diff options
author | Yorick Peterse <yorickpeterse@gmail.com> | 2019-03-04 21:44:46 +0300 |
---|---|---|
committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-03-04 21:44:46 +0300 |
commit | 59db98a0cabea4421434655d7f7873110363d21a (patch) | |
tree | f3f72bca43724e230090aeae7aa0c15e56b707bf /app/assets | |
parent | 5c80bbb33c12490bc5fa711642a40fc16bdb79a4 (diff) | |
parent | 025015048f7eaad29ee7816c6040fb3e0c06eb8d (diff) |
Merge dev master into GitLab.com master
Diffstat (limited to 'app/assets')
-rw-r--r-- | app/assets/javascripts/behaviors/markdown/render_mermaid.js | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/app/assets/javascripts/behaviors/markdown/render_mermaid.js b/app/assets/javascripts/behaviors/markdown/render_mermaid.js index 35380ca49fb..798114b4b0b 100644 --- a/app/assets/javascripts/behaviors/markdown/render_mermaid.js +++ b/app/assets/javascripts/behaviors/markdown/render_mermaid.js @@ -1,4 +1,5 @@ import flash from '~/flash'; +import { sprintf, __ } from '../../locale'; // Renders diagrams and flowcharts from text using Mermaid in any element with the // `js-render-mermaid` class. @@ -14,6 +15,9 @@ import flash from '~/flash'; // </pre> // +// This is an arbitary number; Can be iterated upon when suitable. +const MAX_CHAR_LIMIT = 5000; + export default function renderMermaid($els) { if (!$els.length) return; @@ -34,6 +38,21 @@ export default function renderMermaid($els) { $els.each((i, el) => { const source = el.textContent; + /** + * Restrict the rendering to a certain amount of character to + * prevent mermaidjs from hanging up the entire thread and + * causing a DoS. + */ + if (source && source.length > MAX_CHAR_LIMIT) { + el.textContent = sprintf( + __( + 'Cannot render the image. Maximum character count (%{charLimit}) has been exceeded.', + ), + { charLimit: MAX_CHAR_LIMIT }, + ); + return; + } + // Remove any extra spans added by the backend syntax highlighting. Object.assign(el, { textContent: source }); |