From a7082633aa69c1d36692c56db73ee9916e6f1992 Mon Sep 17 00:00:00 2001 From: Max Wu Date: Sun, 28 Jul 2019 11:43:02 +0800 Subject: [PATCH 1/3] Upgrade mermaid to 8.2.3 to avoid XSS inside the svg tag Signed-off-by: Max Wu --- package.json | 2 +- public/js/extra.js | 11 +++-------- public/views/codimd/foot.ejs | 2 +- public/views/pretty.ejs | 2 +- public/views/slide.ejs | 2 +- 5 files changed, 7 insertions(+), 12 deletions(-) diff --git a/package.json b/package.json index 7a94dee0..bf8dfe41 100644 --- a/package.json +++ b/package.json @@ -91,7 +91,7 @@ "markdown-pdf": "~9.0.0", "mathjax": "~2.7.0", "mattermost-redux": "^5.9.0", - "mermaid": "~7.1.0", + "mermaid": "^8.2.3", "method-override": "~2.3.7", "minimist": "~1.2.0", "minio": "~6.0.0", diff --git a/public/js/extra.js b/public/js/extra.js index fb78a8c4..7b33d263 100644 --- a/public/js/extra.js +++ b/public/js/extra.js @@ -387,19 +387,14 @@ export function finishView (view) { var $value = $(value) const $ele = $(value).closest('pre') - window.mermaid.mermaidAPI.parse($value.text()) + window.mermaid.parse($value.text()) $ele.addClass('mermaid') $ele.html($value.text()) window.mermaid.init(undefined, $ele) } catch (err) { - var errormessage = err - if (err.str) { - errormessage = err.str - } - $value.unwrap() - $value.parent().append(`
${escapeHTML(errormessage)}
`) - console.warn(errormessage) + $value.parent().append(`
${S(err.str).escapeHTML().s}
`) + console.warn(err) } }) // abc.js diff --git a/public/views/codimd/foot.ejs b/public/views/codimd/foot.ejs index d054279e..61bb10d6 100644 --- a/public/views/codimd/foot.ejs +++ b/public/views/codimd/foot.ejs @@ -10,7 +10,7 @@ - + diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs index 12561a3f..6bdcf9bc 100644 --- a/public/views/pretty.ejs +++ b/public/views/pretty.ejs @@ -82,7 +82,7 @@ - + diff --git a/public/views/slide.ejs b/public/views/slide.ejs index a92e1dae..b7d73bfd 100644 --- a/public/views/slide.ejs +++ b/public/views/slide.ejs @@ -98,7 +98,7 @@ - + From dd267096c91c150a4a9459359dd5c9d0f958db8f Mon Sep 17 00:00:00 2001 From: Max Wu Date: Sun, 28 Jul 2019 19:51:59 +0800 Subject: [PATCH 2/3] fix: use lodash escapeHTML Signed-off-by: Max Wu --- public/js/extra.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/public/js/extra.js b/public/js/extra.js index 7b33d263..d0a7c2d2 100644 --- a/public/js/extra.js +++ b/public/js/extra.js @@ -393,7 +393,7 @@ export function finishView (view) { window.mermaid.init(undefined, $ele) } catch (err) { $value.unwrap() - $value.parent().append(`
${S(err.str).escapeHTML().s}
`) + $value.parent().append(`
${escapeHTML(err.str)}
`) console.warn(err) } }) From f1680ef7fad98a7527c2eec2ff54ef2b9d45b7fe Mon Sep 17 00:00:00 2001 From: Max Wu Date: Sun, 28 Jul 2019 19:56:55 +0800 Subject: [PATCH 3/3] fix: code style Signed-off-by: Max Wu --- lib/web/middleware/tooBusy.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/web/middleware/tooBusy.js b/lib/web/middleware/tooBusy.js index 78f3e49a..f7c0850f 100644 --- a/lib/web/middleware/tooBusy.js +++ b/lib/web/middleware/tooBusy.js @@ -5,7 +5,7 @@ const toobusy = require('toobusy-js') const config = require('../../config') const response = require('../../response') -toobusy.maxLag(config.responseMaxLag); +toobusy.maxLag(config.responseMaxLag) module.exports = function (req, res, next) { if (toobusy()) {