mermaid-js / mermaid

Generation of diagrams like flowcharts or sequence diagrams from text in a similar manner as markdown
https://mermaid.js.org
MIT License
68.75k stars 6.08k forks source link

[BUG] Using `constructor` as node ID results in errors #5451

Closed Yash-Singh1 closed 1 month ago

Yash-Singh1 commented 2 months ago

Description

When someone uses constructor or __proto__ as the node ID, then it results in errors since it overrides internal object properties. This isn't prototype pollution, this is just overriding these values can generate errors.

Steps to reproduce

  1. Create a flowchart
  2. Rename the ID to __proto__ or constructor

Screenshots

constructor

Screenshot 2024-04-09 at 8 53 18 PM

view fail TypeError: Cannot read properties of undefined (reading 'id')
    at index-fc10efb0.1MTf2mPJ.js:1:10564
    at Array.map (<anonymous>)
    at M (index-fc10efb0.1MTf2mPJ.js:1:9833)
    at bt (index-fc10efb0.1MTf2mPJ.js:1:11949)
    at Object.ae [as draw] (styles-3ed67cfa.CLmMmzON.js:2:1286)
    at async Object.render$1 [as render] (state.BobIb4kd.js:96:1687)

__proto__

Screenshot 2024-04-09 at 8 53 53 PM

view fail TypeError: Utils.channel.clamp[o] is not a function
    at change (state.BobIb4kd.js:15:10249)
    at adjust (state.BobIb4kd.js:15:11045)
    at new Theme$3 (state.BobIb4kd.js:19:14623)
    at Object.getThemeVariables$3 [as getThemeVariables] (state.BobIb4kd.js:19:27063)
    at Object.initialize$1 [as initialize] (state.BobIb4kd.js:96:2726)
    at Object.initialize (state.BobIb4kd.js:96:5750)
    at render (state.BobIb4kd.js:98:1461)
    at async gt (View.Cek2wZ8c.js:2:340)

Code Sample

flowchart TD
  __proto__ --> B

Setup

Suggested Solutions

This should be a pretty simple fix by replacing usages of objects in the db files with Maps. However, I noticed that the classes are exported through the getClasses function on some of the diagrams. So, would switching to Map be considered a breaking change? Another option is to encode the keys before they are inserted into the objects.

Additional Context

No response

sidharthv96 commented 2 months ago

@Yash-Singh1 we haven't released v11 yet, so breaking changes can go in. No issues.