Trigger an alert when securityLevel is stripped
Co-authored-by: Sidharth Vinod <sidharthv96@gmail.com>
This commit is contained in:
co-authored by
Sidharth Vinod
parent
fbe2f127b8
commit
a907674539
@@ -37,7 +37,10 @@ export const loadState = (data: string): void => {
|
||||
state = JSON.parse(stateStr);
|
||||
const mermaidConfig =
|
||||
typeof state.mermaid === 'string' ? JSON.parse(state.mermaid) : state.mermaid;
|
||||
delete mermaidConfig.securityLevel; // Prevent setting overriding securityLevel when loading state to mitigate possible XSS attack
|
||||
if(mermaidConfig.securityLevel) {
|
||||
alert(`securityLevel was removed from config. Please add "securityLevel":"${mermaidConfig.securityLevel}" to your config if you trust the source of this Diagram`);
|
||||
delete mermaidConfig.securityLevel; // Prevent setting overriding securityLevel when loading state to mitigate possible XSS attack
|
||||
}
|
||||
|
||||
state.mermaid = JSON.stringify(mermaidConfig, null, 2);
|
||||
} catch (e) {
|
||||
|
||||
Reference in New Issue
Block a user