Fixed an XSS vulnerability.

mermaid-js · Jun 26, 2024 · ad7545b · ad7545b
1 parent dcfee8c
commit ad7545b
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 23 deletions.
diff --git a/package.json b/package.json
@@ -49,6 +49,7 @@
     "antlr4": "~4.11.0",
     "color-string": "^1.5.5",
     "dom-to-image-more": "^2.13.0",
+    "dompurify": "^3.1.5",
     "file-saver": "^2.0.5",
     "highlight.js": "^10.7.3",
     "html-to-image": "^1.11.3",

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/components/DiagramFrame/SeqDiagram/MessageLayer/Block/Statement/Comment/Comment.vue b/src/components/DiagramFrame/SeqDiagram/MessageLayer/Block/Statement/Comment/Comment.vue
@@ -8,6 +8,8 @@
 
 <script type="text/babel">
 import { marked } from "marked";
+import DOMPurify from "dompurify";
+
 import highlightjs from "highlight.js/lib/core";
 
 // Languages import
@@ -61,10 +63,10 @@ export default {
   props: ["comment", "commentObj"],
   computed: {
     markedComment() {
-      return (
+      const dirtyHTML =
         (this.commentObj?.text && marked.parse(this.commentObj?.text)) ||
-        (this.comment && marked.parse(this.comment))
-      );
+        (this.comment && marked.parse(this.comment));
+      return DOMPurify.sanitize(dirtyHTML);
     },
     commentStyle() {
       return this.commentObj?.commentStyle;