marcel/mermaid
1
0
Fork 0
mirror of https://github.com/mermaid-js/mermaid.git synced 2025-09-17 22:39:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

#2219 Frezing object to protect the prototype

Browse Source
This commit is contained in:
Knut Sveidqvist
2021-08-05 00:40:21 +02:00
parent af7f5d0aaf
commit f8891beb0a
3 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cypress/platform/knsv.html
View File

@@ -57,9 +57,8 @@ subgraph CompositeState
end
</div>
<div class="mermaid" style="width: 100%; height: 20%;">
%%{init: { '__proto__': {'vuln': 'test'}} }%%
%%{init: { '__proto__': {'vuln': 'test'}} }%%
%%{init: { 'prototype': {'__proto__': {'vuln': 'test'}}} }%%
%%{init: { 'prototype': {'__proto__': {'vuln': 'test'}}} }%%
sequenceDiagram
Alice->>Bob: Hi Bob
Bob->>Alice: Hi Alice

7
cypress/platform/xss2.html
View File

@@ -44,6 +44,13 @@
graph LR
A --> B
</div>
<div class="mermaid">
%%{init: { 'prototype': {'__proto__': {'polluted': 'test'}}} }%%
%%{init: { 'prototype': {'__proto__': {'polluted': 'test'}}} }%%
sequenceDiagram
Alice->>Bob: Hi Bob
Bob->>Alice: Hi Alice
</div>
<script src="./mermaid.js"></script>
<script>
mermaid.initialize({

12
src/utils.js
View File

@@ -77,8 +77,20 @@ export const detectInit = function (text, cnf) {
log.debug('sanitize deleting prototype option', args[key]);
delete args[argKey][key];
}
if (key.indexOf('proto') >= 0) {
log.debug('sanitize deleting prototype option', args[key]);
delete args[argKey][key];
}
if (key.indexOf('constr') >= 0) {
log.debug('sanitize deleting prototype option', args[key]);
delete args[argKey][key];
}
});
});
Object.freeze(Object.prototype);
Object.freeze(Object);
results = assignWithDepth(results, [...args]);
} else {
results = inits.args;