fix mermaid xss

BoostIO · May 24, 2019 · 1ff179a · 1ff179a
1 parent 29ea1ca
commit 1ff179a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/browser/components/MarkdownPreview.js b/browser/components/MarkdownPreview.js
@@ -845,7 +845,7 @@ export default class MarkdownPreview extends React.Component {
     _.forEach(
       this.refs.root.contentWindow.document.querySelectorAll('.mermaid'),
       el => {
-        mermaidRender(el, htmlTextHelper.decodeEntities(el.innerHTML), theme)
+        mermaidRender(el, htmlTextHelper.encodeEntities(el.innerHTML), theme)
       }
     )