jamdesk 1.1.94 → 1.1.95

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.94",
+  "version": "1.1.95",
   "description": "CLI for Jamdesk — build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/components/mdx/MermaidInner.tsx

@@ -28,26 +28,27 @@ export interface CachedDiagram {
   height: number;
 }
 
+// Coarse tamper check, NOT a sanitizer. mermaid's securityLevel:'strict' is
+// the real defense (it sanitizes at render). This only guards the cache-read
+// path, which re-injects stored bytes via React's raw inner-HTML prop without
+// re-sanitizing — so a tampered same-origin sessionStorage entry is rejected
+// here, forcing a fresh re-sanitized render. Catches the obvious signatures
+// only (non-<svg> root, <script>, inline on*= handlers).
+function looksTampered(svg: string): boolean {
+  return (
+    !/^\s*<svg/.test(svg) ||
+    /<script\b/i.test(svg) ||
+    /<[^>]+\son[a-z]+\s*=/i.test(svg)
+  );
+}
+
 export function readCache(source: string): CachedDiagram | null {
   try {
     const raw = sessionStorage.getItem(CACHE_KEY_PREFIX + hashDiagram(source));
     if (!raw) return null;
     const parsed = JSON.parse(raw) as Partial<CachedDiagram>;
     if (typeof parsed?.svg !== 'string') return null;
-    // Defense-in-depth: mermaid sanitizes at render time (securityLevel:
-    // 'strict'), but the cache-read path injects the stored bytes via React's
-    // raw inner-HTML prop without re-sanitizing. A tampered sessionStorage
-    // entry must not be trusted — reject anything that isn't a bare <svg> root
-    // or that carries a <script> or an inline on*= event handler. On rejection
-    // we return null so the caller falls back to a fresh, re-sanitized render.
-    const svg = parsed.svg.trimStart();
-    if (
-      !svg.startsWith('<svg') ||
-      /<script\b/i.test(svg) ||
-      /<[^>]+\son[a-z]+\s*=/i.test(svg)
-    ) {
-      return null;
-    }
+    if (looksTampered(parsed.svg)) return null;
     // Normalize the shape so the return honestly matches CachedDiagram:
     // legacy v1 entries predate height tracking, and a tampered/foreign
     // entry could carry a non-numeric height. Coerce both to a number.
@@ -66,12 +67,10 @@ export function writeCache(source: string, entry: CachedDiagram): void {
   } catch {}
 }
 
-// Real mermaid output does NOT carry a `height` attribute — it sizes the root
-// <svg> via `viewBox` + `style="max-width"`. So read the explicit `height`
-// attribute first (covers other renderers / older mermaid), then fall back to
-// the 4th `viewBox` token (its height). Parsing the markup rather than
-// getBoundingClientRect works in jsdom and avoids a forced reflow on the
-// production hot path.
+// Real mermaid output has no `height` attribute (it sizes via viewBox +
+// max-width), so fall back to the viewBox height; an explicit `height` still
+// wins when present (other/older renderers). Markup-parsing instead of
+// getBoundingClientRect keeps this jsdom-safe and reflow-free on the hot path.
 export function readSvgHeight(svgMarkup: string): number {
   const attr = svgMarkup.match(/<svg\b[^>]*\bheight=["']([\d.]+)(?:px)?["']/i);
   if (attr) return parseFloat(attr[1]);