Commit d77bd32c authored by Tim Zallmann's avatar Tim Zallmann

Merge branch 'sh-update-mermaid' into 'master'

Update Mermaid to v8.2.3

Closes #64601

See merge request gitlab-org/gitlab-ce!30985
parents 149a0a86 e1219ad4
......@@ -33,6 +33,7 @@ export default function renderMermaid($els) {
flowchart: {
htmlLabels: false,
},
securityLevel: 'strict',
});
$els.each((i, el) => {
......
---
title: Update Mermaid to v8.2.3
merge_request: 30985
author:
type: fixed
......@@ -41,16 +41,17 @@ describe "User comments on issue", :js do
expect(page.find('pre code').text).to eq code_block_content
end
it "does not render html content in mermaid" do
it "renders escaped HTML content in Mermaid" do
html_content = "<img onerror=location=`javascript\\u003aalert\\u0028document.domain\\u0029` src=x>"
mermaid_content = "graph LR\n B-->D(#{html_content});"
escaped_content = CGI.escapeHTML(html_content).gsub('=', "&equals;")
comment = "```mermaid\n#{mermaid_content}\n```"
add_note(comment)
wait_for_requests
expect(page.find('svg.mermaid')).to have_content html_content
expect(page.find('svg.mermaid')).to have_content escaped_content
end
end
......
This source diff could not be displayed because it is too large. You can view the blob instead.
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment