mirror of
https://github.com/mermaid-js/mermaid.git
synced 2025-10-02 21:59:39 +02:00
Compare commits
21 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
65592e0541 | ||
|
|
f4c335ad2f | ||
|
|
6f800be33b | ||
|
|
52af0476c1 | ||
|
|
b4fbe1b0f0 | ||
|
|
835ae1734c | ||
|
|
1127ce7b50 | ||
|
|
9d8273771a | ||
|
|
0f9722393e | ||
|
|
e2bb8478d0 | ||
|
|
a353300707 | ||
|
|
77b2e4211d | ||
|
|
868c2ece91 | ||
|
|
354daee3a1 | ||
|
|
fcc51f4d94 | ||
|
|
94f7af1190 | ||
|
|
1059873b10 | ||
|
|
4cf2d71eb4 | ||
|
|
f7b73be561 | ||
|
|
a349fd3aba | ||
|
|
295b428d62 |
2
.github/workflows/update-browserlist.yml
vendored
2
.github/workflows/update-browserlist.yml
vendored
@@ -1,5 +1,7 @@
|
||||
name: Update Browserslist
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 7 * * 1'
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
|
||||
107
cypress/platform/xss15.html
Normal file
107
cypress/platform/xss15.html
Normal file
@@ -0,0 +1,107 @@
|
||||
<html>
|
||||
<head>
|
||||
<link
|
||||
href="https://fonts.googleapis.com/css?family=Montserrat&display=swap"
|
||||
rel="stylesheet"
|
||||
/>
|
||||
<link href="https://unpkg.com/tailwindcss@^1.0/dist/tailwind.min.css" rel="stylesheet">
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
|
||||
<link href="https://fonts.googleapis.com/css?family=Noto+Sans+SC&display=swap" rel="stylesheet">
|
||||
<style>
|
||||
body {
|
||||
/* background: rgb(221, 208, 208); */
|
||||
/* background:#333; */
|
||||
font-family: 'Arial';
|
||||
/* font-size: 18px !important; */
|
||||
}
|
||||
h1 { color: grey;}
|
||||
.mermaid2 {
|
||||
display: none;
|
||||
}
|
||||
.mermaid svg {
|
||||
/* font-size: 18px !important; */
|
||||
}
|
||||
.malware {
|
||||
position: fixed;
|
||||
bottom:0;
|
||||
left:0;
|
||||
right:0;
|
||||
height: 150px;
|
||||
background: red;
|
||||
color: black;
|
||||
display: flex;
|
||||
display: flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
font-family: monospace;
|
||||
font-size: 72px;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div>Security check</div>
|
||||
<div class="flex">
|
||||
<div id="diagram" class="mermaid"></div>
|
||||
<div id="res" class=""></div>
|
||||
<script src="./mermaid.js"></script>
|
||||
<script>
|
||||
mermaid.parseError = function (err, hash) {
|
||||
// console.error('Mermaid error: ', err);
|
||||
};
|
||||
mermaid.initialize({
|
||||
theme: 'forest',
|
||||
arrowMarkerAbsolute: true,
|
||||
// themeCSS: '.edgePath .path {stroke: red;} .arrowheadPath {fill: red;}',
|
||||
logLevel: 0,
|
||||
state: {
|
||||
defaultRenderer: 'dagre-d3',
|
||||
},
|
||||
flowchart: {
|
||||
// defaultRenderer: 'dagre-wrapper',
|
||||
nodeSpacing: 10,
|
||||
curve: 'cardinal',
|
||||
htmlLabels: true,
|
||||
},
|
||||
htmlLabels: true,
|
||||
// gantt: { axisFormat: '%m/%d/%Y' },
|
||||
sequence: { actorFontFamily: 'courier', actorMargin: 50, showSequenceNumbers: false },
|
||||
// sequenceDiagram: { actorMargin: 300 } // deprecated
|
||||
// fontFamily: '"times", sans-serif',
|
||||
// fontFamily: 'courier',
|
||||
fontSize: 18,
|
||||
curve: 'basis',
|
||||
securityLevel: 'strict',
|
||||
startOnLoad: false,
|
||||
secure: ['secure', 'securityLevel', 'startOnLoad', 'maxTextSize'],
|
||||
// themeVariables: {relationLabelColor: 'red'}
|
||||
});
|
||||
function callback() {
|
||||
alert('It worked');
|
||||
}
|
||||
function xssAttack() {
|
||||
const div = document.createElement('div');
|
||||
div.id = 'the-malware';
|
||||
div.className = 'malware';
