From 7b6cb4f9747a86f556d70e2ee20c7afc0c828742 Mon Sep 17 00:00:00 2001 From: Knut Sveidqvist Date: Thu, 1 Jun 2023 16:30:57 +0200 Subject: [PATCH] #4446 Updating the cleanup criteria --- cypress/helpers/util.js | 2 +- cypress/integration/other/ghsa.spec.js | 9 ++- cypress/platform/xss23-css.html | 85 ++++++++++++++++++++++++++ packages/mermaid/src/mermaidAPI.ts | 2 +- 4 files changed, 95 insertions(+), 3 deletions(-) create mode 100644 cypress/platform/xss23-css.html diff --git a/cypress/helpers/util.js b/cypress/helpers/util.js index 7ec960b97..4d13b3590 100644 --- a/cypress/helpers/util.js +++ b/cypress/helpers/util.js @@ -60,7 +60,7 @@ export const renderGraph = (graphStr, options, api) => { openURLAndVerifyRendering(url, options); }; -const openURLAndVerifyRendering = (url, options, validation = undefined) => { +export const openURLAndVerifyRendering = (url, options, validation = undefined) => { const useAppli = Cypress.env('useAppli'); const name = (options.name || cy.state('runnable').fullTitle()).replace(/\s+/g, '-'); diff --git a/cypress/integration/other/ghsa.spec.js b/cypress/integration/other/ghsa.spec.js index 8f28d9f53..912f35728 100644 --- a/cypress/integration/other/ghsa.spec.js +++ b/cypress/integration/other/ghsa.spec.js @@ -1,4 +1,4 @@ -import { urlSnapshotTest } from '../../helpers/util.js'; +import { urlSnapshotTest, openURLAndVerifyRendering } from '../../helpers/util.js'; describe('CSS injections', () => { it('should not allow CSS injections outside of the diagram', () => { @@ -13,4 +13,11 @@ describe('CSS injections', () => { flowchart: { htmlLabels: false }, }); }); + it('should not allow manipulating styletags using arrowheads', () => { + openURLAndVerifyRendering('http://localhost:9000/xss23-css.html', { + logLevel: 1, + arrowMarkerAbsolute: false, + flowchart: { htmlLabels: true }, + }); + }); }); diff --git a/cypress/platform/xss23-css.html b/cypress/platform/xss23-css.html new file mode 100644 index 000000000..cc5b6f0bf --- /dev/null +++ b/cypress/platform/xss23-css.html @@ -0,0 +1,85 @@ + + + + + + + + + +
Security check
+
+
+
+
+
+ + + diff --git a/packages/mermaid/src/mermaidAPI.ts b/packages/mermaid/src/mermaidAPI.ts index e96407638..8e7f4d4b1 100644 --- a/packages/mermaid/src/mermaidAPI.ts +++ b/packages/mermaid/src/mermaidAPI.ts @@ -263,7 +263,7 @@ export const cleanUpSvgCode = ( // Replace marker-end urls with just the # anchor (remove the preceding part of the URL) if (!useArrowMarkerUrls && !inSandboxMode) { - cleanedUpSvg = cleanedUpSvg.replace(/marker-end="url\(.*?#/g, 'marker-end="url(#'); + cleanedUpSvg = cleanedUpSvg.replace(/marker-end="url\([/:A-Za-z-]*?#/g, 'marker-end="url(#'); } cleanedUpSvg = decodeEntities(cleanedUpSvg);