GitLab wird am Donnerstag, den 27. Januar, zwischen 08:00 und 12:00 Uhr wegen wichtigen Wartungsarbeiten nicht zur Verfügung stehen.

Commit 4ae8923b authored by GitLab Release Tools Bot's avatar GitLab Release Tools Bot
Browse files

Merge branch 'security-mermaid-block-12-2' into '12-2-stable'

Only render fixed number of mermaid blocks

See merge request gitlab/gitlabhq!3412
parents 225a4821 b8e14b58
......@@ -36,6 +36,8 @@ export default function renderMermaid($els) {
securityLevel: 'strict',
});
let renderedChars = 0;
$els.each((i, el) => {
// Mermaid doesn't like `<br />` tags, so collapse all like tags into `<br>`, which is parsed correctly.
const source = el.textContent.replace(/<br\s*\/>/g, '<br>');
......@@ -45,7 +47,7 @@ export default function renderMermaid($els) {
* prevent mermaidjs from hanging up the entire thread and
* causing a DoS.
*/
if (source && source.length > MAX_CHAR_LIMIT) {
if ((source && source.length > MAX_CHAR_LIMIT) || renderedChars > MAX_CHAR_LIMIT) {
el.textContent = sprintf(
__(
'Cannot render the image. Maximum character count (%{charLimit}) has been exceeded.',
......@@ -55,6 +57,7 @@ export default function renderMermaid($els) {
return;
}
renderedChars += source.length;
// Remove any extra spans added by the backend syntax highlighting.
Object.assign(el, { textContent: source });
......
---
title: Only render fixed number of mermaid blocks
merge_request:
author:
type: security
This diff is collapsed.
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment