Environment ------------ ### Host | item | version | | --- | --- | |OS |arch-linux| |GROWI |3.4.6| |node.js |10.15.3| |npm |6.4.1| |Using Docker|yes| |Using [growi-docker-compose][growi-docker-compose]|yes| [growi-docker-compose]: https://github.com/weseek/growi-docker-compose ### Client | item | version | | --- | --- | |OS |Windows7| |browser |Chrome 74.0.3729.169| How to reproduce? (再現手順) --------------------------- same as #709 What happens? (症状) --------------------- - One diagram was rendered What is the expected result? (期待される動作) ------------------------------------------- - Two diagrams are rendered Note ---- ### Solution proposal XSS filter library strips the **attributes not in white list** like below; ``` # cat index.js xss = require("xss") var opts = {whiteList: {"-": []}} var html = xss('<- foo; bar ->', opts); console.log(html); # node index.js <-> ``` In the mentioned code, `foo;`, `bar`, `-` are erased since they'er interpreted as attributes. So, the arrows should be passed by `onTag` handler. ### Tags should be passed through the filter #### PlantUML - `<--` (doted arrow) - `<[#red]-` (colored arrow) - `<|-` (outlined triangle arrow) - `<..` (doted arrow in use case diagram) - `<<` (stereo type) Note: the number of `.` and `-` may be greater than two. #### Blockdiag - `<--` (seqdiag) - `<<-` (seqdiag) - `>-<` `-<` (blockdiag: any token comes behind this. **it's impossible to support this**) The regexp which matches these would be `/^[[<.|-].*$/`. ### Solution to the root of the problem I think that XSS filter should be applied the content excluded "plantuml" and "blockdiag" block. It seems that only "markdown-it" do HTML parsing, so I think XSS filter should be implemented as markdown-it plugin instead of preprocessor.

Do you want to work on this issue?

Bug: Still XSS filter breaks PlantUML arrows #981

Company

Community

Support

Connect