diff --git a/package.json b/package.json index 957569c7..642d83c3 100644 --- a/package.json +++ b/package.json @@ -67,7 +67,7 @@ "katex": "^0.15.2", "keyboard-layout": "^2.0.17", "keytar": "^7.7.0", - "mermaid": "8.8.4", + "mermaid": "^8.13.10", "minizlib": "^2.1.1", "plist": "^3.0.4", "popper.js": "^1.16.1", @@ -78,9 +78,9 @@ "turndown": "^7.1.1", "underscore": "^1.13.2", "unsplash-js": "^7.0.15", - "vega": "^5.17.3", - "vega-embed": "^6.14.2", - "vega-lite": "^4.17.0", + "vega": "^5.21.0", + "vega-embed": "^6.20.5", + "vega-lite": "^5.2.0", "vscode-ripgrep": "^1.12.1", "vue": "^2.6.14", "vue-electron": "^1.0.6", diff --git a/src/muya/lib/parser/render/index.js b/src/muya/lib/parser/render/index.js index 4827d17f..1c9d8d44 100644 --- a/src/muya/lib/parser/render/index.js +++ b/src/muya/lib/parser/render/index.js @@ -1,6 +1,6 @@ import loadRenderer from '../../renderers' -import { CLASS_OR_ID } from '../../config' -import { conflict, mixins, camelToSnake } from '../../utils' +import { CLASS_OR_ID, PREVIEW_DOMPURIFY_CONFIG } from '../../config' +import { conflict, mixins, camelToSnake, sanitize } from '../../utils' import { patch, toVNode, toHTML, h, addNStoVNodeSvgChildren } from './snabbdom' import { beginRules } from '../rules' import renderInlines from './renderInlines' @@ -99,6 +99,7 @@ class StateRender { if (this.mermaidCache.size) { const mermaid = await loadRenderer('mermaid') mermaid.initialize({ + securityLevel: 'strict', theme: this.muya.options.mermaidTheme }) for (const [key, value] of this.mermaidCache.entries()) { @@ -109,7 +110,7 @@ class StateRender { } try { mermaid.parse(code) - target.innerHTML = code + target.innerHTML = sanitize(code, PREVIEW_DOMPURIFY_CONFIG, true) mermaid.init(undefined, target) } catch (err) { target.innerHTML = '< Invalid Mermaid Codes >' diff --git a/src/muya/lib/utils/exportHtml.js b/src/muya/lib/utils/exportHtml.js index a66ce09a..e7d1e050 100644 --- a/src/muya/lib/utils/exportHtml.js +++ b/src/muya/lib/utils/exportHtml.js @@ -38,18 +38,20 @@ class ExportHtml { for (const code of codes) { const preEle = code.parentNode const mermaidContainer = document.createElement('div') - mermaidContainer.innerHTML = code.innerHTML + mermaidContainer.innerHTML = sanitize(unescapeHtml(code.innerHTML), EXPORT_DOMPURIFY_CONFIG, true) mermaidContainer.classList.add('mermaid') preEle.replaceWith(mermaidContainer) } const mermaid = await loadRenderer('mermaid') // We only export light theme, so set mermaid theme to `default`, in the future, we can choose whick theme to export. mermaid.initialize({ + securityLevel: 'strict', theme: 'default' }) mermaid.init(undefined, this.exportContainer.querySelectorAll('div.mermaid')) if (this.muya) { mermaid.initialize({ + securityLevel: 'strict', theme: this.muya.options.mermaidTheme }) } diff --git a/src/renderer/components/exportSettings/index.vue b/src/renderer/components/exportSettings/index.vue index 0997f1e4..7974419a 100644 --- a/src/renderer/components/exportSettings/index.vue +++ b/src/renderer/components/exportSettings/index.vue @@ -220,7 +220,8 @@