From b3210ed2efb69d74c1e1a33450300b1396b62331 Mon Sep 17 00:00:00 2001
From: eajenkins <e.a.jenkins@live.com>
Date: Thu, 2 Sep 2021 11:59:43 -0700
Subject: [PATCH] Added sanitization of the links to prevent script injection
 attacks.

---
 src/diagrams/sequence/svgDraw.js | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/diagrams/sequence/svgDraw.js b/src/diagrams/sequence/svgDraw.js
index b126fba2a..1850ca93e 100644
--- a/src/diagrams/sequence/svgDraw.js
+++ b/src/diagrams/sequence/svgDraw.js
@@ -18,6 +18,10 @@ export const drawRect = function (elem, rectData) {
   return rectElem;
 };
 
+const sanitizeUrl = function (s) {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;').replace(/javascript:/g, '');
+}
+
 export const drawPopup = function (elem, actor, minMenuWidth, textAttrs, forceMenus) {
 
   if (actor.links === undefined || actor.links === null || Object.keys(actor.links).length === 0) {
@@ -61,7 +65,8 @@ export const drawPopup = function (elem, actor, minMenuWidth, textAttrs, forceMe
     var linkY = 20;
     for (let key in links) {
       var linkElem = g.append('a');
-      linkElem.attr('xlink:href', links[key]);
+      var sanitizedLink = sanitizeUrl(links[key]);
+      linkElem.attr('xlink:href', sanitizedLink);
       linkElem.attr('target', '_blank');
 
       _drawMenuItemTextCandidateFunc(textAttrs)(
@@ -88,14 +93,16 @@ export const drawImage = function (elem, x, y, link) {
   const imageElem = elem.append('image');
   imageElem.attr('x', x);
   imageElem.attr('y', y);
-  imageElem.attr('xlink:href', link);
+  var sanitizedLink = sanitizeUrl(link);
+  imageElem.attr('xlink:href', sanitizedLink);
 }
 
 export const drawEmbeddedImage = function (elem, x, y, link) {
   const imageElem = elem.append('use');
   imageElem.attr('x', x);
   imageElem.attr('y', y);
-  imageElem.attr('xlink:href', '#' + link);
+  var sanitizedLink = sanitizeUrl(link);
+  imageElem.attr('xlink:href', '#' + sanitizedLink);
 }
 
 export const popupMenu = function (popid) {