|
||||
div.innerHTML = 'XSS Succeeded';
|
||||
document.getElementsByTagName('body')[0].appendChild(div);
|
||||
throw new Error('XSS Succeded');
|
||||
}
|
||||
|
||||
var diagram = `sequenceDiagram
|
||||
participant John
|
||||
links John: {"XSS": "javas`;
|
||||
diagram += `cript:alert('AudioParam')"}`;
|
||||
|
||||
// var diagram = "stateDiagram-v2\n";
|
||||
// diagram += "<img/src='1'/onerror"
|
||||
// diagram += "=xssAttack()> --> B";
|
||||
console.log(diagram);
|
||||
// document.querySelector('#diagram').innerHTML = diagram;
|
||||
mermaid.render('diagram', diagram, (res) => {
|
||||
console.log(res);
|
||||
document.querySelector('#res').innerHTML = res;
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
106
cypress/platform/xss16.html
Normal file
106
cypress/platform/xss16.html
Normal file
@@ -0,0 +1,106 @@
|
||||
<html>
|
||||
<head>
|
||||
<link
|
||||
href="https://fonts.googleapis.com/css?family=Montserrat&display=swap"
|
||||
rel="stylesheet"
|
||||
/>
|
||||
<link href="https://unpkg.com/tailwindcss@^1.0/dist/tailwind.min.css" rel="stylesheet">
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
|
||||
<link href="https://fonts.googleapis.com/css?family=Noto+Sans+SC&display=swap" rel="stylesheet">
|
||||
<style>
|
||||
body {
|
||||
/* background: rgb(221, 208, 208); */
|
||||
/* background:#333; */
|
||||
font-family: 'Arial';
|
||||
/* font-size: 18px !important; */
|
||||
}
|
||||
h1 { color: grey;}
|
||||
.mermaid2 {
|
||||
display: none;
|
||||
}
|
||||
.mermaid svg {
|
||||
/* font-size: 18px !important; */
|
||||
}
|
||||
.malware {
|
||||
position: fixed;
|
||||
bottom:0;
|
||||
left:0;
|
||||
right:0;
|
||||
height: 150px;
|
||||
background: red;
|
||||
color: black;
|
||||
display: flex;
|
||||
display: flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
font-family: monospace;
|
||||
font-size: 72px;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div>Security check</div>
|
||||
<div class="flex">
|
||||
<div id="diagram" class="mermaid"></div>
|
||||
<div id="res" class=""></div>
|
||||
<script src="./mermaid.js"></script>
|
||||
<script>
|
||||
mermaid.parseError = function (err, hash) {
|
||||
// console.error('Mermaid error: ', err);
|
||||
};
|
||||
mermaid.initialize({
|
||||
theme: 'forest',
|
||||
arrowMarkerAbsolute: true,
|
||||
// themeCSS: '.edgePath .path {stroke: red;} .arrowheadPath {fill: red;}',
|
||||
logLevel: 0,
|
||||
state: {
|
||||
defaultRenderer: 'dagre-d3',
|
||||
},
|
||||
flowchart: {
|
||||
// defaultRenderer: 'dagre-wrapper',
|
||||
nodeSpacing: 10,
|
||||
curve: 'cardinal',
|
||||
htmlLabels: true,
|
||||
},
|
||||
htmlLabels: true,
|
||||
// gantt: { axisFormat: '%m/%d/%Y' },
|
||||
sequence: { actorFontFamily: 'courier', actorMargin: 50, showSequenceNumbers: false },
|
||||
// sequenceDiagram: { actorMargin: 300 } // deprecated
|
||||
// fontFamily: '"times", sans-serif',
|
||||
// fontFamily: 'courier',
|
||||
fontSize: 18,
|
||||
curve: 'basis',
|
||||
securityLevel: 'loose',
|
||||
startOnLoad: false,
|
||||
secure: ['secure', 'securityLevel', 'startOnLoad', 'maxTextSize'],
|
||||
// themeVariables: {relationLabelColor: 'red'}
|
||||
});
|
||||
function callback() {
|
||||
alert('It worked');
|
||||
}
|
||||
function xssAttack() {
|
||||
const div = document.createElement('div');
|
||||
div.id = 'the-malware';
|
||||
div.className = 'malware';
|
||||
div.innerHTML = 'XSS Succeeded';
|
||||
document.getElementsByTagName('body')[0].appendChild(div);
|
||||
