Permalink
Show file tree
Hide file tree
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Merge pull request from GHSA-p3rp-vmj9-gv6v
Advisory fix 1
- Loading branch information
Showing
8 changed files
with
272 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| <html> | ||
| <head> | ||
| <link | ||
| href="https://fonts.googleapis.com/css?family=Montserrat&display=swap" | ||
| rel="stylesheet" | ||
| /> | ||
| <link href="https://unpkg.com/tailwindcss@^1.0/dist/tailwind.min.css" rel="stylesheet"> | ||
| <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"> | ||
| <link href="https://fonts.googleapis.com/css?family=Noto+Sans+SC&display=swap" rel="stylesheet"> | ||
| <style> | ||
| body { | ||
| /* background: rgb(221, 208, 208); */ | ||
| /* background:#333; */ | ||
| font-family: 'Arial'; | ||
| /* font-size: 18px !important; */ | ||
| } | ||
| h1 { color: grey;} | ||
| .mermaid2 { | ||
| display: none; | ||
| } | ||
| .mermaid svg { | ||
| /* font-size: 18px !important; */ | ||
| } | ||
| .malware { | ||
| position: fixed; | ||
| bottom:0; | ||
| left:0; | ||
| right:0; | ||
| height: 150px; | ||
| background: red; | ||
| color: black; | ||
| display: flex; | ||
| display: flex; | ||
| justify-content: center; | ||
| align-items: center; | ||
| font-family: monospace; | ||
| font-size: 72px; | ||
| } | ||
| </style> | ||
| </head> | ||
| <body> | ||
| <div>Security check</div> | ||
| <div class="flex"> | ||
| <div id="diagram" class="mermaid"></div> | ||
| <div id="res" class=""></div> | ||
| <script src="./mermaid.js"></script> | ||
| <script> | ||
| mermaid.parseError = function (err, hash) { | ||
| // console.error('Mermaid error: ', err); | ||
| }; | ||
| mermaid.initialize({ | ||
| theme: 'forest', | ||
| arrowMarkerAbsolute: true, | ||
| // themeCSS: '.edgePath .path {stroke: red;} .arrowheadPath {fill: red;}', | ||
| logLevel: 0, | ||
| state: { | ||
| defaultRenderer: 'dagre-d3', | ||
| }, | ||
| flowchart: { | ||
| // defaultRenderer: 'dagre-wrapper', | ||
| nodeSpacing: 10, | ||
| curve: 'cardinal', | ||
| htmlLabels: true, | ||
| }, | ||
| htmlLabels: true, | ||
| // gantt: { axisFormat: '%m/%d/%Y' }, | ||
| sequence: { actorFontFamily: 'courier', actorMargin: 50, showSequenceNumbers: false }, | ||
| // sequenceDiagram: { actorMargin: 300 } // deprecated | ||
| // fontFamily: '"times", sans-serif', | ||
| // fontFamily: 'courier', | ||
| fontSize: 18, | ||
| curve: 'basis', | ||
| securityLevel: 'loose', | ||
| startOnLoad: false, | ||
| secure: ['secure', 'securityLevel', 'startOnLoad', 'maxTextSize'], | ||
| // themeVariables: {relationLabelColor: 'red'} | ||
| }); | ||
| function callback() { | ||
| alert('It worked'); | ||
| } | ||
| function xssAttack() { | ||
| const div = document.createElement('div'); | ||
| div.id = 'the-malware'; | ||
| div.className = 'malware'; | ||
| div.innerHTML = 'XSS Succeeded'; | ||
| document.getElementsByTagName('body')[0].appendChild(div); | ||
| throw new Error('XSS Succeded'); | ||
| } | ||
|
|
||
| var diagram = `sequenceDiagram | ||
| participant Alice | ||
| links Alice: { "Click me!" : "javasjavascript:cript:alert('goose')" }`; | ||
|
|
||
| // // var diagram = "stateDiagram-v2\n"; | ||
| // // diagram += "<img/src='1'/onerror" | ||
| // diagram += '//via.placeholder.com/64\' width=64 />"]'; | ||
| // console.log(diagram); | ||
| // document.querySelector('#diagram').innerHTML = diagram; | ||
| mermaid.render('diagram', diagram, (res) => { | ||
| console.log(res); | ||
| document.querySelector('#res').innerHTML = res; | ||
| }); | ||
| </script> | ||
| </body> | ||
| </html> | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| <html> | ||
| <head> | ||
| <link | ||
| href="https://fonts.googleapis.com/css?family=Montserrat&display=swap" | ||
| rel="stylesheet" | ||
| /> | ||
| <link href="https://unpkg.com/tailwindcss@^1.0/dist/tailwind.min.css" rel="stylesheet"> | ||
| <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"> | ||
| <link href="https://fonts.googleapis.com/css?family=Noto+Sans+SC&display=swap" rel="stylesheet"> | ||
| <style> | ||
| body { | ||
| /* background: rgb(221, 208, 208); */ | ||
| /* background:#333; */ | ||
| font-family: 'Arial'; | ||
| /* font-size: 18px !important; */ | ||
| } | ||
| h1 { color: grey;} | ||
| .mermaid2 { | ||
| display: none; | ||
| } | ||
| .mermaid svg { | ||
| /* font-size: 18px !important; */ | ||
