style: format code with Prettier and StandardJS#928
style: format code with Prettier and StandardJS#928deepsource-autofix[bot] wants to merge 1 commit intomainfrom
Conversation
This commit fixes the style issues introduced in fa4234c according to the output from Prettier and StandardJS. Details: None
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| </div> | ||
| ) | ||
| : ( | ||
| <div className='mermaid-output' dangerouslySetInnerHTML={{ __html: svg }} /> |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
In general, the problem arises because untrusted user input ends up being rendered as HTML without sufficient protection. Since this code relies on Mermaid to generate SVG/HTML, the correct fix is to configure Mermaid to use its safer security settings instead of the relaxed "loose" mode, and avoid overriding it with a weaker value via config. That way, Mermaid enforces stricter rules on how user-supplied diagrams are turned into SVG, significantly reducing or eliminating XSS vectors while preserving the existing functionality as much as possible.
Concretely, in src/components/stateful/mermaidHooks/index.jsx we should:
- Change
securityLevel: 'loose'to a safer level, such as'strict'(Mermaid’s recommended default for untrusted input). - Prevent callers from downgrading
securityLevelvia theconfigprop by ensuring the defaultsecurityLevelcannot be overridden. This can be done by spreadingconfigbefore specifyingsecurityLevel, so our secure value wins.
No other files need changes for this particular vulnerability, and no new imports or helper methods are required.
| @@ -24,12 +24,13 @@ | ||
|
|
||
| // Initialize with default config or props | ||
| // Note: initialize is global, but safe to call repeatedly with same config | ||
| // Use a strict security level for untrusted input and prevent it from being overridden | ||
| mermaid.initialize({ | ||
| startOnLoad: false, | ||
| theme: 'default', | ||
| securityLevel: 'loose', | ||
| fontFamily: 'monospace', | ||
| ...config | ||
| ...config, | ||
| securityLevel: 'strict' | ||
| }) | ||
|
|
||
| // Attempt to render |
2 participants
This commit fixes the style issues introduced in fa4234c according to the output
from Prettier and StandardJS.
Details: None