jamdesk 1.1.93 → 1.1.95

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.93",
+  "version": "1.1.95",
   "description": "CLI for Jamdesk — build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/components/mdx/MermaidInner.tsx

@@ -28,12 +28,27 @@ export interface CachedDiagram {
   height: number;
 }
 
+// Coarse tamper check, NOT a sanitizer. mermaid's securityLevel:'strict' is
+// the real defense (it sanitizes at render). This only guards the cache-read
+// path, which re-injects stored bytes via React's raw inner-HTML prop without
+// re-sanitizing — so a tampered same-origin sessionStorage entry is rejected
+// here, forcing a fresh re-sanitized render. Catches the obvious signatures
+// only (non-<svg> root, <script>, inline on*= handlers).
+function looksTampered(svg: string): boolean {
+  return (
+    !/^\s*<svg/.test(svg) ||
+    /<script\b/i.test(svg) ||
+    /<[^>]+\son[a-z]+\s*=/i.test(svg)
+  );
+}
+
 export function readCache(source: string): CachedDiagram | null {
   try {
     const raw = sessionStorage.getItem(CACHE_KEY_PREFIX + hashDiagram(source));
     if (!raw) return null;
     const parsed = JSON.parse(raw) as Partial<CachedDiagram>;
     if (typeof parsed?.svg !== 'string') return null;
+    if (looksTampered(parsed.svg)) return null;
     // Normalize the shape so the return honestly matches CachedDiagram:
     // legacy v1 entries predate height tracking, and a tampered/foreign
     // entry could carry a non-numeric height. Coerce both to a number.
@@ -52,12 +67,17 @@ export function writeCache(source: string, entry: CachedDiagram): void {
   } catch {}
 }
 
-// Mermaid always emits a `height` attribute on the root <svg>. Reading it
-// from the markup (rather than getBoundingClientRect) works in jsdom and
-// avoids a forced reflow on the production hot path.
+// Real mermaid output has no `height` attribute (it sizes via viewBox +
+// max-width), so fall back to the viewBox height; an explicit `height` still
+// wins when present (other/older renderers). Markup-parsing instead of
+// getBoundingClientRect keeps this jsdom-safe and reflow-free on the hot path.
 export function readSvgHeight(svgMarkup: string): number {
-  const match = svgMarkup.match(/<svg\b[^>]*\bheight=["']([\d.]+)(?:px)?["']/i);
-  return match ? parseFloat(match[1]) : 0;
+  const attr = svgMarkup.match(/<svg\b[^>]*\bheight=["']([\d.]+)(?:px)?["']/i);
+  if (attr) return parseFloat(attr[1]);
+  const viewBox = svgMarkup.match(
+    /<svg\b[^>]*\bviewBox=["']\s*[\d.+-]+\s+[\d.+-]+\s+[\d.+-]+\s+([\d.]+)/i
+  );
+  return viewBox ? parseFloat(viewBox[1]) : 0;
 }
 
 interface MermaidInnerProps {