From a7082633aa69c1d36692c56db73ee9916e6f1992 Mon Sep 17 00:00:00 2001 From: Max Wu Date: Sun, 28 Jul 2019 11:43:02 +0800 Subject: [PATCH] Upgrade mermaid to 8.2.3 to avoid XSS inside the svg tag Signed-off-by: Max Wu --- package.json | 2 +- public/js/extra.js | 11 +++-------- public/views/codimd/foot.ejs | 2 +- public/views/pretty.ejs | 2 +- public/views/slide.ejs | 2 +- 5 files changed, 7 insertions(+), 12 deletions(-) diff --git a/package.json b/package.json index 7a94dee0..bf8dfe41 100644 --- a/package.json +++ b/package.json @@ -91,7 +91,7 @@ "markdown-pdf": "~9.0.0", "mathjax": "~2.7.0", "mattermost-redux": "^5.9.0", - "mermaid": "~7.1.0", + "mermaid": "^8.2.3", "method-override": "~2.3.7", "minimist": "~1.2.0", "minio": "~6.0.0", diff --git a/public/js/extra.js b/public/js/extra.js index fb78a8c4..7b33d263 100644 --- a/public/js/extra.js +++ b/public/js/extra.js @@ -387,19 +387,14 @@ export function finishView (view) { var $value = $(value) const $ele = $(value).closest('pre') - window.mermaid.mermaidAPI.parse($value.text()) + window.mermaid.parse($value.text()) $ele.addClass('mermaid') $ele.html($value.text()) window.mermaid.init(undefined, $ele) } catch (err) { - var errormessage = err - if (err.str) { - errormessage = err.str - } - $value.unwrap() - $value.parent().append(`
${escapeHTML(errormessage)}
`) - console.warn(errormessage) + $value.parent().append(`
${S(err.str).escapeHTML().s}
`) + console.warn(err) } }) // abc.js diff --git a/public/views/codimd/foot.ejs b/public/views/codimd/foot.ejs index d054279e..61bb10d6 100644 --- a/public/views/codimd/foot.ejs +++ b/public/views/codimd/foot.ejs @@ -10,7 +10,7 @@ - + diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs index 12561a3f..6bdcf9bc 100644 --- a/public/views/pretty.ejs +++ b/public/views/pretty.ejs @@ -82,7 +82,7 @@ - + diff --git a/public/views/slide.ejs b/public/views/slide.ejs index a92e1dae..b7d73bfd 100644 --- a/public/views/slide.ejs +++ b/public/views/slide.ejs @@ -98,7 +98,7 @@ - +