Force securityLevel option to 'strict' by default to mitigate XSS attacks

2021-06-11 11:13:03 +02:00
parent d751945e94
commit 1096d10cb4
1 changed files with 3 additions and 1 deletions
@@ -25,7 +25,9 @@
 					const scroll = container.parentElement.parentElement.parentElement.scrollTop;
 					container.innerHTML = code;
 					delete container.dataset.processed;
-					mermaid.initialize(Object.assign({}, JSON.parse(state.mermaid)));
+					mermaid.initialize(
+						Object.assign({}, JSON.parse(state.mermaid), { securityLevel: 'strict' })
+					); // Monkey patch: force securityLevel: strict to mitigate XSS attacks
 					mermaid.render('graph-div', code, (svgCode) => {
 						container.innerHTML = svgCode;
 					});