Jason Woltje f87a28ac55 fix(#200): Enhance Mermaid XSS protection with DOMPurify ...

Added defense-in-depth security layers for Mermaid rendering:

DOMPurify SVG Sanitization:
- Sanitize SVG output after mermaid.render()
- Remove script tags, iframes, objects, embeds
- Remove event handlers (onerror, onclick, onload, etc.)
- Use SVG profile for allowed elements

Label Sanitization:
- Added sanitizeMermaidLabel() function
- Remove HTML tags from all labels
- Remove dangerous protocols (javascript:, data:, vbscript:)
- Remove control characters
- Escape Mermaid special characters
- Truncate to 200 chars for DoS prevention
- Applied to all node labels in diagrams

Comprehensive XSS Testing:
- 15 test cases covering all attack vectors
- Script tag injection variants
- Event handler injection
- JavaScript/data URL injection
- SVG with embedded scripts
- HTML entity bypass attempts
- All tests passing

Files modified:
- apps/web/src/components/mindmap/MermaidViewer.tsx
- apps/web/src/components/mindmap/hooks/useGraphData.ts
- apps/web/src/components/mindmap/MermaidViewer.test.tsx (new)

Fixes #200

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2026-02-03 22:55:57 -06:00

..

api

fix(#297): Implement actual query processing for federation

2026-02-03 22:48:59 -06:00

coordinator

fix(#180): Update pnpm to 10.27.0 in Dockerfiles

2026-02-01 20:52:43 -06:00

orchestrator

fix(#277): Add comprehensive security event logging for command injection

2026-02-03 20:27:45 -06:00

web

fix(#200): Enhance Mermaid XSS protection with DOMPurify

2026-02-03 22:55:57 -06:00