throw new Error('XSS Succeded');
|
||||
}
|
||||
|
||||
var diagram = `sequenceDiagram
|
||||
participant Alice
|
||||
links Alice: { "Click me!" : "javasjavascript:cript:alert('goose')" }`;
|
||||
|
||||
// // var diagram = "stateDiagram-v2\n";
|
||||
// // diagram += "<img/src='1'/onerror"
|
||||
// diagram += '//via.placeholder.com/64\' width=64 />"]';
|
||||
// console.log(diagram);
|
||||
// document.querySelector('#diagram').innerHTML = diagram;
|
||||
mermaid.render('diagram', diagram, (res) => {
|
||||
console.log(res);
|
||||
document.querySelector('#res').innerHTML = res;
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
106
cypress/platform/xss17.html
Normal file
106
cypress/platform/xss17.html
Normal file
@@ -0,0 +1,106 @@
|
||||
<html>
|
||||
<head>
|
||||
<link
|
||||
href="https://fonts.googleapis.com/css?family=Montserrat&display=swap"
|
||||
rel="stylesheet"
|
||||
/>
|
||||
<link href="https://unpkg.com/tailwindcss@^1.0/dist/tailwind.min.css" rel="stylesheet">
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
|
||||
<link href="https://fonts.googleapis.com/css?family=Noto+Sans+SC&display=swap" rel="stylesheet">
|
||||
<style>
|
||||
body {
|
||||
/* background: rgb(221, 208, 208); */
|
||||
/* background:#333; */
|
||||
font-family: 'Arial';
|
||||
/* font-size: 18px !important; */
|
||||
}
|
||||
h1 { color: grey;}
|
||||
.mermaid2 {
|
||||
display: none;
|
||||
}
|
||||
.mermaid svg {
|
||||
/* font-size: 18px !important; */
|
||||
}
|
||||
.malware {
|
||||
position: fixed;
|
||||
bottom:0;
|
||||
left:0;
|
||||
right:0;
|
||||
height: 150px;
|
||||
background: red;
|
||||
color: black;
|
||||
display: flex;
|
||||
display: flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
font-family: monospace;
|
||||
font-size: 72px;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div>Security check</div>
|
||||
<div class="flex">
|
||||
<div id="diagram" class="mermaid"></div>
|
||||
<div id="res" class=""></div>
|
||||
<script src="./mermaid.js"></script>
|
||||
<script>
|
||||
mermaid.parseError = function (err, hash) {
|
||||
// console.error('Mermaid error: ', err);
|
||||
};
|
||||
mermaid.initialize({
|
||||
theme: 'forest',
|
||||
arrowMarkerAbsolute: true,
|
||||
// themeCSS: '.edgePath .path {stroke: red;} .arrowheadPath {fill: red;}',
|
||||
logLevel: 0,
|
||||
state: {
|
||||
defaultRenderer: 'dagre-d3',
|
||||
},
|
||||
flowchart: {
|
||||
// defaultRenderer: 'dagre-wrapper',
|
||||
nodeSpacing: 10,
|
||||
curve: 'cardinal',
|
||||
htmlLabels: true,
|
||||
},
|
||||
htmlLabels: true,
|
||||
// gantt: { axisFormat: '%m/%d/%Y' },
|
||||
sequence: { actorFontFamily: 'courier', actorMargin: 50, showSequenceNumbers: false },
|
||||
// sequenceDiagram: { actorMargin: 300 } // deprecated
|
||||
// fontFamily: '"times", sans-serif',
|
||||
// fontFamily: 'courier',
|
||||
fontSize: 18,
|
||||
curve: 'basis',
|
||||
securityLevel: 'loose',
|
||||
startOnLoad: false,
|
||||
secure: ['secure', 'securityLevel', 'startOnLoad', 'maxTextSize'],
|
||||
// themeVariables: {relationLabelColor: 'red'}
|
||||
});
|
||||
function callback() {
|
||||
alert('It worked');
|
||||
}
|
||||
function xssAttack() {
|
||||
const div = document.createElement('div');
|
||||
div.id = 'the-malware';
|
||||
div.className = 'malware';
|
||||
div.innerHTML = 'XSS Succeeded';
|
||||
document.getElementsByTagName('body')[0].appendChild(div);
|
||||
throw new Error('XSS Succeded');
|
||||
}
|
||||
|
||||
var diagram = `sequenceDiagram
|
||||
