jamdesk 1.1.93 → 1.1.94

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.93",
+  "version": "1.1.94",
   "description": "CLI for Jamdesk — build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/components/mdx/MermaidInner.tsx

@@ -34,6 +34,20 @@ export function readCache(source: string): CachedDiagram | null {
     if (!raw) return null;
     const parsed = JSON.parse(raw) as Partial<CachedDiagram>;
     if (typeof parsed?.svg !== 'string') return null;
+    // Defense-in-depth: mermaid sanitizes at render time (securityLevel:
+    // 'strict'), but the cache-read path injects the stored bytes via React's
+    // raw inner-HTML prop without re-sanitizing. A tampered sessionStorage
+    // entry must not be trusted — reject anything that isn't a bare <svg> root
+    // or that carries a <script> or an inline on*= event handler. On rejection
+    // we return null so the caller falls back to a fresh, re-sanitized render.
+    const svg = parsed.svg.trimStart();
+    if (
+      !svg.startsWith('<svg') ||
+      /<script\b/i.test(svg) ||
+      /<[^>]+\son[a-z]+\s*=/i.test(svg)
+    ) {
+      return null;
+    }
     // Normalize the shape so the return honestly matches CachedDiagram:
     // legacy v1 entries predate height tracking, and a tampered/foreign
     // entry could carry a non-numeric height. Coerce both to a number.
@@ -52,12 +66,19 @@ export function writeCache(source: string, entry: CachedDiagram): void {
   } catch {}
 }
 
-// Mermaid always emits a `height` attribute on the root <svg>. Reading it
-// from the markup (rather than getBoundingClientRect) works in jsdom and
-// avoids a forced reflow on the production hot path.
+// Real mermaid output does NOT carry a `height` attribute — it sizes the root
+// <svg> via `viewBox` + `style="max-width"`. So read the explicit `height`
+// attribute first (covers other renderers / older mermaid), then fall back to
+// the 4th `viewBox` token (its height). Parsing the markup rather than
+// getBoundingClientRect works in jsdom and avoids a forced reflow on the
+// production hot path.
 export function readSvgHeight(svgMarkup: string): number {
-  const match = svgMarkup.match(/<svg\b[^>]*\bheight=["']([\d.]+)(?:px)?["']/i);
-  return match ? parseFloat(match[1]) : 0;
+  const attr = svgMarkup.match(/<svg\b[^>]*\bheight=["']([\d.]+)(?:px)?["']/i);
+  if (attr) return parseFloat(attr[1]);
+  const viewBox = svgMarkup.match(
+    /<svg\b[^>]*\bviewBox=["']\s*[\d.+-]+\s+[\d.+-]+\s+[\d.+-]+\s+([\d.]+)/i
+  );
+  return viewBox ? parseFloat(viewBox[1]) : 0;
 }
 
 interface MermaidInnerProps {