diff --git a/.github/workflows/update-browserlist.yml b/.github/workflows/update-browserlist.yml index 5ad70a9f51..923ccdb19a 100644 --- a/.github/workflows/update-browserlist.yml +++ b/.github/workflows/update-browserlist.yml @@ -1,5 +1,7 @@ name: Update Browserslist on: + schedule: + - cron: '0 7 * * 1' workflow_dispatch: jobs: diff --git a/cypress/platform/xss15.html b/cypress/platform/xss15.html new file mode 100644 index 0000000000..94506def5f --- /dev/null +++ b/cypress/platform/xss15.html @@ -0,0 +1,107 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/src/diagrams/common/common.js b/src/diagrams/common/common.js index e2de952d7b..6ed40871a6 100644 --- a/src/diagrams/common/common.js +++ b/src/diagrams/common/common.js @@ -13,6 +13,24 @@ export const getRows = (s) => { return str.split('#br#'); }; +export const removeEscapes = (text) => { + let newStr = text.replace(/\\u[\dA-F]{4}/gi, function (match) { + return String.fromCharCode(parseInt(match.replace(/\\u/g, ''), 16)); + }); + + console.log(newStr); + + newStr = newStr.replace(/\\x([0-9a-f]{2})/gi, (_, c) => String.fromCharCode(parseInt(c, 16))); + newStr = newStr.replace(/\\[\d\d\d]{3}/gi, function (match) { + return String.fromCharCode(parseInt(match.replace(/\\/g, ''), 8)); + }); + newStr = newStr.replace(/\\[\d\d\d]{2}/gi, function (match) { + return String.fromCharCode(parseInt(match.replace(/\\/g, ''), 8)); + }); + + return newStr; +}; + /** * Removes script tags from a text * @@ -40,13 +58,12 @@ export const removeScript = (txt) => { break; } } - - rs = rs.replace(/script>/gi, '#'); - rs = rs.replace(/script>/gi, '#'); - rs = rs.replace(/javascript:/gi, '#'); - rs = rs.replace(/onerror=/gi, 'onerror:'); - rs = rs.replace(/