fix: copy mermaid config sanitization check

Copy the XSS prevention check from the `sanitize` function in mermaid
upstream's `config.ts` file.

See: https://github.com/mermaid-js/mermaid/blob/9745f325cb9e1967640f0e85da193a2f820634f1/packages/mermaid/src/config.ts#L178-L183

src/lib/util/state.ts

@@ -187,6 +187,12 @@ function getUnsafePaths(object: object, unsafeKeys: string[], path: string[] = [
     }
     if (typeof value === 'object' && value !== null) {
       unsafePaths.push(...getUnsafePaths(value as object, unsafeKeys, currentPath));
+    } else if (
+      typeof value === 'string' &&
+      // XSS prevention checks -- See mermaid `sanitize` function for reference.
+      (value.includes('<') || value.includes('>') || value.includes('url(data:'))
+    ) {
+      unsafePaths.push(currentPath);
     }
   });
   return unsafePaths;

tests/loadSite.spec.ts

@@ -84,7 +84,10 @@ test.describe('Site Loads', () => {
           JSON.stringify({
             someOtherSetting: 'Test value',
             securityLevel: 'loose',
-            secure: []
+            secure: [],
+            themeVariables: {
+              nodeBorder: '</style></svg><script>alert("XSS")</script>'
+            }
           })
         )}`
       }).toString()}`
@@ -96,7 +99,8 @@ test.describe('Site Loads', () => {
     const parsedStore = JSON.parse(codeStore) as State;
     const parsedConfig = JSON.parse(parsedStore.mermaid) as Record<string, unknown>;
     expect(parsedConfig).toEqual({
-      someOtherSetting: 'Test value'
+      someOtherSetting: 'Test value',
+      themeVariables: {}
     });
     // should scrub unsafe securityLevel but keep other settings
     expect(parsedConfig.securityLevel).toBeUndefined();