test: seq, state

packages/mermaid/src/diagrams/sequence/sequenceDiagram.spec.js

@@ -2033,4 +2033,10 @@ participant Alice`;
       );
     });
   });
+
+  it.each(['__proto__', 'constructor'])('should allow %s as an actor name', function (prop) {
+    mermaidAPI.parse(`
+sequenceDiagram
+${prop}-->>A: Hello, how are you?`);
+  });
 });

packages/mermaid/src/diagrams/state/parser/state-parser.spec.js

@@ -130,4 +130,16 @@ describe('state parser can parse...', () => {
       expect(states.get('bigState1').doc[1].description).toEqual('inner state 2');
     });
   });
+
+  describe('unsafe properties as state names', () => {
+    it.each(['__proto__', 'constructor'])('should allow %s as a state name', function (prop) {
+      stateDiagram.parser.parse(`
+stateDiagram-v2
+[*] --> ${prop}
+${prop} --> [*]`);
+      stateDiagram.parser.yy.extract(stateDiagram.parser.yy.getRootDocV2());
+      const states = stateDiagram.parser.yy.getStates();
+      expect(states.get(prop)).not.toBeUndefined();
+    });
+  });
 });

packages/mermaid/src/diagrams/state/parser/state-style.spec.js

@@ -60,6 +60,16 @@ describe('ClassDefs and classes when parsing a State diagram', () => {
         expect(classes.get('exampleStyleClass').styles[0]).toBe('background:  #bbb');
         expect(classes.get('exampleStyleClass').styles[1]).toBe('border:1.5px solid red');
       });
+
+      it('can have __proto__ or constructor as a class name', function () {
+        stateDiagram.parser.parse(
+          'stateDiagram-v2\n classDef __proto__ background:#bbb,border:1.5px solid red;\n classDef constructor background:#bbb,border:1.5px solid red;'
+        );
+        stateDiagram.parser.yy.extract(stateDiagram.parser.yy.getRootDocV2());
+        const classes = stateDiagram.parser.yy.getClasses();
+        expect(classes.get('__proto__').styles.length).toBe(2);
+        expect(classes.get('constructor').styles.length).toBe(2);
+      });
     });
 
     describe('applying to states in the diagram', () => {