diff options
| author | Douwe Maan <douwe@gitlab.com> | 2018-02-01 00:48:18 +0300 |
|---|---|---|
| committer | Robert Speicher <rspeicher@gmail.com> | 2018-02-01 02:23:15 +0300 |
| commit | 270adf1cbc0903708d4df225e423e3ca02a936d3 (patch) | |
| tree | cf66266df93306ad0b569cb55f2f072e9f88966d /app | |
| parent | e853495f80de79213a15f15a72171955d04f13e0 (diff) | |
Merge branch 'fix-mermaid-xss' into 'security-10-4'
[10.4] Fix stored XSS in code blocks
See merge request gitlab/gitlabhq!2316
Diffstat (limited to 'app')
| -rw-r--r-- | app/assets/javascripts/render_mermaid.js | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/app/assets/javascripts/render_mermaid.js b/app/assets/javascripts/render_mermaid.js index 31c7a772cf4..d4f18955bd2 100644 --- a/app/assets/javascripts/render_mermaid.js +++ b/app/assets/javascripts/render_mermaid.js @@ -30,6 +30,9 @@ export default function renderMermaid($els) { $els.each((i, el) => { const source = el.textContent; + // Remove any extra spans added by the backend syntax highlighting. + Object.assign(el, { textContent: source }); + mermaid.init(undefined, el, (id) => { const svg = document.getElementById(id); |