marcel/mermaid
1
0
Fork 0
mirror of https://github.com/mermaid-js/mermaid.git synced 2025-11-17 11:14:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

#2219 Frezing object to protect the prototype

Browse Source
This commit is contained in:
Knut Sveidqvist
2021-08-05 00:40:21 +02:00
parent af7f5d0aaf
commit f8891beb0a
3 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cypress/platform/knsv.html
View File

@@ -57,9 +57,8 @@ subgraph CompositeState
end end
</div> </div>
<div class="mermaid" style="width: 100%; height: 20%;"> <div class="mermaid" style="width: 100%; height: 20%;">
%%{init: { '__proto__': {'vuln': 'test'}} }%% %%{init: { 'prototype': {'__proto__': {'vuln': 'test'}}} }%%
%%{init: { '__proto__': {'vuln': 'test'}} }%% %%{init: { 'prototype': {'__proto__': {'vuln': 'test'}}} }%%
sequenceDiagram sequenceDiagram
Alice->>Bob: Hi Bob Alice->>Bob: Hi Bob
Bob->>Alice: Hi Alice Bob->>Alice: Hi Alice

7
cypress/platform/xss2.html
View File

@@ -44,6 +44,13 @@
graph LR graph LR
A --> B A --> B
</div> </div>
<div class="mermaid">
%%{init: { 'prototype': {'__proto__': {'polluted': 'test'}}} }%%
%%{init: { 'prototype': {'__proto__': {'polluted': 'test'}}} }%%
sequenceDiagram
Alice->>Bob: Hi Bob
Bob->>Alice: Hi Alice
</div>
<script src="./mermaid.js"></script> <script src="./mermaid.js"></script>
<script> <script>
mermaid.initialize({ mermaid.initialize({

12
src/utils.js
View File

@@ -77,8 +77,20 @@ export const detectInit = function (text, cnf) {
log.debug('sanitize deleting prototype option', args[key]); log.debug('sanitize deleting prototype option', args[key]);
delete args[argKey][key]; delete args[argKey][key];
} }
if (key.indexOf('proto') >= 0) {
log.debug('sanitize deleting prototype option', args[key]);
delete args[argKey][key];
}
if (key.indexOf('constr') >= 0) {
log.debug('sanitize deleting prototype option', args[key]);
delete args[argKey][key];
}
}); });
}); });
Object.freeze(Object.prototype);
Object.freeze(Object);
results = assignWithDepth(results, [...args]); results = assignWithDepth(results, [...args]);
} else { } else {
results = inits.args; results = inits.args;