From 1096d10cb41702878fb11ec663c8c74da89a5047 Mon Sep 17 00:00:00 2001
From: Morreski <contact@enguerrand.io>
Date: Fri, 11 Jun 2021 11:07:27 +0200
Subject: [PATCH] Force securityLevel option to 'strict' by default to mitigate
 XSS attacks

---
 src/lib/components/view.svelte | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/lib/components/view.svelte b/src/lib/components/view.svelte
index 718a158f..bca08fd5 100644
--- a/src/lib/components/view.svelte
+++ b/src/lib/components/view.svelte
@@ -25,7 +25,9 @@
 					const scroll = container.parentElement.parentElement.parentElement.scrollTop;
 					container.innerHTML = code;
 					delete container.dataset.processed;
-					mermaid.initialize(Object.assign({}, JSON.parse(state.mermaid)));
+					mermaid.initialize(
+						Object.assign({}, JSON.parse(state.mermaid), { securityLevel: 'strict' })
+					); // Monkey patch: force securityLevel: strict to mitigate XSS attacks
 					mermaid.render('graph-div', code, (svgCode) => {
 						container.innerHTML = svgCode;
 					});