chore(deps): consolidate open dependency updates #39
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| declare module "*.css"; |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -37,6 +37,7 @@ async function diagramToSvg(d2: D2, diagram: string, options: CompileOptions) { | |||||||||||||||||||||||
| export default () => { | ||||||||||||||||||||||||
| const d2 = new D2(); | ||||||||||||||||||||||||
| let isRendering = false; | ||||||||||||||||||||||||
| let renderAgain = false; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| return { | ||||||||||||||||||||||||
| async render({ model, el }: RenderProps<Model>) { | ||||||||||||||||||||||||
|
|
@@ -57,27 +58,32 @@ export default () => { | |||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| // Diagramming logic | ||||||||||||||||||||||||
| const update = async () => { | ||||||||||||||||||||||||
| if (isRendering) { | ||||||||||||||||||||||||
| renderAgain = true; | ||||||||||||||||||||||||
| return; | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| isRendering = true; | ||||||||||||||||||||||||
| try { | ||||||||||||||||||||||||
| do { | ||||||||||||||||||||||||
| renderAgain = false; | ||||||||||||||||||||||||
| try { | ||||||||||||||||||||||||
| const svg = await diagramToSvg(d2, getDiagram(), getOptions()); | ||||||||||||||||||||||||
| setSvg(svg); | ||||||||||||||||||||||||
| getRoot().innerHTML = svg; | ||||||||||||||||||||||||
| } catch (error: unknown) { | ||||||||||||||||||||||||
|
Comment on lines
+71
to
+74
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major 🧩 Analysis chain🌐 Web query:
💡 Result: No, Citations:
🏁 Script executed: # First, let's find and inspect the widget.ts file
fd -t f "widget.ts" --type fRepository: peter-gy/d2-widget Length of output: 169 🏁 Script executed: # Check if package.json exists and look for DOMPurify dependency
fd -t f "package.json" --type f | head -5Repository: peter-gy/d2-widget Length of output: 169 🏁 Script executed: # Let's also check the project structure
git ls-files | grep -E "(widget|package)" | head -20Repository: peter-gy/d2-widget Length of output: 342 🏁 Script executed: # Read the widget.ts file with line numbers to verify the vulnerable code
cat -n js/widget.ts | head -100Repository: peter-gy/d2-widget Length of output: 3738 🏁 Script executed: # Read package.json to check dependencies
cat package.jsonRepository: peter-gy/d2-widget Length of output: 987 Sanitize SVG before DOM injection to prevent XSS. Line 73 directly injects SVG via Suggested fix+import DOMPurify from "dompurify";
@@
- const svg = await diagramToSvg(d2, getDiagram(), getOptions());
- setSvg(svg);
- getRoot().innerHTML = svg;
+ const svg = await diagramToSvg(d2, getDiagram(), getOptions());
+ const safeSvg = DOMPurify.sanitize(svg, {
+ USE_PROFILES: { svg: true, svgFilters: true },
+ });
+ setSvg(safeSvg);
+ getRoot().innerHTML = safeSvg;📝 Committable suggestion
Suggested change
🧰 Tools🪛 ast-grep (0.44.0)[warning] 72-72: Direct HTML content assignment detected. Modifying innerHTML, outerHTML, or using document.write with unsanitized content can lead to XSS vulnerabilities. Use secure alternatives like textContent or sanitize HTML with libraries like DOMPurify. (unsafe-html-content-assignment) [warning] 72-72: Direct modification of innerHTML or outerHTML properties detected. Modifying these properties with unsanitized user input can lead to XSS vulnerabilities. Use safe alternatives or sanitize content first. (dom-content-modification) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||||||||||||||||
| console.error(error); | ||||||||||||||||||||||||
| const errorMessage = error instanceof Error ? error.message : "Unknown error"; | ||||||||||||||||||||||||
| const root = getRoot(); | ||||||||||||||||||||||||
| const errorElement = document.createElement("div"); | ||||||||||||||||||||||||
| errorElement.className = "error"; | ||||||||||||||||||||||||
| errorElement.textContent = `Error generating diagram: ${errorMessage}`; | ||||||||||||||||||||||||
| root.replaceChildren(errorElement); | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
| } while (renderAgain); | ||||||||||||||||||||||||
| } finally { | ||||||||||||||||||||||||
| isRendering = false; | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
| }; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| // Set up root element | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
Repository: peter-gy/d2-widget
Length of output: 1852
Pin deploy workflow actions to immutable SHAs.
The current tagged references (
@v6,@v5) are mutable and leave the Pages pipeline open to action-retag supply-chain risk. Replace with full commit SHAs:pnpm/action-setup@v6→ pinned SHAactions/upload-pages-artifact@v5→ pinned SHAactions/deploy-pages@v5→ pinned SHA🧰 Tools
🪛 zizmor (1.26.1)
[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Source: Linters/SAST tools