| } | ||
| .malware { | ||
| position: fixed; | ||
| bottom:0; | ||
| left:0; | ||
| right:0; | ||
| height: 150px; | ||
| background: red; | ||
| color: black; | ||
| display: flex; | ||
| display: flex; | ||
| justify-content: center; | ||
| align-items: center; | ||
| font-family: monospace; | ||
| font-size: 72px; | ||
| } | ||
| </style> | ||
| </head> | ||
| <body> | ||
| <div>Security check</div> | ||
| <div class="flex"> | ||
| <div id="diagram" class="mermaid"></div> | ||
| <div id="res" class=""></div> | ||
| <script src="./mermaid.js"></script> | ||
| <script> | ||
| mermaid.parseError = function (err, hash) { | ||
| // console.error('Mermaid error: ', err); | ||
| }; | ||
| mermaid.initialize({ | ||
| theme: 'forest', | ||
| arrowMarkerAbsolute: true, | ||
| // themeCSS: '.edgePath .path {stroke: red;} .arrowheadPath {fill: red;}', | ||
| logLevel: 0, | ||
| state: { | ||
| defaultRenderer: 'dagre-d3', | ||
| }, | ||
| flowchart: { | ||
| // defaultRenderer: 'dagre-wrapper', | ||
| nodeSpacing: 10, | ||
| curve: 'cardinal', | ||
| htmlLabels: true, | ||
| }, | ||
| htmlLabels: true, | ||
| // gantt: { axisFormat: '%m/%d/%Y' }, | ||
| sequence: { actorFontFamily: 'courier', actorMargin: 50, showSequenceNumbers: false }, | ||
| // sequenceDiagram: { actorMargin: 300 } // deprecated | ||
| // fontFamily: '"times", sans-serif', | ||
| // fontFamily: 'courier', | ||
| fontSize: 18, | ||
| curve: 'basis', | ||
| securityLevel: 'loose', | ||
| startOnLoad: false, | ||
| secure: ['secure', 'securityLevel', 'startOnLoad', 'maxTextSize'], | ||
| // themeVariables: {relationLabelColor: 'red'} | ||
| }); | ||
| function callback() { | ||
| alert('It worked'); | ||
| } | ||
| function xssAttack() { | ||
| const div = document.createElement('div'); | ||
| div.id = 'the-malware'; | ||
| div.className = 'malware'; | ||
| div.innerHTML = 'XSS Succeeded'; | ||
| document.getElementsByTagName('body')[0].appendChild(div); | ||
| throw new Error('XSS Succeded'); | ||
| } | ||
|
|
||
| var diagram = `sequenceDiagram | ||
| participant Alice | ||
| link Alice: Click Me!@javasjavascript:cript:alert("goose")`; | ||
|
|
||
| // // var diagram = "stateDiagram-v2\n"; | ||
| // // diagram += "<img/src='1'/onerror" | ||
| // diagram += '//via.placeholder.com/64\' width=64 />"]'; | ||
| // console.log(diagram); | ||
| // document.querySelector('#diagram').innerHTML = diagram; | ||
| mermaid.render('diagram', diagram, (res) => { | ||
| console.log(res); | ||
| document.querySelector('#res').innerHTML = res; | ||
| }); | ||
| </script> | ||
| </body> | ||
| </html> | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # Security | ||
| The Mermaid team takes the security of Mermaid and the applications that use Mermaid seriously. This page describes how to report any vulnerabilities you may find, and lists best practices to minimize the risk of introducing a vulnerability. | ||
|
|
||
| ## Reporting vulnerabilities | ||
| To report a vulnerability, please e-mail security@mermaid.live with a description of the issue, the steps you took to create the issue, affected versions, and if known, mitigations for the issue. | ||
|
|
||
| We aim to reply within three working days, probably much sooner. | ||
|
|
||
| You should expect a close collaboration as we work to resolve the issue you have reported. Please reach out to security@mermaid.live again if you do not receive prompt attention and regular updates. | ||
|
|
||
| You may also reach out to the team via our public Slack chat channels; however, please make sure to e-mail security@mernaid.live when reporting an issue, and avoid revealing information about vulnerabilities in public as that could that could put users at risk. | ||
|
|
||
| ## Best practices | ||
|
|
||
| Keep current with the latest Mermaid releases. We regularly update Mermaid, and these updates may fix security defects discovered in previous versions. Check the Mermaid release notes for security-related updates. | ||
|
|
||
| Keep your application’s dependencies up to date. Make sure you upgrade your package dependencies to keep the dependencies up to date. Avoid pinning to specific versions for your dependencies and, if you do, make sure you check periodically to see if your dependencies have had security updates, and update the pin accordingly. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters