marcel/mermaid
1
0
Fork 0
mirror of https://github.com/mermaid-js/mermaid.git synced 2025-09-17 14:29:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Only allowing a subset of characters in themeVariables

Browse Source
This commit is contained in:
Knut Sveidqvist
2022-06-21 21:17:53 +02:00
parent 566ec14648
commit ec2da8e85d
5 changed files with 104 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/utils.js
View File

@@ -1044,6 +1044,17 @@ export const directiveSanitizer = (args) => {
});
}
}
if (args.themeVariables) {
const kArr = Object.keys(args.themeVariables);
for (let i = 0; i < kArr.length; i++) {
const k = kArr[i];
const val = args.themeVariables[k];
if (!val.match(/^[a-zA-Z0-9#;]+$/)) {
args.themeVariables[k] = '';
}
}
}
log.debug('After sanitization', args);
};
export const sanitizeCss = (str) => {
const stringsearch = 'o';