diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 13:53:04 +0000 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 13:53:04 +0000 |
commit | 4ae8923bf0db37d981176b4d4faf790af51d2176 (patch) | |
tree | 74093088d3b08cff1b3fec0e4b45e11e33d89f54 /app | |
parent | 225a482194bf97c4c97fb8f135052f35ad17cde0 (diff) | |
parent | b8e14b583ce3e4655ebb06577ce621d06f546e71 (diff) | |
download | gitlab-ce-4ae8923bf0db37d981176b4d4faf790af51d2176.tar.gz |
Merge branch 'security-mermaid-block-12-2' into '12-2-stable'
Only render fixed number of mermaid blocks
See merge request gitlab/gitlabhq!3412
Diffstat (limited to 'app')
-rw-r--r-- | app/assets/javascripts/behaviors/markdown/render_mermaid.js | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/app/assets/javascripts/behaviors/markdown/render_mermaid.js b/app/assets/javascripts/behaviors/markdown/render_mermaid.js index 27708504791..c3e2c09f1d5 100644 --- a/app/assets/javascripts/behaviors/markdown/render_mermaid.js +++ b/app/assets/javascripts/behaviors/markdown/render_mermaid.js @@ -36,6 +36,8 @@ export default function renderMermaid($els) { securityLevel: 'strict', }); + let renderedChars = 0; + $els.each((i, el) => { // Mermaid doesn't like `<br />` tags, so collapse all like tags into `<br>`, which is parsed correctly. const source = el.textContent.replace(/<br\s*\/>/g, '<br>'); @@ -45,7 +47,7 @@ export default function renderMermaid($els) { * prevent mermaidjs from hanging up the entire thread and * causing a DoS. */ - if (source && source.length > MAX_CHAR_LIMIT) { + if ((source && source.length > MAX_CHAR_LIMIT) || renderedChars > MAX_CHAR_LIMIT) { el.textContent = sprintf( __( 'Cannot render the image. Maximum character count (%{charLimit}) has been exceeded.', @@ -55,6 +57,7 @@ export default function renderMermaid($els) { return; } + renderedChars += source.length; // Remove any extra spans added by the backend syntax highlighting. Object.assign(el, { textContent: source }); |