diff --git a/cypress/helpers/util.js b/cypress/helpers/util.js index 7ec960b97b..4d13b35901 100644 --- a/cypress/helpers/util.js +++ b/cypress/helpers/util.js @@ -60,7 +60,7 @@ export const renderGraph = (graphStr, options, api) => { openURLAndVerifyRendering(url, options); }; -const openURLAndVerifyRendering = (url, options, validation = undefined) => { +export const openURLAndVerifyRendering = (url, options, validation = undefined) => { const useAppli = Cypress.env('useAppli'); const name = (options.name || cy.state('runnable').fullTitle()).replace(/\s+/g, '-'); diff --git a/cypress/integration/other/ghsa.spec.js b/cypress/integration/other/ghsa.spec.js index 8f28d9f53d..912f357280 100644 --- a/cypress/integration/other/ghsa.spec.js +++ b/cypress/integration/other/ghsa.spec.js @@ -1,4 +1,4 @@ -import { urlSnapshotTest } from '../../helpers/util.js'; +import { urlSnapshotTest, openURLAndVerifyRendering } from '../../helpers/util.js'; describe('CSS injections', () => { it('should not allow CSS injections outside of the diagram', () => { @@ -13,4 +13,11 @@ describe('CSS injections', () => { flowchart: { htmlLabels: false }, }); }); + it('should not allow manipulating styletags using arrowheads', () => { + openURLAndVerifyRendering('http://localhost:9000/xss23-css.html', { + logLevel: 1, + arrowMarkerAbsolute: false, + flowchart: { htmlLabels: true }, + }); + }); }); diff --git a/cypress/platform/xss23-css.html b/cypress/platform/xss23-css.html new file mode 100644 index 0000000000..cc5b6f0bf7 --- /dev/null +++ b/cypress/platform/xss23-css.html @@ -0,0 +1,85 @@ + + + + + + + + + +
Security check
+
+
+
+
+
+ + + diff --git a/docs/config/setup/modules/mermaidAPI.md b/docs/config/setup/modules/mermaidAPI.md index ef04c10c3e..b5e48b2290 100644 --- a/docs/config/setup/modules/mermaidAPI.md +++ b/docs/config/setup/modules/mermaidAPI.md @@ -96,7 +96,7 @@ mermaid.initialize(config); #### Defined in -[mermaidAPI.ts:667](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L667) +[mermaidAPI.ts:670](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L670) ## Functions @@ -127,7 +127,7 @@ Return the last node appended #### Defined in -[mermaidAPI.ts:306](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L306) +[mermaidAPI.ts:309](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L309) --- @@ -295,7 +295,7 @@ Put the svgCode into an iFrame. Return the iFrame code #### Defined in -[mermaidAPI.ts:285](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L285) +[mermaidAPI.ts:288](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L288) --- @@ -320,4 +320,4 @@ Remove any existing elements from the given document #### Defined in -[mermaidAPI.ts:356](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L356) +[mermaidAPI.ts:359](https://github.com/mermaid-js/mermaid/blob/master/packages/mermaid/src/mermaidAPI.ts#L359) diff --git a/docs/syntax/quadrantChart.md b/docs/syntax/quadrantChart.md index 86aa21f72d..10becf2e49 100644 --- a/docs/syntax/quadrantChart.md +++ b/docs/syntax/quadrantChart.md @@ -46,9 +46,6 @@ quadrantChart ## Syntax -> **Note** -> In place of `` you can use text like `this is a sample text` or inside **double quotes** like `"This type of text may contain unicode like ❤"`. - > **Note** > If there is no points available in the chart both **axis** text and **quadrant** will be rendered in the center of the respective quadrant. > If there are points **x-axis** labels will rendered from left of the respective quadrant also they will be displayed in bottom of the chart, and **y-axis** lables will be rendered in bottom of the respective quadrant, the quadrant text will render at top of the respective quadrant. @@ -152,7 +149,7 @@ Points are used to plot a circle inside the quadrantChart. The syntax is ` %%{init: {"quadrantChart": {"chartWidth": 400, "chartHeight": 400}, "themeVariables": {"quadrant1TextFill": "#ff0000"} }}%% quadrantChart x-axis Urgent --> Not Urgent - y-axis Not Important --> important + y-axis Not Important --> "Important ❤" quadrant-1 Plan quadrant-2 Do quadrant-3 Deligate @@ -163,7 +160,7 @@ quadrantChart %%{init: {"quadrantChart": {"chartWidth": 400, "chartHeight": 400}, "themeVariables": {"quadrant1TextFill": "#ff0000"} }}%% quadrantChart