fix: avoid eval string when putting back parsed string of mermaid

where has stored XSS issue
hackmdio · Dec 21, 2020 · 79dc6a9 · 79dc6a9
1 parent 381b3ff
commit 79dc6a9
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/public/js/extra.js b/public/js/extra.js
@@ -397,9 +397,10 @@ export function finishView (view) {
       var $value = $(value)
       const $ele = $(value).closest('pre')
 
-      window.mermaid.parse($value.text())
+      let text = $value.text()
+      window.mermaid.parse(text)
       $ele.addClass('mermaid')
-      $ele.html($value.text())
+      $ele.text(text)
       window.mermaid.init(undefined, $ele)
     } catch (err) {
       $value.unwrap()