Trigger an alert when securityLevel is stripped

Co-authored-by: Sidharth Vinod <sidharthv96@gmail.com>
This commit is contained in:
Enguerrand Pelletier
2021-06-15 09:15:47 +02:00
committed by GitHub
co-authored by Sidharth Vinod
parent fbe2f127b8
commit a907674539
+4 -1
View File
@@ -37,7 +37,10 @@ export const loadState = (data: string): void => {
state = JSON.parse(stateStr);
const mermaidConfig =
typeof state.mermaid === 'string' ? JSON.parse(state.mermaid) : state.mermaid;
delete mermaidConfig.securityLevel; // Prevent setting overriding securityLevel when loading state to mitigate possible XSS attack
if(mermaidConfig.securityLevel) {
alert(`securityLevel was removed from config. Please add "securityLevel":"${mermaidConfig.securityLevel}" to your config if you trust the source of this Diagram`);
delete mermaidConfig.securityLevel; // Prevent setting overriding securityLevel when loading state to mitigate possible XSS attack
}
state.mermaid = JSON.stringify(mermaidConfig, null, 2);
} catch (e) {