From 69d4cdc663cfecc7231d4f768f7ae014fe807457 Mon Sep 17 00:00:00 2001
From: Sebastion <sebastion@sebastion.dev>
Date: Mon, 20 Jul 2026 06:12:23 +0100
Subject: [PATCH] fix(frontend): set Mermaid securityLevel to strict to prevent
 XSS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Mermaid renderer's per-render initialize() call was overriding the
top-level 'strict' setting with 'loose'. With securityLevel: 'loose',
Mermaid does not sanitize scripting/interactive constructs in the
generated SVG, and the SVG is then injected into the DOM via
dangerouslySetInnerHTML — allowing XSS from any attacker-controllable
markdown source (chat messages, task descriptions, etc.).

Aligns the runtime re-initialization with the module-level default.
---
 frontend/src/components/common/markdown.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/components/common/markdown.tsx b/frontend/src/components/common/markdown.tsx
index c2b3559f3..638e3e07c 100644
--- a/frontend/src/components/common/markdown.tsx
+++ b/frontend/src/components/common/markdown.tsx
@@ -40,7 +40,7 @@ const Mermaid = memo(function Mermaid({ chart, isDark }: MermaidProps) {
         mermaid.initialize({
           startOnLoad: false,
           theme: isDark ? "dark" : "default",
-          securityLevel: "loose",
+          securityLevel: "strict",
           suppressErrorRendering: true,
         })
         // 使用唯一 ID 避免冲突