x-axis Urgent --> Not Urgent - y-axis Not Important --> important + y-axis Not Important --> "Important ❤" quadrant-1 Plan quadrant-2 Do quadrant-3 Deligate diff --git a/package.json b/package.json index 993c78eca1..11e88d7251 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "mermaid-monorepo", "private": true, - "version": "10.2.0", + "version": "10.2.2", "description": "Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams, gantt charts and git graphs.", "type": "module", "packageManager": "pnpm@8.5.1", diff --git a/packages/mermaid/package.json b/packages/mermaid/package.json index 46ddbcf967..cd870e15e8 100644 --- a/packages/mermaid/package.json +++ b/packages/mermaid/package.json @@ -1,6 +1,6 @@ { "name": "mermaid", - "version": "10.2.0", + "version": "10.2.2", "description": "Markdown-ish syntax for generating flowcharts, sequence diagrams, class diagrams, gantt charts and git graphs.", "type": "module", "module": "./dist/mermaid.core.mjs", @@ -28,7 +28,7 @@ "docs:build": "rimraf ../../docs && pnpm docs:spellcheck && pnpm docs:code && ts-node-esm src/docs.mts", "docs:verify": "pnpm docs:spellcheck && pnpm docs:code && ts-node-esm src/docs.mts --verify", "docs:pre:vitepress": "rimraf src/vitepress && pnpm docs:code && ts-node-esm src/docs.mts --vitepress", - "docs:build:vitepress": "pnpm docs:pre:vitepress && (cd src/vitepress && pnpm --filter ./ install --no-frozen-lockfile && pnpm run build) && cpy --flat src/docs/landing/ ./src/vitepress/.vitepress/dist/landing", + "docs:build:vitepress": "pnpm docs:pre:vitepress && (cd src/vitepress && pnpm --filter ./ install --no-frozen-lockfile --ignore-scripts && pnpm run build) && cpy --flat src/docs/landing/ ./src/vitepress/.vitepress/dist/landing", "docs:dev": "pnpm docs:pre:vitepress && concurrently \"pnpm --filter ./ src/vitepress dev\" \"ts-node-esm src/docs.mts --watch --vitepress\"", "docs:serve": "pnpm docs:build:vitepress && vitepress serve src/vitepress", "docs:spellcheck": "cspell --config ../../cSpell.json \"src/docs/**/*.md\"", diff --git a/packages/mermaid/src/diagrams/gantt/ganttDb.js b/packages/mermaid/src/diagrams/gantt/ganttDb.js index 81ff6d7556..3964027025 100644 --- a/packages/mermaid/src/diagrams/gantt/ganttDb.js +++ b/packages/mermaid/src/diagrams/gantt/ganttDb.js @@ -1,8 +1,8 @@ import { sanitizeUrl } from '@braintree/sanitize-url'; -import dayjs from 'dayjs/esm/index.js'; -import dayjsIsoWeek from 'dayjs/esm/plugin/isoWeek/index.js'; -import dayjsCustomParseFormat from 'dayjs/esm/plugin/customParseFormat/index.js'; -import dayjsAdvancedFormat from 'dayjs/esm/plugin/advancedFormat/index.js'; +import dayjs from 'dayjs'; +import dayjsIsoWeek from 'dayjs/plugin/isoWeek.js'; +import dayjsCustomParseFormat from 'dayjs/plugin/customParseFormat.js'; +import dayjsAdvancedFormat from 'dayjs/plugin/advancedFormat.js'; import { log } from '../../logger.js'; import * as configApi from '../../config.js'; import utils from '../../utils.js'; diff --git a/packages/mermaid/src/diagrams/gantt/ganttDb.spec.ts b/packages/mermaid/src/diagrams/gantt/ganttDb.spec.ts index 123b4a52d3..416368e8f9 100644 --- a/packages/mermaid/src/diagrams/gantt/ganttDb.spec.ts +++ b/packages/mermaid/src/diagrams/gantt/ganttDb.spec.ts @@ -1,5 +1,5 @@ // @ts-nocheck TODO: Fix TS -import dayjs from 'dayjs/esm/index.js'; +import dayjs from 'dayjs'; import ganttDb from './ganttDb.js'; import { convert } from '../../tests/util.js'; diff --git a/packages/mermaid/src/diagrams/gantt/ganttRenderer.js b/packages/mermaid/src/diagrams/gantt/ganttRenderer.js index a148d8a9e4..ff16fef7c7 100644 --- a/packages/mermaid/src/diagrams/gantt/ganttRenderer.js +++ b/packages/mermaid/src/diagrams/gantt/ganttRenderer.js @@ -1,4 +1,4 @@ -import dayjs from 'dayjs/esm/index.js'; +import dayjs from 'dayjs'; import { log } from '../../logger.js'; import { select, diff --git a/packages/mermaid/src/docs/.vitepress/components/Contributors.vue b/packages/mermaid/src/docs/.vitepress/components/Contributors.vue index 37b7b9133c..94e9180271 100644 --- a/packages/mermaid/src/docs/.vitepress/components/Contributors.vue +++ b/packages/mermaid/src/docs/.vitepress/components/Contributors.vue @@ -5,12 +5,12 @@ import { contributors } from '../contributors';