LailaTheElf/hedgedoc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't store mermaid diagrams in innerHTML

Browse Source 
Using jQuery's `.html()` method stores the given string as `innerHTML`, which enables injection of arbitrary DOM elements.
Using `.text()` instead mitigates this issue.

Signed-off-by: David Mehren <git@herrmehren.de>
This commit is contained in:
David Mehren 2020-12-26 14:40:00 +01:00
parent 89ecff4b1c
commit c32b1cf42b
No known key found for this signature in database
GPG Key ID: 185982BA4C42B7C3
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
public/js/extra.js
View File

@ -386,7 +386,7 @@ export function finishView (view) {
window.mermaid.mermaidAPI.parse($value.text()) window.mermaid.mermaidAPI.parse($value.text())
$ele.addClass('mermaid') $ele.addClass('mermaid')
$ele.html($value.text()) $ele.text($value.text())
window.mermaid.init(undefined, $ele) window.mermaid.init(undefined, $ele)
} catch (err) { } catch (err) {
var errormessage = err var errormessage = err