participant Alice
|
||||
link Alice: Click Me!@javasjavascript:cript:alert("goose")`;
|
||||
|
||||
// // var diagram = "stateDiagram-v2\n";
|
||||
// // diagram += "<img/src='1'/onerror"
|
||||
// diagram += '//via.placeholder.com/64\' width=64 />"]';
|
||||
// console.log(diagram);
|
||||
// document.querySelector('#diagram').innerHTML = diagram;
|
||||
mermaid.render('diagram', diagram, (res) => {
|
||||
console.log(res);
|
||||
document.querySelector('#res').innerHTML = res;
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
- 📔 Introduction
|
||||
- 📔 Introduction
|
||||
|
||||
- [About Mermaid](README.md)
|
||||
- [Deployment](n00b-gettingStarted.md)
|
||||
- [Syntax and Configuration](n00b-syntaxReference.md)
|
||||
|
||||
- 📊 Diagram Syntax
|
||||
- 📊 Diagram Syntax
|
||||
- [Flowchart](flowchart.md)
|
||||
- [Sequence diagram](sequenceDiagram.md)
|
||||
- [Class Diagram](classDiagram.md)
|
||||
@@ -16,7 +16,7 @@
|
||||
- [Requirement Diagram](requirementDiagram.md)
|
||||
- [Other Examples](examples.md)
|
||||
|
||||
- ⚙️ Deployment and Configuration
|
||||
- ⚙️ Deployment and Configuration
|
||||
|
||||
- [Tutorials](Tutorials.md)
|
||||
- [API-Usage](usage.md)
|
||||
@@ -26,12 +26,13 @@
|
||||
- [Mermaid CLI](mermaidCLI.md)
|
||||
- [Advanced usage](n00b-advanced.md)
|
||||
|
||||
- 📚 Misc
|
||||
- 📚 Misc
|
||||
- [Use-Cases and Integrations](integrations.md)
|
||||
- [FAQ](faq.md)
|
||||
|
||||
- 🙌 Contributions and Community
|
||||
- 🙌 Contributions and Community
|
||||
- [Overview for Beginners](n00b-overview.md)
|
||||
- [Development and Contribution ](development.md)
|
||||
- [Changelog](CHANGELOG.md)
|
||||
- [Adding Diagrams ](newDiagram.md)
|
||||
- [Security ](security.md)
|
||||
|
||||
17
docs/security.md
Normal file
17
docs/security.md
Normal file
@@ -0,0 +1,17 @@
|
||||
# Security
|
||||
The Mermaid team takes the security of Mermaid and the applications that use Mermaid seriously. This page describes how to report any vulnerabilities you may find, and lists best practices to minimize the risk of introducing a vulnerability.
|
||||
|
||||
## Reporting vulnerabilities
|
||||
To report a vulnerability, please e-mail security@mermaid.live with a description of the issue, the steps you took to create the issue, affected versions, and if known, mitigations for the issue.
|
||||
|
||||
We aim to reply within three working days, probably much sooner.
|
||||
|
||||
You should expect a close collaboration as we work to resolve the issue you have reported. Please reach out to security@mermaid.live again if you do not receive prompt attention and regular updates.
|
||||
|
||||
You may also reach out to the team via our public Slack chat channels; however, please make sure to e-mail security@mernaid.live when reporting an issue, and avoid revealing information about vulnerabilities in public as that could that could put users at risk.
|
||||
|
||||
## Best practices
|
||||
|
||||
Keep current with the latest Mermaid releases. We regularly update Mermaid, and these updates may fix security defects discovered in previous versions. Check the Mermaid release notes for security-related updates.
|
||||
|
||||
Keep your application’s dependencies up to date. Make sure you upgrade your package dependencies to keep the dependencies up to date. Avoid pinning to specific versions for your dependencies and, if you do, make sure you check periodically to see if your dependencies have had security updates, and update the pin accordingly.
