marcel/mermaid
1
0
Fork 0
mirror of https://github.com/mermaid-js/mermaid.git synced 2025-09-15 13:29:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

add security level antiscript option, to let use rich html format but remove all script element.

Browse Source
This commit is contained in:
Toan
2020-07-05 23:04:22 +07:00
parent 5242672efb
commit fce2a16e42
3 changed files with 66 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
src/diagrams/common/common.js
View File

@@ -5,6 +5,30 @@ export const getRows = s => {
return str.split('#br#');
};
export const removeScript = txt => {
var rs = '';
var idx = 0;
while (idx >= 0) {
idx = txt.indexOf('<script');
if (idx >= 0) {
rs += txt.substr(0, idx);
txt = txt.substr(idx + 1);
idx = txt.indexOf('</script>');
if (idx >= 0) {
idx += 9;
txt = txt.substr(idx);
}
} else {
rs += txt;
idx = -1;
break;
}
}
return rs;
};
export const sanitizeText = (text, config) => {
let txt = text;
let htmlLabels = true;
@@ -14,12 +38,18 @@ export const sanitizeText = (text, config) => {
)
htmlLabels = false;
if (config.securityLevel !== 'loose' && htmlLabels) {
// eslint-disable-line
txt = breakToPlaceholder(txt);
txt = txt.replace(/</g, '&lt;').replace(/>/g, '&gt;');
txt = txt.replace(/=/g, '&equals;');
txt = placeholderToBreak(txt);
if (htmlLabels) {
var level = config.securityLevel;
if (level == 'antiscript') {
txt = removeScript(txt);
} else if (level !== 'loose') {
// eslint-disable-line
txt = breakToPlaceholder(txt);
txt = txt.replace(/</g, '&lt;').replace(/>/g, '&gt;');
txt = txt.replace(/=/g, '&equals;');
txt = placeholderToBreak(txt);
}
}
return txt;
@@ -48,5 +78,6 @@ export default {
sanitizeText,
hasBreaks,
splitBreaks,
lineBreakRegex
lineBreakRegex,
removeScript
};