Merge branch 'HEAD' into 2541

cypress/integration/other/xss.spec.js

@@ -105,4 +105,9 @@ describe('XSS', () => {
     cy.wait(1000);
     cy.get('#the-malware').should('not.exist');
   });
+  it('should not allow maniplulating antiscript to run javascript iframes in class diagrams', () => {
+    cy.visit('http://localhost:9000/xss14.html');
+    cy.wait(1000);
+    cy.get('#the-malware').should('not.exist');
+  });
 });

cypress/platform/xss14.html

@@ -86,7 +86,7 @@
       var diagram = "classDiagram\n"
 diagram += "classA <-- classB : <ifr";
 diagram += "ame/srcdoc='<scr";
-diagram += "ipt>alert(`XSS`)</";
+diagram += "ipt>parent.xssAttack(`XSS`)</";
 diagram += "script>'>";
 
     //   var diagram = "stateDiagram-v2\n";