diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5116d0a27..bb96028b6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -2,6 +2,9 @@ name: Build on: [push, pull_request] +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/check-readme-in-sync.yml b/.github/workflows/check-readme-in-sync.yml index 28a82a29a..13912e5b9 100644 --- a/.github/workflows/check-readme-in-sync.yml +++ b/.github/workflows/check-readme-in-sync.yml @@ -10,6 +10,9 @@ on: branches: - gh-pages +permissions: + contents: read + jobs: check: runs-on: ubuntu-latest diff --git a/.github/workflows/e2e b/.github/workflows/e2e index 29a8b7cf5..5b716e429 100644 --- a/.github/workflows/e2e +++ b/.github/workflows/e2e @@ -2,6 +2,9 @@ name: E2E on: [push, pull_request] +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/README.md b/README.md index cbf50713b..db1ddc3ce 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,8 @@ English | [简体中文](./README.zh-CN.md) :trophy: **Mermaid was nominated and won the [JS Open Source Awards (2019)](https://osawards.com/javascript/2019) in the category "The most exciting use of technology"!!!** + + **Thanks to all involved, people committing pull requests, people answering questions! 🙏** Explore Mermaid.js in depth, with real-world examples, tips & tricks from the creator... The first official book on Mermaid is available for purchase. Check it out! @@ -39,9 +41,8 @@ __The following are some examples of the diagrams, charts and graphs that can be ### Flowchart [docs - live editor] ``` -flowchart LR -title Example flow chart -accDescripton Flow chart showing examples of node usage +flowchart LR + A[Hard] -->|Text| B(Round) B --> C{Decision} C -->|One| D[Result 1] @@ -49,8 +50,7 @@ C -->|Two| E[Result 2] ``` ```mermaid flowchart LR -title Example flow chart -accDescripton Flow chart showing examples of node usage + A[Hard] -->|Text| B(Round) B --> C{Decision} C -->|One| D[Result 1] diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js index f605e98dc..6226feaeb 100644 --- a/cypress/integration/other/xss.spec.js +++ b/cypress/integration/other/xss.spec.js @@ -115,4 +115,18 @@ describe('XSS', () => { cy.wait(1000); cy.get('#the-malware').should('not.exist'); }); + it('should sanitize colons properly', () => { + cy.visit('http://localhost:9000/xss20.html'); + cy.wait(1000); + cy.get('a').click(''); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }); + it('should sanitize colons properly', () => { + cy.visit('http://localhost:9000/xss21.html'); + cy.wait(1000); + cy.get('a').click(''); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }); }); diff --git a/cypress/platform/xss20.html b/cypress/platform/xss20.html new file mode 100644 index 000000000..33d4dfccb --- /dev/null +++ b/cypress/platform/xss20.html @@ -0,0 +1,105 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss21.html b/cypress/platform/xss21.html new file mode 100644 index 000000000..9a88d7afa --- /dev/null +++ b/cypress/platform/xss21.html @@ -0,0 +1,105 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/cypress/platform/xss22.html b/cypress/platform/xss22.html new file mode 100644 index 000000000..d51a7f384 --- /dev/null +++ b/cypress/platform/xss22.html @@ -0,0 +1,16 @@ + + + + + + + +
+ graph TD +A --> B["<a href='javascript#9;t#colon;alert(document.location)'>AAA</a>"] +
+ + + + \ No newline at end of file diff --git a/demos/index.html b/demos/index.html index 37744d832..bdbd2f180 100644 --- a/demos/index.html +++ b/demos/index.html @@ -385,8 +385,7 @@ A -->|Get money| B1[(Go shopping 1)] A -->|Get money| B2[(Go shopping 2)] A -->|Get money| B3[(Go shopping 3)] - C[(Let me think...
Do I want something for work,
something to spend every free second with,
or - something to get around?)] + C[(Let me think...
Do I want something for work,
something to spend every free second with,
or something to get around?)] B1 --> C B2 --> C B3 --> C @@ -518,8 +517,10 @@ sequenceDiagram autonumber Alice->>John: Hello John,
how are you? + autonumber 50 10 Alice->>John: John,
can you hear me? John-->>Alice: Hi Alice,
I can hear you! + autonumber off John-->>Alice: I feel great!
@@ -601,10 +602,11 @@ gitGraph: options { - "nodeSpacing": 150, - "nodeRadius": 10 + "nodeSpacing": 50, + "nodeRadius": 5 } end + branch master commit branch newbranch checkout newbranch diff --git a/demos/sequence.html b/demos/sequence.html index 7dab8cad9..800d44779 100644 --- a/demos/sequence.html +++ b/demos/sequence.html @@ -24,6 +24,7 @@ participant Alice participant Bob participant John as John
Second Line + autonumber 10 10 rect rgb(200, 220, 100) rect rgb(200, 255, 200) Alice ->> Bob: Hello Bob, how are you? @@ -39,14 +40,17 @@ Bob-x John:wrap: John! Are you still debating about how you're doing? How long does it take?? Note over John: After a few more moments, John
finally snaps out of it. end + autonumber off alt either this Alice->>+John: Yes John-->>-Alice: OK else or this + autonumber Alice->>John: No else or this will happen Alice->John: Maybe end + autonumber 200 par this happens in parallel Alice -->> Bob: Parallel message 1 and diff --git a/docs/examples.md b/docs/examples.md index 227161be6..0295a2e50 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -140,7 +140,7 @@ sequenceDiagram ``` -A commit flow diagram. +## A commit flow diagram. ```mermaid gitGraph: commit "Ashish" @@ -155,4 +155,4 @@ gitGraph: commit branch b2 commit -``` \ No newline at end of file +``` diff --git a/docs/flowchart.md b/docs/flowchart.md index f33fe39cc..485686995 100644 --- a/docs/flowchart.md +++ b/docs/flowchart.md @@ -7,7 +7,7 @@ All Flowcharts are composed of **nodes**, the geometric shapes and **edges**, th It can also accommodate different arrow types, multi directional arrows, and linking to and from subgraphs. > **Important note**: Do not type the word "end" as a Flowchart node. Capitalize all or any one the letters to keep the flowchart from breaking, i.e, "End" or "END". Or you can apply this [workaround](https://github.com/mermaid-js/mermaid/issues/1444#issuecomment-639528897).** -Node + ### A node (default) ```mermaid-example diff --git a/docs/index.html b/docs/index.html index b14210dbc..d538ec862 100644 --- a/docs/index.html +++ b/docs/index.html @@ -17,7 +17,7 @@ /> - +