diff --git a/docs/config/setup/modules/mermaidAPI.md b/docs/config/setup/modules/mermaidAPI.md index 9516d2b46..a1992c225 100644 --- a/docs/config/setup/modules/mermaidAPI.md +++ b/docs/config/setup/modules/mermaidAPI.md @@ -96,7 +96,7 @@ mermaid.initialize(config); #### Defined in -[mermaidAPI.ts:607](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L607) +[mermaidAPI.ts:608](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L608) ## Functions diff --git a/packages/mermaid/package.json b/packages/mermaid/package.json index 51e5a68cb..f31d55145 100644 --- a/packages/mermaid/package.json +++ b/packages/mermaid/package.json @@ -68,7 +68,7 @@ "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.13", "dayjs": "^1.11.7", - "dompurify": "^3.0.5 <3.1.7", + "dompurify": "^3.2.1", "elkjs": "^0.9.0", "katex": "^0.16.9", "khroma": "^2.0.0", @@ -88,7 +88,6 @@ "@types/d3-scale": "^4.0.3", "@types/d3-selection": "^3.0.5", "@types/d3-shape": "^3.1.1", - "@types/dompurify": "^3.0.2", "@types/jsdom": "^21.1.1", "@types/katex": "^0.16.7", "@types/lodash-es": "^4.17.7", diff --git a/packages/mermaid/src/diagrams/common/common.ts b/packages/mermaid/src/diagrams/common/common.ts index 60f8bc439..6e8378f25 100644 --- a/packages/mermaid/src/diagrams/common/common.ts +++ b/packages/mermaid/src/diagrams/common/common.ts @@ -32,15 +32,15 @@ const setupDompurifyHooksIfNotSetup = (() => { function setupDompurifyHooks() { const TEMPORARY_ATTRIBUTE = 'data-temp-href-target'; - DOMPurify.addHook('beforeSanitizeAttributes', (node: Element) => { - if (node.tagName === 'A' && node.hasAttribute('target')) { - node.setAttribute(TEMPORARY_ATTRIBUTE, node.getAttribute('target') || ''); + DOMPurify.addHook('beforeSanitizeAttributes', (node) => { + if (node instanceof Element && node.tagName === 'A' && node.hasAttribute('target')) { + node.setAttribute(TEMPORARY_ATTRIBUTE, node.getAttribute('target') ?? ''); } }); - DOMPurify.addHook('afterSanitizeAttributes', (node: Element) => { - if (node.tagName === 'A' && node.hasAttribute(TEMPORARY_ATTRIBUTE)) { - node.setAttribute('target', node.getAttribute(TEMPORARY_ATTRIBUTE) || ''); + DOMPurify.addHook('afterSanitizeAttributes', (node) => { + if (node instanceof Element && node.tagName === 'A' && node.hasAttribute(TEMPORARY_ATTRIBUTE)) { + node.setAttribute('target', node.getAttribute(TEMPORARY_ATTRIBUTE) ?? ''); node.removeAttribute(TEMPORARY_ATTRIBUTE); if (node.getAttribute('target') === '_blank') { node.setAttribute('rel', 'noopener'); diff --git a/packages/mermaid/src/mermaidAPI.ts b/packages/mermaid/src/mermaidAPI.ts index ad9d7d286..7b5a8eb66 100644 --- a/packages/mermaid/src/mermaidAPI.ts +++ b/packages/mermaid/src/mermaidAPI.ts @@ -464,6 +464,7 @@ const render = async function ( svgCode = DOMPurify.sanitize(svgCode, { ADD_TAGS: DOMPURIFY_TAGS, ADD_ATTR: DOMPURIFY_ATTR, + HTML_INTEGRATION_POINTS: { foreignobject: true }, }); } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1d43590a6..263cd993e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -227,8 +227,8 @@ importers: specifier: ^1.11.7 version: 1.11.10 dompurify: - specifier: ^3.0.5 <3.1.7 - version: 3.1.6 + specifier: ^3.2.1 + version: 3.2.1 elkjs: specifier: ^0.9.0 version: 0.9.2 @@ -278,9 +278,6 @@ importers: '@types/d3-shape': specifier: ^3.1.1 version: 3.1.6 - '@types/dompurify': - specifier: ^3.0.2 - version: 3.0.5 '@types/jsdom': specifier: ^21.1.1 version: 21.1.6 @@ -5012,12 +5009,6 @@ packages: dependencies: '@types/ms': 0.7.34 - /@types/dompurify@3.0.5: - resolution: {integrity: sha512-1Wg0g3BtQF7sSb27fJQAKck1HECM6zV1EB66j8JH9i3LCjYabJa0FSdiSgsD5K/RbrsR0SiraKacLB+T8ZVYAg==} - dependencies: - '@types/trusted-types': 2.0.7 - dev: true - /@types/eslint-scope@3.7.4: resolution: {integrity: sha512-9K4zoImiZc3HlIp6AVUDE4CWYx22a+lhSZMYNpbjW04+YF0KWj4pJXnEMjdnFTiQibFFmElcsasJXDbdI/EPhA==} dependencies: @@ -5406,7 +5397,9 @@ packages: /@types/trusted-types@2.0.7: resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==} - dev: true + requiresBuild: true + dev: false + optional: true /@types/unist@2.0.10: resolution: {integrity: sha512-IfYcSBWE3hLpBg8+X2SEa8LVkJdJEkT2Ese2aaLs3ptGdVtABxndrMaxuFlQ1qdFf9Q5rDvDpxI3WwgvKFAsQA==} @@ -8869,8 +8862,10 @@ packages: domelementtype: 2.3.0 dev: true - /dompurify@3.1.6: - resolution: {integrity: sha512-cTOAhc36AalkjtBpfG6O8JimdTMWNXjiePT2xQH/ppBGi/4uIpmj8eKyIkMJErXWARyINV/sB38yf8JCLF5pbQ==} + /dompurify@3.2.1: + resolution: {integrity: sha512-NBHEsc0/kzRYQd+AY6HR6B/IgsqzBABrqJbpCDQII/OK6h7B7LXzweZTDsqSW2LkTRpoxf18YUP+YjGySk6B3w==} + optionalDependencies: + '@types/trusted-types': 2.0.7 dev: false /domutils@3.1.0: