diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js index 9a07a7ab2..cce120ff1 100644 --- a/cypress/integration/other/xss.spec.js +++ b/cypress/integration/other/xss.spec.js @@ -78,5 +78,25 @@ describe('XSS', () => { cy.wait(1000); cy.get('#the-malware').should('not.exist'); }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss10.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss11.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss12.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) + it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => { + cy.visit('http://localhost:9000/xss13.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) }) diff --git a/cypress/platform/xss10.html b/cypress/platform/xss10.html new file mode 100644 index 000000000..3fc10dbab --- /dev/null +++ b/cypress/platform/xss10.html @@ -0,0 +1,105 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss11.html b/cypress/platform/xss11.html new file mode 100644 index 000000000..8114e055e --- /dev/null +++ b/cypress/platform/xss11.html @@ -0,0 +1,103 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss12.html b/cypress/platform/xss12.html new file mode 100644 index 000000000..460dd5921 --- /dev/null +++ b/cypress/platform/xss12.html @@ -0,0 +1,103 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss13.html b/cypress/platform/xss13.html new file mode 100644 index 000000000..48156949e --- /dev/null +++ b/cypress/platform/xss13.html @@ -0,0 +1,103 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/src/dagre-wrapper/createLabel.js b/src/dagre-wrapper/createLabel.js index bcf8f098e..1137b6bf9 100644 --- a/src/dagre-wrapper/createLabel.js +++ b/src/dagre-wrapper/createLabel.js @@ -1,6 +1,7 @@ import { select } from 'd3'; import { log } from '../logger'; // eslint-disable-line -import { evaluate } from '../diagrams/common/common'; +import { getConfig } from '../config'; +import { evaluate, sanitizeText } from '../diagrams/common/common'; // let vertexNode; // if (evaluate(getConfig().flowchart.htmlLabels)) { // // TODO: addHtmlLabel accepts a labelStyle. Do we possibly have that? @@ -25,7 +26,6 @@ import { evaluate } from '../diagrams/common/common'; // } // vertexNode = svgLabel; // } -import { getConfig } from '../config'; function applyStyle(dom, styleFn) { if (styleFn) { @@ -85,7 +85,7 @@ function addHtmlLabel(node) { } const createLabel = (_vertexText, style, isTitle, isNode) => { - let vertexText = _vertexText || ''; + let vertexText = sanitizeText(_vertexText || '', getConfig()); if (typeof vertexText === 'object') vertexText = vertexText[0]; if (evaluate(getConfig().flowchart.htmlLabels)) { // TODO: addHtmlLabel accepts a labelStyle. Do we possibly have that?