chore: update dependencies and improve MermaidBlock security
- Updated mermaid from version 11.13.0 to 9.1.7 for compatibility. - Upgraded next from version 14.2.21 to ^14.2.35 for the latest features and fixes. - Added @types/dompurify and isomorphic-dompurify for improved sanitization. - Replaced innerHTML assignment in MermaidBlock with sanitized SVG using DOMPurify. - Updated eslint-config-next to ^16.2.4 for better linting support.
This commit is contained in:
@@ -4,6 +4,7 @@ import { useState, useEffect, useRef } from "react";
|
||||
import { Wand2, Loader2, Code2, Play } from "lucide-react";
|
||||
import { cmsApi } from "@/lib/api";
|
||||
import mermaid from "mermaid";
|
||||
import DOMPurify from "isomorphic-dompurify";
|
||||
|
||||
interface MermaidBlockProps {
|
||||
id: string;
|
||||
@@ -48,7 +49,8 @@ export default function MermaidBlock({
|
||||
mermaidRef.current.innerHTML = "";
|
||||
const { svg } = await mermaid.render(`mermaid-${id}`, mermaid_code);
|
||||
if (mermaidRef.current) {
|
||||
mermaidRef.current.innerHTML = svg;
|
||||
// Sanitizar SVG antes de inyectar
|
||||
mermaidRef.current.innerHTML = DOMPurify.sanitize(svg);
|
||||
}
|
||||
} catch (error: any) {
|
||||
console.error("Mermaid parsing error:", error);
|
||||
|
||||
Reference in New Issue
Block a user