diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js index e1f05b6e6..830be4f8e 100644 --- a/cypress/integration/other/xss.spec.js +++ b/cypress/integration/other/xss.spec.js @@ -53,5 +53,10 @@ describe('XSS', () => { cy.wait(1000); cy.get('#the-malware').should('not.exist'); }) + it('should not allow maniplulating htmlLabels into a false positive', () => { + cy.visit('http://localhost:9000/xss4.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) }) diff --git a/cypress/integration/rendering/flowchart-v2.spec.js b/cypress/integration/rendering/flowchart-v2.spec.js index 48d5e0e95..00d0d4a77 100644 --- a/cypress/integration/rendering/flowchart-v2.spec.js +++ b/cypress/integration/rendering/flowchart-v2.spec.js @@ -371,25 +371,25 @@ flowchart TD E[(red text)] -->|default style| F((blue text)) G>red text] -->|default style| H{blue text} I{{red text}} -->|default style| J[/blue text/] - K[\ red text\] -->|default style| L[/blue text\] - M[\ red text/] -->|default style| N[blue text] + K[\\ red text\\] -->|default style| L[/blue text\\] + M[\\ red text/] -->|default style| N[blue text]; linkStyle default color:Sienna; - style A stroke:#ff0000,fill:#ffcccc,color:#ff0000 - style B stroke:#0000ff,fill:#ccccff,color:#0000ff - style C stroke:#ff0000,fill:#ffcccc,color:#ff0000 - style D stroke:#0000ff,fill:#ccccff,color:#0000ff - style E stroke:#ff0000,fill:#ffcccc,color:#ff0000 - style F stroke:#0000ff,fill:#ccccff,color:#0000ff - style G stroke:#ff0000,fill:#ffcccc,color:#ff0000 - style H stroke:#0000ff,fill:#ccccff,color:#0000ff - style I stroke:#ff0000,fill:#ffcccc,color:#ff0000 - style J stroke:#0000ff,fill:#ccccff,color:#0000ff - style K stroke:#ff0000,fill:#ffcccc,color:#ff0000 - style L stroke:#0000ff,fill:#ccccff,color:#0000ff - style M stroke:#ff0000,fill:#ffcccc,color:#ff0000 - style N stroke:#0000ff,fill:#ccccff,color:#0000ff + style A stroke:#ff0000,fill:#ffcccc,color:#ff0000; + style B stroke:#0000ff,fill:#ccccff,color:#0000ff; + style C stroke:#ff0000,fill:#ffcccc,color:#ff0000; + style D stroke:#0000ff,fill:#ccccff,color:#0000ff; + style E stroke:#ff0000,fill:#ffcccc,color:#ff0000; + style F stroke:#0000ff,fill:#ccccff,color:#0000ff; + style G stroke:#ff0000,fill:#ffcccc,color:#ff0000; + style H stroke:#0000ff,fill:#ccccff,color:#0000ff; + style I stroke:#ff0000,fill:#ffcccc,color:#ff0000; + style J stroke:#0000ff,fill:#ccccff,color:#0000ff; + style K stroke:#ff0000,fill:#ffcccc,color:#ff0000; + style L stroke:#0000ff,fill:#ccccff,color:#0000ff; + style M stroke:#ff0000,fill:#ffcccc,color:#ff0000; + style N stroke:#0000ff,fill:#ccccff,color:#0000ff; `, - {htmlLabels: true, flowchart: {htmlLabels: true}, securityLevel: 'loose'} + {htmlLabels: true, flowchart: {htmlLabels: true}, securityLevel: 'loose', logLevel:2} ); }); it('61: fontawesome icons in edge labels', () => { @@ -610,4 +610,27 @@ flowchart RL {htmlLabels: true, flowchart: {htmlLabels: true}, securityLevel: 'loose'} ); }); + + it('2050: handling of different rendering direction in subgraphs', () => { + imgSnapshotTest( + ` + flowchart LR + + subgraph TOP + direction TB + subgraph B1 + direction RL + i1 -->f1 + end + subgraph B2 + direction BT + i2 -->f2 + end + end + A --> TOP --> B + B1 --> B2 + `, + {htmlLabels: true, flowchart: {htmlLabels: true}, securityLevel: 'loose'} + ); + }); }); diff --git a/cypress/integration/rendering/stateDiagram-v2.spec.js b/cypress/integration/rendering/stateDiagram-v2.spec.js index af1f1e808..21806dd2a 100644 --- a/cypress/integration/rendering/stateDiagram-v2.spec.js +++ b/cypress/integration/rendering/stateDiagram-v2.spec.js @@ -401,7 +401,7 @@ stateDiagram-v2 it('v2 should handle different rendering directions in composite states', () => { imgSnapshotTest( ` -stateDiagram +stateDiagram-v2 direction LR state A { direction BT diff --git a/cypress/platform/exploit.js b/cypress/platform/exploit.js new file mode 100644 index 000000000..2b4b0baa5 --- /dev/null +++ b/cypress/platform/exploit.js @@ -0,0 +1,6 @@ +const div = parent.document.createElement('div'); +div.id = 'the-malware'; +div.className = 'malware'; +div.innerHTML = 'XSS Succeeded'; +parent.document.getElementsByTagName('body')[0].appendChild(div); +throw new Error('XSS Succeded'); diff --git a/cypress/platform/knsv.html b/cypress/platform/knsv.html index 8ae25a819..353593e5e 100644 --- a/cypress/platform/knsv.html +++ b/cypress/platform/knsv.html @@ -15,7 +15,7 @@ /* font-size: 18px !important; */ } h1 { color: grey;} - .mermaid2 { + .mermaid2,.mermaid3 { display: none; } .mermaid svg { @@ -27,14 +27,27 @@