flowchart-sequence-designer 1.2.1 → 1.2.2

package/dist/ui/index.js

@@ -528,7 +528,7 @@ function nextId(prefix, existing) {
   let max = 0;
   for (const item of existing) {
     const match = re.exec(item.id);
-    if (match) {
+    if (match?.[1]) {
       const n = parseInt(match[1], 10);
       if (n > max) max = n;
     }
@@ -1352,7 +1352,7 @@ function estimateW(text, pxPerChar = 7) {
 }
 function SequenceCanvas(props) {
   const {
-    model,
+    model: _model,
     actors,
     messages,
     t,
@@ -1956,9 +1956,15 @@ function escapeXML(s2) {
 }
 function sanitizeForSVG(s2) {
   let clean = s2;
-  clean = clean.replace(/<\/?[a-zA-Z][^>]*>/g, "");
-  clean = clean.replace(/\b(?:javascript|data|vbscript)\s*:/gi, "");
-  clean = clean.replace(/\bon[a-z]+\s*=/gi, "");
+  while (/<[a-zA-Z/][^>]{0,500}>/g.test(clean)) {
+    clean = clean.replace(/<[a-zA-Z/][^>]{0,500}>/g, "");
+  }
+  while (/\b(?:javascript|data|vbscript)\s*:/gi.test(clean)) {
+    clean = clean.replace(/\b(?:javascript|data|vbscript)\s*:/gi, "");
+  }
+  while (/\bon[a-z]+\s*=/gi.test(clean)) {
+    clean = clean.replace(/\bon[a-z]+\s*=/gi, "");
+  }
   clean = clean.replace(/\x00/g, "");
   return escapeXML(clean);
 }
@@ -2378,9 +2384,15 @@ var MAX_IMPORT_LENGTH = 2 * 1024 * 1024;
 function sanitizeLabel(raw) {
   let s2 = raw;
   s2 = s2.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
-  s2 = s2.replace(/<\/?[a-zA-Z][^>]*>/g, "");
-  s2 = s2.replace(/\b(?:javascript|data|vbscript)\s*:/gi, "");
-  s2 = s2.replace(/\bon[a-z]+\s*=/gi, "");
+  while (/<[a-zA-Z/][^>]{0,500}>/g.test(s2)) {
+    s2 = s2.replace(/<[a-zA-Z/][^>]{0,500}>/g, "");
+  }
+  while (/\b(?:javascript|data|vbscript)\s*:/gi.test(s2)) {
+    s2 = s2.replace(/\b(?:javascript|data|vbscript)\s*:/gi, "");
+  }
+  while (/\bon[a-z]+\s*=/gi.test(s2)) {
+    s2 = s2.replace(/\bon[a-z]+\s*=/gi, "");
+  }
   if (s2.length > MAX_LABEL_LENGTH) {
     s2 = s2.slice(0, MAX_LABEL_LENGTH);
   }
@@ -2390,11 +2402,11 @@ function sanitizeLabel(raw) {
 // src/importers/mermaid.ts
 function parseNodeDecl(raw) {
   const patterns = [
-    [/^(\w+)\{\{?"?(.+?)"?\}?\}$/, "diamond"],
-    [/^(\w+)\(\("?(.+?)"?\)\)$/, "circle"],
-    [/^(\w+)\[\/(.+?)\/\]$/, "parallelogram"],
-    [/^(\w+)\[["']?(.+?)["']?\]$/, "rectangle"],
-    [/^(\w+)\("?(.+?)"?\)$/, "rectangle"]
+    [/^(\w+)\{\{?"?([^}"]+)"?\}?\}$/, "diamond"],
+    [/^(\w+)\(\("?([^)"]+)"?\)\)$/, "circle"],
+    [/^(\w+)\[\/([^/\]]+)\/\]$/, "parallelogram"],
+    [/^(\w+)\[["']?([^\]"']+)["']?\]$/, "rectangle"],
+    [/^(\w+)\("?([^)"]+)"?\)$/, "rectangle"]
   ];
   for (const [re, shape] of patterns) {
     const m = raw.match(re);
@@ -2402,7 +2414,7 @@ function parseNodeDecl(raw) {
   }
   return null;
 }
-var EDGE_RE = /^(.+?)\s*(-\.->|-\.-|-->|---)(?:\|(.+?)\|)?\s*(.+)$/;
+var EDGE_RE = /^(\S+)\s*(-\.->|-\.-|-->|---)(?:\|([^|]+)\|)?\s*(.+)$/;
 function detectStyle(connector) {
   return connector.startsWith("-.") ? "dashed" : "solid";
 }
@@ -2520,7 +2532,7 @@ function parseSequence(lines, title) {
       safeAddActor(actorMatch[1].trim());
       continue;
     }
-    const msgMatch = trimmed.match(/^(.+?)\s*(-->>|->>|-->|->)\s*(.+?):\s*(.+)$/);
+    const msgMatch = trimmed.match(/^(\w+)\s*(-->>|->>|-->|->)\s*(\w+):\s*(.+)$/);
     if (msgMatch) {
       const from = safeAddActor(msgMatch[1].trim());
       const arrow = msgMatch[2];
@@ -2545,7 +2557,7 @@ function fromMermaid(mermaid) {
   if (mermaid.length > MAX_IMPORT_LENGTH) {
     throw new Error(`Import aborted: input exceeds the maximum of ${MAX_IMPORT_LENGTH} characters`);
   }
-  const cleaned = mermaid.replace(/mermaid\.initialize\([\s\S]*?\)\s*;?/g, "");
+  const cleaned = mermaid.replace(/mermaid\.initialize\([^)]*\)\s*;?/g, "");
   const rawLines = cleaned.split("\n");
   let startIdx = 0;
   let title;
@@ -4775,7 +4787,7 @@ function DiagramCanvas(props) {
     acc,
     transform,
     setTransform,
-    selected,
+    selected: _selected,
     selectedSet,
     hoveredId,
     setHoveredId,