fix(graph-node): sanitize dataModel.id to prevent XSS

rabix · Dec 4, 2020 · 2c238ba · 2c238ba
1 parent 473ec31
commit 2c238ba
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/src/graph/graph-node.ts b/src/graph/graph-node.ts
@@ -128,9 +128,9 @@ export class GraphNode {
 
         return `
             <g tabindex="-1" class="node ${nodeTypeClass} ${typeClass} ${itemsClass}"
-               data-connection-id="${dataModel.connectionId}"
+               data-connection-id="${HtmlUtils.escapeHTML(dataModel.connectionId)}"
                transform="matrix(1, 0, 0, 1, ${x}, ${y})"
-               data-id="${dataModel.id}">
+               data-id="${HtmlUtils.escapeHTML(dataModel.id)}">
                
                 <g class="core" transform="matrix(1, 0, 0, 1, 0, 0)">
                     <circle cx="0" cy="0" r="${radius}" class="outer"></circle>
@@ -217,4 +217,4 @@ export class GraphNode {
         return model;
     }
 
-}
+}