Alois Klink
46a7a533ab
fix: copy mermaid config sanitization check
...
Copy the XSS prevention check from the `sanitize` function in mermaid
upstream's `config.ts` file.
See: https://github.com/mermaid-js/mermaid/blob/9745f325cb9e1967640f0e85da193a2f820634f1/packages/mermaid/src/config.ts#L178-L183
2026-04-02 19:00:54 +09:00
Alois Klink
7e9cdfca73
fix: sanitize all secure keys in config
...
Check and remove all the secure keys in the site Mermaid Config,
not just `securityLevel`. Unfortunately, the logic of Mermaid's
`sanitize` function in `config.ts` is a bit convoluted. For instance,
the `secure` config restricts keys deeply in the object.
See: https://github.com/mermaid-js/mermaid/blob/9745f325cb9e1967640f0e85da193a2f820634f1/packages/mermaid/src/config.ts#L155-L190
2026-04-02 19:00:54 +09:00
Alois Klink
48b9560e8e
fix: sanitize config loaded from gist/config URL
...
Currently, the `config` in the codeState in the hash is sanitized for
unsafe values, however the `?config` URL parameter or configs loaded
from a GitHub Gist are not.
Reported-by: Chai Cheng Xun @QiaoNPC
2026-04-02 18:59:09 +09:00
Sidharth Vinod
64e156085b
test: Fix tests
2025-03-19 19:54:42 -07:00
Sidharth Vinod
bb084867fa
chore: Add playwright tests
2025-03-17 19:47:13 -07:00
Alois Klink