From df87ab8818c0682630d83522535ae29ba27cc7e0 Mon Sep 17 00:00:00 2001 From: Knut Sveidqvist Date: Thu, 21 Apr 2022 21:11:48 +0200 Subject: [PATCH] Fix for vulnerability --- cypress/integration/other/xss.spec.js | 14 ++++ cypress/platform/xss20.html | 105 ++++++++++++++++++++++++++ cypress/platform/xss21.html | 105 ++++++++++++++++++++++++++ cypress/platform/xss22.html | 16 ++++ src/diagrams/common/common.js | 1 + src/mermaidAPI.js | 5 ++ 6 files changed, 246 insertions(+) create mode 100644 cypress/platform/xss20.html create mode 100644 cypress/platform/xss21.html create mode 100644 cypress/platform/xss22.html diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js index f605e98dc9..6226feaeb9 100644 --- a/cypress/integration/other/xss.spec.js +++ b/cypress/integration/other/xss.spec.js @@ -115,4 +115,18 @@ describe('XSS', () => { cy.wait(1000); cy.get('#the-malware').should('not.exist'); }); + it('should sanitize colons properly', () => { + cy.visit('http://localhost:9000/xss20.html'); + cy.wait(1000); + cy.get('a').click(''); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }); + it('should sanitize colons properly', () => { + cy.visit('http://localhost:9000/xss21.html'); + cy.wait(1000); + cy.get('a').click(''); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }); }); diff --git a/cypress/platform/xss20.html b/cypress/platform/xss20.html new file mode 100644 index 0000000000..33d4dfccb5 --- /dev/null +++ b/cypress/platform/xss20.html @@ -0,0 +1,105 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss21.html b/cypress/platform/xss21.html new file mode 100644 index 0000000000..9a88d7afa7 --- /dev/null +++ b/cypress/platform/xss21.html @@ -0,0 +1,105 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss22.html b/cypress/platform/xss22.html new file mode 100644 index 0000000000..d51a7f3840 --- /dev/null +++ b/cypress/platform/xss22.html @@ -0,0 +1,16 @@ + + + + + + + +
+ graph TD +A --> B["<a href='javascript#9;t#colon;alert(document.location)'>AAA</a>"] +
+ + + + \ No newline at end of file diff --git a/src/diagrams/common/common.js b/src/diagrams/common/common.js index 145e29219e..b61d4dddd5 100644 --- a/src/diagrams/common/common.js +++ b/src/diagrams/common/common.js @@ -59,6 +59,7 @@ export const removeScript = (txt) => { let decodedText = removeEscapes(rs); decodedText = decodedText.replace(/script>/gi, '#'); decodedText = decodedText.replace(/javascript:/gi, '#'); + decodedText = decodedText.replace(/javascript&colon/gi, '#'); decodedText = decodedText.replace(/onerror=/gi, 'onerror:'); decodedText = decodedText.replace(/`; + } else { + if (cnf.securityLevel !== 'loose') { + svgCode = DOMPurify.sanitize(svgCode, { ADD_TAGS: ['foreignobject'] }); + } } if (typeof cb !== 'undefined') {