diff --git a/.github/workflows/check-readme-in-sync.yml b/.github/workflows/check-readme-in-sync.yml
new file mode 100644
index 000000000..2106e0630
--- /dev/null
+++ b/.github/workflows/check-readme-in-sync.yml
@@ -0,0 +1,34 @@
+# Reference: https://github.com/Yash-Singh1/eslint-plugin-userscripts/blob/main/.github/workflows/readme-in-sync.yml
+
+name: Check if README and docs/README are in sync
+
+on:
+ push:
+ branches:
+ - master
+ - develop
+ pull_request:
+ branches:
+ - master
+ - develop
+
+jobs:
+ check:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v2
+
+ - name: Check for difference in README.md and docs/README.md
+ run: |
+ if [ -z "$(diff README.md docs/README.md --brief)" ]
+ then
+ echo "README.md and docs/README.md are in sync"
+ else
+ echo "Make sure that README.md and docs/README.md are in sync"
+ echo
+ echo "Difference:"
+ echo
+ diff README.md docs/README.md -u
+ exit 1
+ fi
diff --git a/README.md b/README.md
index 01e505792..1f94027cf 100644
--- a/README.md
+++ b/README.md
@@ -215,6 +215,14 @@ Mermaid is a growing community and is always accepting new contributors. There's
Detailed information about how to contribute can be found in the [contribution guide](CONTRIBUTING.md)
+## Security and safe diagrams
+
+For public sites, it can be precarious to retrieve text from users on the internet, storing that content for presentation in a browser at a later stage. The reason is that the user content can contain embedded malicious scripts that will run when the data is presented. For Mermaid this is a risk, specially as mermaid diagrams contain many characters that are used in html which makes the standard sanitation unusable as it also breaks the diagrams. We still make an effort to sanitise the incoming code and keep refining the process but it is hard to guarantee that there are no loop holes.
+
+As an extra level of security for sites with external users we are happy to introduce a new security level in which the diagram is rendered in a sandboxed iframe preventing javascript in the code from being executed. This is a great step forward for better security.
+
+*Unfortunately you can not have a cake and eat it at the same time which in this case means that some of the interactive functionality gets blocked along with the possible malicious code.*
+
## Reporting vulnerabilities
To report a vulnerability, please e-mail security@mermaid.live with a description of the issue, the steps you took to create the issue, affected versions, and if known, mitigations for the issue.
diff --git a/cypress/integration/rendering/flowchart-v2.spec.js b/cypress/integration/rendering/flowchart-v2.spec.js
index 60fba981e..10731de05 100644
--- a/cypress/integration/rendering/flowchart-v2.spec.js
+++ b/cypress/integration/rendering/flowchart-v2.spec.js
@@ -368,6 +368,7 @@ flowchart TD
I{{red text}} -->|default style| J[/blue text/]
K[\\ red text\\] -->|default style| L[/blue text\\]
M[\\ red text/] -->|default style| N[blue text];
+ O(((red text))) -->|default style| P(((blue text)));
linkStyle default color:Sienna;
style A stroke:#ff0000,fill:#ffcccc,color:#ff0000;
style B stroke:#0000ff,fill:#ccccff,color:#0000ff;
@@ -383,6 +384,8 @@ flowchart TD
style L stroke:#0000ff,fill:#ccccff,color:#0000ff;
style M stroke:#ff0000,fill:#ffcccc,color:#ff0000;
style N stroke:#0000ff,fill:#ccccff,color:#0000ff;
+ style O stroke:#ff0000,fill:#ffcccc,color:#ff0000;
+ style P stroke:#0000ff,fill:#ccccff,color:#0000ff;
`,
{ htmlLabels: true, flowchart: { htmlLabels: true }, securityLevel: 'loose', logLevel: 2 }
);
diff --git a/cypress/platform/click_security_sandbox.html b/cypress/platform/click_security_sandbox.html
new file mode 100644
index 000000000..275fea640
--- /dev/null
+++ b/cypress/platform/click_security_sandbox.html
@@ -0,0 +1,170 @@
+
+
+
+
+
+ Mermaid Quick Test Page
+
+
+
+
+
+
+ graph TB
+ Function-->URL
+ click Function clickByFlow "Add a div"
+ click URL "http://localhost:9000/webpackUsage.html" "Visit mermaid docs"
+
+ classDiagram
+ class ShapeLink
+ link ShapeLink "http://localhost:9000/webpackUsage.html" "This is a tooltip for a link"
+ class ShapeCallback
+ callback ShapeCallback "clickByClass" "This is a tooltip for a callback"
+
+
+ classDiagram-v2
+ class ShapeLink2
+ link ShapeLink2 "http://localhost:9000/webpackUsage.html" "This is a tooltip for a link"
+ class ShapeCallback2
+ callback ShapeCallback2 "clickByClass" "This is a tooltip for a callback"
+
+
+
+
+
+ gantt
+ dateFormat YYYY-MM-DD
+ axisFormat %d/%m
+ title Adding GANTT diagram to mermaid
+ excludes weekdays 2014-01-10
+
+ section A section
+ Completed task :done, des1, 2014-01-06,2014-01-08
+ Active task :active, des2, 2014-01-09, 3d
+ Future task : des3, after des2, 5d
+ Future task2 : des4, after des3, 5d
+
+ section Critical tasks
+ Completed task in the critical line :crit, done, 2014-01-06,24h
+ Implement parser and jison :crit, done, after des1, 2d
+ Create tests for parser :crit, active, 3d
+ Future task in critical line :crit, 5d
+ Create tests for renderer :2d
+ Add to mermaid :1d
+
+ section Documentation
+ Describe gantt syntax :active, a1, after des1, 3d
+ Add gantt diagram to demo page :after a1 , 20h
+ Add another diagram to demo page :doc1, after a1 , 48h
+
+ section Clickable
+ Visit mermaidjs :active, cl1, 2014-01-07,2014-01-10
+ Calling a Callback (look at the console log) :cl2, after cl1, 3d
+ Calling a Callback with args :cl3, after cl1, 3d
+
+ click cl1 href "http://localhost:9000/webpackUsage.html"
+ click cl2 call clickByGantt()
+ click cl3 call clickByGantt("test1", test2, test3)
+
+ section Last section
+ Describe gantt syntax :after doc1, 3d
+ Add gantt diagram to demo page : 20h
+ Add another diagram to demo page : 48h
+
+ classDiagram
+ class ShapeLink
+ link ShapeLink "http://localhost:9000/webpackUsage.html" "This is a tooltip for a link"
+ class ShapeCallback
+ click ShapeCallback call clickByClass(123) "This is a tooltip for a callback"
+
+
+
+ classDiagram-v2
+ class ShapeLink2
+ link ShapeLink2 "http://localhost:9000/webpackUsage.html" "This is a tooltip for a link"
+ class ShapeCallback2
+ click ShapeCallback2 call clickByClass(123) "This is a tooltip for a callback"
+
+pie title Pets adopted by volunteers
+ "Dogs" : 386
+ "Cats" : 85
+ "Rats" : 15
+
+
+gantt
+ title Adding GANTT diagram functionality to mermaid
+ excludes :excludes the named dates/days from being included in a charted task..
+ section Screening
+ Lexplore :active, des1, 2023-01-06,2023-01-08
+ H4 :active, des2, 2024-01-09, 3d
+ Future task : des3, after des2, 5d
+ Future task2 : des4, after des3, 5d
-
+sequenceDiagram
+ participant a as Alice
+ participant j as John
+ note right of a: Hello world!
+ properties a: {"class": "internal-service-actor", "type": "@clock"}
+ properties j: {"class": "external-service-actor", "type": "@computer"}
+ links a: {"Repo": "https://www.contoso.com/repo", "Swagger": "https://www.contoso.com/swagger"}
+ links j: {"Repo": "https://www.contoso.com/repo"}
+ links a: {"Dashboard": "https://www.contoso.com/dashboard", "On-Call": "https://www.contoso.com/oncall"}
+ link a: Contacts @ https://contacts.contoso.com/?contact=alice@contoso.com
+ a->>j: Hello John, how are you?
