diff options
| author | Winnie Hellmann <winnie@gitlab.com> | 2018-11-09 14:16:11 +0100 |
|---|---|---|
| committer | Winnie Hellmann <winnie@gitlab.com> | 2018-11-14 15:31:02 +0100 |
| commit | 4db692244c38db15bb9b7e47669a9712a5b55d69 (patch) | |
| tree | 5473cefd3d83fe502c434556361b8a36901f3d9c | |
| parent | 36a4710238bd0e573e3f68fbae66f20c70fd6264 (diff) | |
| download | gitlab-ce-4db692244c38db15bb9b7e47669a9712a5b55d69.tar.gz | |
Configure mermaid to not render HTML content in diagrams
(cherry picked from commit f2e9f22f7d3d84abeea5ba2918ee5ffcc55f2dad)
Conflicts:
app/assets/javascripts/behaviors/markdown/render_mermaid.js
| -rw-r--r-- | app/assets/javascripts/behaviors/markdown/render_mermaid.js | 3 | ||||
| -rw-r--r-- | changelogs/unreleased/security-mermaid-xss.yml | 5 |
2 files changed, 8 insertions, 0 deletions
diff --git a/app/assets/javascripts/behaviors/markdown/render_mermaid.js b/app/assets/javascripts/behaviors/markdown/render_mermaid.js index 56b1896e9f1..4abea532d56 100644 --- a/app/assets/javascripts/behaviors/markdown/render_mermaid.js +++ b/app/assets/javascripts/behaviors/markdown/render_mermaid.js @@ -25,6 +25,9 @@ export default function renderMermaid($els) { }, // mermaidAPI options theme: 'neutral', + flowchart: { + htmlLabels: false, + }, }); $els.each((i, el) => { diff --git a/changelogs/unreleased/security-mermaid-xss.yml b/changelogs/unreleased/security-mermaid-xss.yml new file mode 100644 index 00000000000..bcf93ef37ff --- /dev/null +++ b/changelogs/unreleased/security-mermaid-xss.yml @@ -0,0 +1,5 @@ +--- +title: Configure mermaid to not render HTML content in diagrams +merge_request: +author: +type: security |