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "mermaid",
|
||||
"version": "8.13.5",
|
||||
"version": "8.13.8",
|
||||
"description": "Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams, gantt charts and git graphs.",
|
||||
"main": "dist/mermaid.core.js",
|
||||
"module": "dist/mermaid.esm.min.mjs",
|
||||
|
||||
@@ -13,6 +13,24 @@ export const getRows = (s) => {
|
||||
return str.split('#br#');
|
||||
};
|
||||
|
||||
export const removeEscapes = (text) => {
|
||||
let newStr = text.replace(/\\u[\dA-F]{4}/gi, function (match) {
|
||||
return String.fromCharCode(parseInt(match.replace(/\\u/g, ''), 16));
|
||||
});
|
||||
|
||||
console.log(newStr);
|
||||
|
||||
newStr = newStr.replace(/\\x([0-9a-f]{2})/gi, (_, c) => String.fromCharCode(parseInt(c, 16)));
|
||||
newStr = newStr.replace(/\\[\d\d\d]{3}/gi, function (match) {
|
||||
return String.fromCharCode(parseInt(match.replace(/\\/g, ''), 8));
|
||||
});
|
||||
newStr = newStr.replace(/\\[\d\d\d]{2}/gi, function (match) {
|
||||
return String.fromCharCode(parseInt(match.replace(/\\/g, ''), 8));
|
||||
});
|
||||
|
||||
return newStr;
|
||||
};
|
||||
|
||||
/**
|
||||
* Removes script tags from a text
|
||||
*
|
||||
@@ -40,13 +58,12 @@ export const removeScript = (txt) => {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
rs = rs.replace(/script>/gi, '#');
|
||||
rs = rs.replace(/script>/gi, '#');
|
||||
rs = rs.replace(/javascript:/gi, '#');
|
||||
rs = rs.replace(/onerror=/gi, 'onerror:');
|
||||
rs = rs.replace(/<iframe/gi, '');
|
||||
return rs;
|
||||
let decodedText = removeEscapes(rs);
|
||||
decodedText = decodedText.replace(/script>/gi, '#');
|
||||
decodedText = decodedText.replace(/javascript:/gi, '#');
|
||||
decodedText = decodedText.replace(/onerror=/gi, 'onerror:');
|
||||
decodedText = decodedText.replace(/<iframe/gi, '');
|
||||
return decodedText;
|
||||
};
|
||||
|
||||
const sanitizeMore = (text, config) => {
|
||||
@@ -62,7 +79,7 @@ const sanitizeMore = (text, config) => {
|
||||
if (htmlLabels) {
|
||||
const level = config.securityLevel;
|
||||
|
||||
if (level === 'antiscript') {
|
||||
if (level === 'antiscript' || level === 'strict') {
|
||||
txt = removeScript(txt);
|
||||
} else if (level !== 'loose') {
|
||||
// eslint-disable-line
|
||||
@@ -171,4 +188,5 @@ export default {
|
||||
removeScript,
|
||||
getUrl,
|
||||
evaluate,
|
||||
removeEscapes,
|
||||
};
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { removeScript } from './common';
|
||||
import { sanitizeText, removeScript, removeEscapes } from './common';
|
||||
|
||||
describe('when securityLevel is antiscript, all script must be removed', function () {
|
||||
it('should remove all script block, script inline.', function () {
|
||||
@@ -24,3 +24,60 @@ describe('when securityLevel is antiscript, all script must be removed', functio
|
||||
expect(isEqual).toEqual(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe('remove escape code in text', function () {
|
||||
it('should remove a unicode colon', function () {
|
||||
const labelString = '\\u003A';
|
||||
|
||||
const result = removeEscapes(labelString);
|
||||
expect(result).toEqual(':');
|
||||
});
|
||||
it('should remove a hex colon', function () {
|
||||
const labelString = '\\x3A';
|
||||
|
||||
const result = removeEscapes(labelString);
|
||||
expect(result).toEqual(':');
|
||||
});
|
||||
it('should remove a oct colon', function () {
|
||||
