Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: target blank removed from anchor tag #4933

Merged
merged 15 commits into from
Nov 9, 2023
Merged

fix: target blank removed from anchor tag #4933

Changes from 6 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
2a9eb7f
fix: target blank removed from anchor tag
devbyharshit Oct 9, 2023
c279a9f
fix: clean link unit test resolved
devbyharshit Oct 9, 2023
345e82a
fix: removed static target=_blank instaed value will fetched from the…
devbyharshit Oct 13, 2023
f12b192
Merge branch 'develop' into bug/4716_fix_target_blank_getting_sanitized
devbyharshit Oct 13, 2023
b232975
Merge branch 'develop' into bug/4716_fix_target_blank_getting_sanitized
nirname Oct 20, 2023
111e067
fix: added type Element to the node used in callback in the addhook f…
devbyharshit Oct 23, 2023
77e7008
Merge branch 'develop' into bug/4716_fix_target_blank_getting_sanitized
devbyharshit Oct 23, 2023
af73818
Merge branch 'bug/4716_fix_target_blank_getting_sanitized' of https:/…
devbyharshit Oct 23, 2023
3b8c48d
fix: added type Element to the node used in callback in the dompurify…
devbyharshit Oct 23, 2023
b36cdac
Merge branch 'develop' of https://github.com/mermaid-js/mermaid into …
devbyharshit Oct 23, 2023
3f486ac
Merge branch 'bug/4716_fix_target_blank_getting_sanitized' of https:/…
devbyharshit Oct 23, 2023
7960f94
fix: shifted dompurify.addhook functions inside removescript
devbyharshit Oct 23, 2023
06d2ba8
fix: added two unit tests to check for the secured anchor tag
devbyharshit Oct 25, 2023
54ab3fc
fix: added an e2e test case for classdiagram with anchor tag
devbyharshit Oct 26, 2023
3394541
Merge branch 'develop' into bug/4716_fix_target_blank_getting_sanitized
devbyharshit Oct 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions packages/mermaid/src/diagrams/common/common.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,24 @@
return DOMPurify.sanitize(txt);
};

const TEMPORARY_ATTRIBUTE = 'data-temp-href-target';

DOMPurify.addHook('beforeSanitizeAttributes', function (node) {
if (node.tagName === 'A' && node.hasAttribute('target')) {
node.setAttribute(TEMPORARY_ATTRIBUTE, node.getAttribute('target') || '');
}
});

Check warning on line 37 in packages/mermaid/src/diagrams/common/common.ts

View check run for this annotation

Codecov / codecov/patch

packages/mermaid/src/diagrams/common/common.ts#L36-L37 

Added lines #L36 - L37 were not covered by tests

DOMPurify.addHook('afterSanitizeAttributes', function (node) {
if (node.tagName === 'A' && node.hasAttribute(TEMPORARY_ATTRIBUTE)) {
node.setAttribute('target', node.getAttribute(TEMPORARY_ATTRIBUTE) || '');
node.removeAttribute(TEMPORARY_ATTRIBUTE);
if (node.getAttribute('target') === '_blank') {
node.setAttribute('rel', 'noopener');
}
}
});

Check warning on line 47 in packages/mermaid/src/diagrams/common/common.ts

View check run for this annotation

Codecov / codecov/patch

packages/mermaid/src/diagrams/common/common.ts#L45-L47 

Added lines #L45 - L47 were not covered by tests

const sanitizeMore = (text: string, config: MermaidConfig) => {
if (config.flowchart?.htmlLabels !== false) {
const level = config.securityLevel;
Expand Down
Loading