diff --git a/src/components/WorkflowEditor.vue b/src/components/WorkflowEditor.vue
index 321b4c4..92ed7c9 100644
--- a/src/components/WorkflowEditor.vue
+++ b/src/components/WorkflowEditor.vue
@@ -807,9 +807,16 @@ export default {
this.graph.getLabel = cell => {
let label = mxGraph.prototype.getLabel.apply(this, arguments)
+ // Used to encode html labels to prevent security issues
+ const encodeHTML = value => {
+ return value.replace(/[\u00A0-\u9999<>&]/gim, i => {
+ return '' + i.charCodeAt(0) + ';'
+ })
+ }
+
if (cell.edge) {
if (cell.value) {
- label = `
`
+ label = ``
}
} else if (this.vertices[cell.id]) {
const vertex = this.vertices[cell.id]
@@ -838,7 +845,7 @@ export default {
values = cell.edges
.filter(({ source }) => cell.id === source.id)
.map(({ id }) => this.edges[id])
- .map(({ node, config }) => `${node.value} | ${config.expr || ''} |
`)
+ .map(({ node, config }) => `${encodeHTML(node.value)} | ${encodeHTML(config.expr || '')} |
`)
.join('')
} else if (['expressions', 'function', 'prompt', 'iterator'].includes(kind)) {
let { arguments: args = [], results = [], ref } = vertex.config || {}
@@ -852,13 +859,13 @@ export default {
if (args.length && kind !== 'expressions') {
values.push('Arguments | |
')
}
- args = args.map(({ target = '', type = 'Any', expr = '', value = '' }) => `${target} (${type}) | ${expr || value} |
`)
+ args = args.map(({ target = '', type = 'Any', expr = '', value = '' }) => `${encodeHTML(target)} (${type}) | ${encodeHTML(expr || value)} |
`)
if (results.length) {
args.push('Results | |
')
}
- results = results.map(({ target = '', type = 'Any', expr = '', value = '' }) => `${target} (${type}) | ${expr || value} |
`)
+ results = results.map(({ target = '', type = 'Any', expr = '', value = '' }) => `${encodeHTML(target)} (${type}) | ${encodeHTML(expr || value)} |
`)
values = [...values, ...args, ...results].join('')
} else if (kind === 'trigger') {
let { resourceType = '', eventType = '', constraints = [] } = vertex.triggers || {}
@@ -876,7 +883,7 @@ export default {
if (constraints.length && eventType && eventType !== 'onManual') {
values.push('Constraints | | |
')
constraints = constraints.map(({ name = '', op = '', values = '' }) => {
- return `${name || eventType.includes('on') ? eventType.replace('on', '') : ''} | ${op} | ${values.join(' or ')} |
`
+ return `${name || eventType.includes('on') ? eventType.replace('on', '') : ''} | ${op} | ${encodeHTML(values.join(' or '))} |
`
})
} else {
constraints = []
@@ -927,13 +934,13 @@ export default {
'' +
`` +
'
' +
- `${cell.value || '/'}` +
+ `${encodeHTML(cell.value || '/')}` +
'
' +
values +
'
' +
''
} else {
- label = ``
+ label = ``
}
}