const labelString = '\\72';
|
||||
|
||||
const result = removeEscapes(labelString);
|
||||
expect(result).toEqual(':');
|
||||
});
|
||||
it('should remove a oct colon 3 numbers', function () {
|
||||
const labelString = '\\072';
|
||||
|
||||
const result = removeEscapes(labelString);
|
||||
expect(result).toEqual(':');
|
||||
});
|
||||
it('should remove multiple colons 3 numbers', function () {
|
||||
const labelString = '\\072\\072\\72';
|
||||
|
||||
const result = removeEscapes(labelString);
|
||||
expect(result).toEqual(':::');
|
||||
});
|
||||
it('should handle greater and smaller then', function () {
|
||||
const labelString = '\\74\\076';
|
||||
|
||||
const result = removeEscapes(labelString);
|
||||
expect(result).toEqual('<>');
|
||||
});
|
||||
it('should handle letters', function () {
|
||||
const labelString = '\\u0073\\143ri\\x70\\u0074\\x3A';
|
||||
|
||||
const result = removeEscapes(labelString);
|
||||
expect(result).toEqual('script:');
|
||||
});
|
||||
});
|
||||
|
||||
describe('Sanitize text', function () {
|
||||
it('should remove script tag', function () {
|
||||
const maliciousStr = 'javajavascript:script:alert(1)';
|
||||
const result = sanitizeText(maliciousStr, {
|
||||
securityLevel: 'strict',
|
||||
flowchart: { htmlLabels: true },
|
||||
});
|
||||
console.log('result', result);
|
||||
expect(result).not.toContain('javascript:alert(1)');
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import common from '../common/common';
|
||||
import { addFunction } from '../../interactionDb';
|
||||
import { sanitizeUrl } from '@braintree/sanitize-url';
|
||||
|
||||
export const drawRect = function (elem, rectData) {
|
||||
const rectElem = elem.append('rect');
|
||||
@@ -19,12 +20,12 @@ export const drawRect = function (elem, rectData) {
|
||||
return rectElem;
|
||||
};
|
||||
|
||||
const sanitizeUrl = function (s) {
|
||||
return s
|
||||
.replace(/&/g, '&')
|
||||
.replace(/</g, '<')
|
||||
.replace(/javascript:/g, '');
|
||||
};
|
||||
// const sanitizeUrl = function (s) {
|
||||
// return s
|
||||
// .replace(/&/g, '&')
|
||||
// .replace(/</g, '<')
|
||||
// .replace(/javascript:/g, '');
|
||||
// };
|
||||
|
||||
const addPopupInteraction = (id, actorCnt) => {
|
||||
addFunction(() => {
|
||||
@@ -1055,4 +1056,5 @@ export default {
|
||||
popupMenu,
|
||||
popdownMenu,
|
||||
fixLifeLineHeights,
|
||||
sanitizeUrl,
|
||||
};
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
const svgDraw = require('./svgDraw');
|
||||
const svgDraw = require('./svgDraw').default;
|
||||
const { MockD3 } = require('d3');
|
||||
|
||||
describe('svgDraw', function () {
|
||||
@@ -124,4 +124,18 @@ describe('svgDraw', function () {
|
||||
expect(rect.lower).toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
describe('sanitizeUrl', function () {
|
||||
it('it should sanitize malicious urls', function () {
|
||||
const maliciousStr = 'javascript:script:alert(1)';
|
||||
const result = svgDraw.sanitizeUrl(maliciousStr);
|
||||
console.log('result', result);
|
||||
expect(result).not.toContain('javascript:alert(1)');
|
||||
});
|
||||
it('it should not sanitize non dangerous urls', function () {
|
||||
const maliciousStr = 'javajavascript:script:alert(1)';
|
||||
const result = svgDraw.sanitizeUrl(maliciousStr);
|
||||
console.log('result', result);
|
||||
expect(result).not.toContain('javascript:alert(1)');
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user