+ j-->>a: Great!
+
+journey
+ title My working day
+ section Go to work
+ Make tea: 5: Me
+ Go upstairs: 3: Me
+ Do work: 1: Me, Cat
+ section Go home
+ Go downstairs: 5: Me
+ Sit down: 5: Me
+
+
+requirementDiagram
+
+ requirement test_req {
+ id: 1
+ text: the test text.
+ risk: high
+ verifymethod: test
+ }
+
+ functionalRequirement test_req2 {
+ id: 1.1
+ text: the second test text.
+ risk: low
+ verifymethod: inspection
+ }
+
+ performanceRequirement test_req3 {
+ id: 1.2
+ text: the third test text.
+ risk: medium
+ verifymethod: demonstration
+ }
+
+ element test_entity {
+ type: simulation
+ }
+
+ element test_entity2 {
+ type: word doc
+ docRef: reqs/test_entity
+ }
+
+
+ test_entity - satisfies -> test_req2
+ test_req - traces -> test_req2
+ test_req - contains -> test_req3
+ test_req <- copies - test_entity2
+
+
+ erDiagram
+ CUSTOMER }|..|{ DELIVERY-ADDRESS : has
+ CUSTOMER ||--o{ ORDER : places
+ CUSTOMER ||--o{ INVOICE : "liable for"
+ DELIVERY-ADDRESS ||--o{ ORDER : receives
+ INVOICE ||--|{ ORDER : covers
+ ORDER ||--|{ ORDER-ITEM : includes
+ PRODUCT-CATEGORY ||--|{ PRODUCT : contains
+ PRODUCT ||--o{ ORDER-ITEM : "ordered in"
+
+
+ graph TB
+ subgraph One
+ a1-->a2-->a3
+ end
+
+
+ flowchart LR
+ Function-->URL-->A-->B-->C
+ click Function clickByFlow "Add a div"
+ click URL "https://mermaid-js.github.io/mermaid/#/" "Visit mermaid docs" _blank
+
+
+ gantt
+ dateFormat YYYY-MM-DD
+ axisFormat %d/%m
+ title Adding GANTT diagram to mermaid
+ excludes weekdays 2014-01-10
+
+ section A section
+ Completed task :done, des1, 2014-01-06,2014-01-08
+ Active task :active, des2, 2014-01-09, 3d
+ Future task : des3, after des2, 5d
+ Future task2 : des4, after des3, 5d
+
+ section Critical tasks
+ Completed task in the critical line :crit, done, 2014-01-06,24h
+ Implement parser and jison :crit, done, after des1, 2d
+ Create tests for parser :crit, active, 3d
+ Future task in critical line :crit, 5d
+ Create tests for renderer :2d
+ Add to mermaid :1d
+
+ section Documentation
+ Describe gantt syntax :active, a1, after des1, 3d
+ Add gantt diagram to demo page :after a1 , 20h
+ Add another diagram to demo page :doc1, after a1 , 48h
+
+ section Clickable
+ Visit mermaidjs :active, cl1, 2014-01-07,2014-01-10
+ Calling a Callback (look at the console log) :cl2, after cl1, 3d
+ Calling a Callback with args :cl3, after cl1, 3d
+
+ click cl1 href "https://mermaid-js.github.io/mermaid/#/"
+ click cl2 call clickByGantt()
+ click cl3 call clickByGantt("test1", test2, test3)
+
+ section Last section
+ Describe gantt syntax :after doc1, 3d
+ Add gantt diagram to demo page : 20h
+ Add another diagram to demo page : 48h
+
+
+classDiagram
+Class01 <|-- AveryLongClass : Cool
+Class09 --> C2 : Where am i?
+Class09 --* C3
+Class09 --|> Class07
+Class07 : equals()
+Class07 : Object[] elementData
+Class01 : size()
+Class01 : int chimp
+Class01 : int gorilla
+class Class10 {
+ int id
+ size()
+}
+
+
+ stateDiagram
[*] --> S1
state "Some long name" as S1
-
-