Re: [PATCH v3 2/2] perf python: treport add flamegraph support

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Rich markup injection vulnerability from unescaped DSO/symbol names containing brackets.
--

--- Patch [2]: [PATCH v3 2/2] perf python: treport add flamegraph support ---
commit 0b23e0e4520eaa617a120b39e7e4595517aedb98
Author: Alice Rogers <[email protected]>

    perf python: treport add flamegraph support
    
    Implement a flamegraph widget that recursively walks down a tree
    splitting line segments based on their value. A visitor pattern is used
    so that the same logic can both draw the line segments and locate which
    segment had a mouse click. Add a tab for the flame graph widget.

> diff --git a/tools/perf/python/treport.py b/tools/perf/python/treport.py
> index 528a640e4d356..ec3263a6b6257 100755
> --- a/tools/perf/python/treport.py
> +++ b/tools/perf/python/treport.py

[ ... ]

> @@ -120,6 +150,327 @@ class ProfileNode:
>                              key=lambda pnode: pnode.value, reverse=True):
>              pnode.add_to_tree(new_node, root_value)

[Severity: Medium]
Will this crash the TUI application when handling typical perf traces?

Looking at ProfileNode.add_to_tree(), self.name is embedded directly into a
formatted string alongside rich style tags:

    if root_value != 0:
        percent = self.value / root_value * 100
        label = f"{self.name} [r]{percent:.3g}%[/]"

Since perf trace data heavily uses brackets for kernel threads (e.g.,
[kworker/0:1]), DSOs (e.g., [kernel.kallsyms]), or placeholders like
[unknown], the Textual Tree widget's rich parser may intercept these as
unclosed or invalid markup tags. 

Does this unescaped input trigger a fatal rich.errors.MarkupError when
constructing the Tree widget?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2