diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js index 9a07a7ab2..cce120ff1 100644 --- a/cypress/integration/other/xss.spec.js +++ b/cypress/integration/other/xss.spec.js @@ -78,5 +78,25 @@ describe('XSS', () => { cy.wait(1000); cy.get('#the-malware').should('not.exist'); }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss10.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss11.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss12.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss13.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) }) diff --git a/cypress/platform/xss10.html b/cypress/platform/xss10.html new file mode 100644 index 000000000..3fc10dbab --- /dev/null +++ b/cypress/platform/xss10.html @@ -0,0 +1,105 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss11.html b/cypress/platform/xss11.html new file mode 100644 index 000000000..8114e055e --- /dev/null +++ b/cypress/platform/xss11.html @@ -0,0 +1,103 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss12.html b/cypress/platform/xss12.html new file mode 100644 index 000000000..460dd5921 --- /dev/null +++ b/cypress/platform/xss12.html @@ -0,0 +1,103 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss13.html b/cypress/platform/xss13.html new file mode 100644 index 000000000..48156949e --- /dev/null +++ b/cypress/platform/xss13.html @@ -0,0 +1,103 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/src/dagre-wrapper/createLabel.js b/src/dagre-wrapper/createLabel.js index bcf8f098e..47ffc911e 100644 --- a/src/dagre-wrapper/createLabel.js +++ b/src/dagre-wrapper/createLabel.js @@ -1,5 +1,6 @@ import { select } from 'd3'; import { log } from '../logger'; // eslint-disable-line +import { getConfig } from '../config'; import { evaluate } from '../diagrams/common/common'; // let vertexNode; // if (evaluate(getConfig().flowchart.htmlLabels)) { @@ -25,7 +26,6 @@ import { evaluate } from '../diagrams/common/common'; // } // vertexNode = svgLabel; // } -import { getConfig } from '../config'; function applyStyle(dom, styleFn) { if (styleFn) { diff --git a/src/diagrams/class/classDb.js b/src/diagrams/class/classDb.js index e4a0cc1c3..027b85564 100644 --- a/src/diagrams/class/classDb.js +++ b/src/diagrams/class/classDb.js @@ -25,7 +25,7 @@ const splitClassNameAndType = function (id) { let split = id.split('~'); className = split[0]; - genericType = split[1]; + genericType = common.sanitizeText(split[1], configApi.getConfig()); } return { className: className, type: genericType }; diff --git a/src/diagrams/common/common.js b/src/diagrams/common/common.js index 94769194a..106bb75f9 100644 --- a/src/diagrams/common/common.js +++ b/src/diagrams/common/common.js @@ -80,6 +80,13 @@ export const sanitizeText = (text, config) => { return txt; }; +export const sanitizeTextOrArray = (a, config) => { + if (typeof a === 'string') return sanitizeText(a, config); + + const f = (x) => sanitizeText(x, config); + return a.flat().map(f); +}; + export const lineBreakRegex = //gi; /** @@ -149,6 +156,7 @@ export const evaluate = (val) => (val === 'false' || val === false ? false : tru export default { getRows, sanitizeText, + sanitizeTextOrArray, hasBreaks, splitBreaks, lineBreakRegex, diff --git a/src/diagrams/state/stateRenderer-v2.js b/src/diagrams/state/stateRenderer-v2.js index 33ee7914d..417fccb2f 100644 --- a/src/diagrams/state/stateRenderer-v2.js +++ b/src/diagrams/state/stateRenderer-v2.js @@ -77,6 +77,10 @@ const setupNode = (g, parent, node, altFlag) => { nodeDb[node.id].description = node.description; } } + nodeDb[node.id].description = common.sanitizeTextOrArray( + nodeDb[node.id].description, + getConfig() + ); } // Save data for description and group so that for instance a statement without description overwrites @@ -194,7 +198,7 @@ const setupDoc = (g, parent, doc, altFlag) => { arrowTypeEnd: 'arrow_barb', style: 'fill:none', labelStyle: '', - label: item.description, + label: common.sanitizeText(item.description, getConfig()), arrowheadStyle: 'fill: #333', labelpos: 'c', labelType: 'text',