitrary dataset row fields by retaining the existing dataset traversal boundary.
• Adds sanitizer and ECharts integration coverage for title, treemap, sunburst, baseOption, and responsive media options.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the changed code.

The recursive confinement removes the targeted navigation keys across nested chart options, retains the intentional dataset boundary, and adds focused sanitizer and integration coverage.

Important Files Changed

Filename	Overview
apps/sim/lib/charts/spec.ts	Extends recursive chart-option confinement to remove ECharts navigation keys while preserving dataset contents.
apps/sim/lib/charts/spec.test.ts	Adds sanitizer and real-ECharts assertions covering navigation keys across title, hierarchical series data, base options, and media options.

_{Reviews (1): Last reviewed commit: "fix(charts): strip ECharts navigation si..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}