Merge branch 'HEAD' into 2541

mermaid-js · Dec 7, 2021 · 8311100 · 8311100
2 parents f69f770 + 89ce930
commit 8311100
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js
@@ -105,4 +105,9 @@ describe('XSS', () => {
     cy.wait(1000);
     cy.get('#the-malware').should('not.exist');
   });
+  it('should not allow maniplulating antiscript to run javascript iframes in class diagrams', () => {
+    cy.visit('http://localhost:9000/xss14.html');
+    cy.wait(1000);
+    cy.get('#the-malware').should('not.exist');
+  });
 });
diff --git a/cypress/platform/xss14.html b/cypress/platform/xss14.html
@@ -86,7 +86,7 @@
       var diagram = "classDiagram\n"
 diagram += "classA <-- classB : <ifr";
 diagram += "ame/srcdoc='<scr";
-diagram += "ipt>alert(`XSS`)</";
+diagram += "ipt>parent.xssAttack(`XSS`)</";
 diagram += "script>'>";
 
     //   var diagram = "stateDiagram-v2\n";