Skip to content

Commit 606be43

Browse files
amedoraRokt33r
authored andcommitted
Fix 3007 (#3028)
* fix code fences never sanitized * fix mermaid xss * Revert "fix mermaid xss" This reverts commit 1ff179a. * configuable mermaid HTML label * add locales for mermaid configuration
1 parent 3290667 commit 606be43

27 files changed

+43
-5
lines changed

browser/components/MarkdownEditor.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,7 @@ class MarkdownEditor extends React.Component {
341341
smartArrows={config.preview.smartArrows}
342342
breaks={config.preview.breaks}
343343
sanitize={config.preview.sanitize}
344+
mermaidHTMLLabel={config.preview.mermaidHTMLLabel}
344345
ref='preview'
345346
onContextMenu={(e) => this.handleContextMenu(e)}
346347
onDoubleClick={(e) => this.handleDoubleClick(e)}

browser/components/MarkdownPreview.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -560,6 +560,7 @@ export default class MarkdownPreview extends React.Component {
560560
if (
561561
prevProps.smartQuotes !== this.props.smartQuotes ||
562562
prevProps.sanitize !== this.props.sanitize ||
563+
prevProps.mermaidHTMLLabel !== this.props.mermaidHTMLLabel ||
563564
prevProps.smartArrows !== this.props.smartArrows ||
564565
prevProps.breaks !== this.props.breaks ||
565566
prevProps.lineThroughCheckbox !== this.props.lineThroughCheckbox
@@ -681,7 +682,8 @@ export default class MarkdownPreview extends React.Component {
681682
showCopyNotification,
682683
storagePath,
683684
noteKey,
684-
sanitize
685+
sanitize,
686+
mermaidHTMLLabel
685687
} = this.props
686688
let { value, codeBlockTheme } = this.props
687689

@@ -823,7 +825,7 @@ export default class MarkdownPreview extends React.Component {
823825
_.forEach(
824826
this.refs.root.contentWindow.document.querySelectorAll('.mermaid'),
825827
el => {
826-
mermaidRender(el, htmlTextHelper.decodeEntities(el.innerHTML), theme)
828+
mermaidRender(el, htmlTextHelper.decodeEntities(el.innerHTML), theme, mermaidHTMLLabel)
827829
}
828830
)
829831

browser/components/MarkdownSplitEditor.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ class MarkdownSplitEditor extends React.Component {
199199
smartArrows={config.preview.smartArrows}
200200
breaks={config.preview.breaks}
201201
sanitize={config.preview.sanitize}
202+
mermaidHTMLLabel={config.preview.mermaidHTMLLabel}
202203
ref='preview'
203204
tabInde='0'
204205
value={value}

browser/components/render/MermaidRender.js

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ function getId () {
1919
return id
2020
}
2121

22-
function render (element, content, theme) {
22+
function render (element, content, theme, enableHTMLLabel) {
2323
try {
2424
const height = element.attributes.getNamedItem('data-height')
2525
if (height && height.value !== 'undefined') {
@@ -29,7 +29,8 @@ function render (element, content, theme) {
2929
mermaidAPI.initialize({
3030
theme: isDarkTheme ? 'dark' : 'default',
3131
themeCSS: isDarkTheme ? darkThemeStyling : '',
32-
useMaxWidth: false
32+
useMaxWidth: false,
33+
flowchart: { htmlLabels: enableHTMLLabel }
3334
})
3435
mermaidAPI.render(getId(), content, (svgGraph) => {
3536
element.innerHTML = svgGraph

browser/lib/markdown-it-sanitize-html.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ module.exports = function sanitizePlugin (md, options) {
1515
options
1616
)
1717
}
18-
if (state.tokens[tokenIdx].type === '_fence') {
18+
if (state.tokens[tokenIdx].type.match(/.*_fence$/)) {
1919
// escapeHtmlCharacters has better performance
2020
state.tokens[tokenIdx].content = escapeHtmlCharacters(
2121
state.tokens[tokenIdx].content,

browser/main/lib/ConfigManager.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,10 @@ export const DEFAULT_CONFIG = {
8686
breaks: true,
8787
smartArrows: false,
8888
allowCustomCSS: false,
89+
8990
customCSS: '/* Drop Your Custom CSS Code Here */',
9091
sanitize: 'STRICT', // 'STRICT', 'ALLOW_STYLES', 'NONE'
92+
mermaidHTMLLabel: false,
9193
lineThroughCheckbox: true
9294
},
9395
blog: {

browser/main/modals/PreferencesModal/UiTab.js

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ class UiTab extends React.Component {
125125
breaks: this.refs.previewBreaks.checked,
126126
smartArrows: this.refs.previewSmartArrows.checked,
127127
sanitize: this.refs.previewSanitize.value,
128+
mermaidHTMLLabel: this.refs.previewMermaidHTMLLabel.checked,
128129
allowCustomCSS: this.refs.previewAllowCustomCSS.checked,
129130
lineThroughCheckbox: this.refs.lineThroughCheckbox.checked,
130131
customCSS: this.customCSSCM.getCodeMirror().getValue()
@@ -813,6 +814,16 @@ class UiTab extends React.Component {
813814
</select>
814815
</div>
815816
</div>
817+
<div styleName='group-checkBoxSection'>
818+
<label>
819+
<input onChange={(e) => this.handleUIChange(e)}
820+
checked={this.state.config.preview.mermaidHTMLLabel}
821+
ref='previewMermaidHTMLLabel'
822+
type='checkbox'
823+
/>&nbsp;
824+
{i18n.__('Enable HTML label in mermaid flowcharts')}
825+
</label>
826+
</div>
816827
<div styleName='group-section'>
817828
<div styleName='group-section-label'>
818829
{i18n.__('LaTeX Inline Open Delimiter')}

locales/da.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,5 +157,6 @@
157157
"Spellcheck disabled": "Spellcheck disabled",
158158
"Show menu bar": "Show menu bar",
159159
"Auto Detect": "Auto Detect",
160+
"Enable HTML label in mermaid flowcharts": "Enable HTML label in mermaid flowcharts ⚠ This option potentially has a risk of XSS.",
160161
"Wrap line in Snippet Note": "Wrap line in Snippet Note"
161162
}

locales/de.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,5 +213,6 @@
213213
"Spellcheck disabled": "Spellcheck disabled",
214214
"Show menu bar": "Show menu bar",
215215
"Auto Detect": "Auto Detect",
216+
"Enable HTML label in mermaid flowcharts": "Enable HTML label in mermaid flowcharts ⚠ This option potentially has a risk of XSS.",
216217
"Wrap line in Snippet Note": "Wrap line in Snippet Note"
217218
}

locales/en.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,5 +188,6 @@
188188
"New notes are tagged with the filtering tags": "New notes are tagged with the filtering tags",
189189
"Show menu bar": "Show menu bar",
190190
"Auto Detect": "Auto Detect",
191+
"Enable HTML label in mermaid flowcharts": "Enable HTML label in mermaid flowcharts ⚠ This option potentially has a risk of XSS.",
191192
"Wrap line in Snippet Note": "Wrap line in Snippet Note"
192193
}

0 commit comments

Comments
 (0)