mirror of
https://github.com/stablyai/orca.git
synced 2026-09-21 16:02:20 +00:00
a7ed5a45c2
* fix(mobile): render Mermaid diagrams in MobileMarkdown (#11141) Co-Authored-By: Grok Companion <noreply@x.ai> * fix(mobile): keep streaming mermaid fences as raw code until the fence closes * perf(mobile): memoize MermaidDiagram and add a CDN load watchdog * fix(mobile): escape mermaid source before embedding in WebView script JSON.stringify leaves </script>, &, and U+2028/U+2029 raw, so a diagram source containing </script> broke out of the inline script and ran arbitrary WebView JS. Diagram source is untrusted (agent output, PR/chat content), and this component now renders from chat and markdown preview, not just the PR sidebar. Escape those chars to \uXXXX; the literal still parses back to the exact source. Adds an adversarial buildHtml test. * fix(mobile): embed the mermaid engine instead of fetching it from a CDN The diagram WebView loaded mermaid from jsdelivr at runtime: offline and constrained-network renders always fell back, the stalled-load watchdog existed only to paper over that, and an unpinned floating-major CDN script with no integrity check ran inside the WebView. Embed the lockfile-pinned package's prebuilt bundle via a postinstall generator (same mechanism as the terminal WebView engine) so the document loads nothing external; the watchdog is removed as obsolete and a no-external-URL gate pins it. * chore(deps): align mermaid at 11.16.0 across desktop and mobile Desktop floated ^11.15.0 while the mobile embedded engine resolved 11.16.0. Raise the desktop floor so both lockfiles resolve the same version, and pin mobile exact: the generated WebView engine embeds the package bytes, so an implicit range bump would silently change what ships. * fix(mobile): block Mermaid diagram network requests Mermaid image-node URLs can initiate subresource requests even with the engine embedded. Keep the WebView offline by restricting resource types through its document CSP. * style(mobile): format Mermaid routing test * fix(mobile): use stable keys for Mermaid diagrams * fix(mobile): keep duplicate Mermaid keys distinct Combine each diagram source with its sibling occurrence so identical diagrams remain unique while source edits still remount the WebView and later streaming prose does not. * fix(mobile): keep Mermaid transitive within release-age policy --------- Co-authored-by: Grok Companion <noreply@x.ai> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
43 lines
1.6 KiB
JavaScript
43 lines
1.6 KiB
JavaScript
import { readFile, writeFile } from 'node:fs/promises'
|
|
import path from 'node:path'
|
|
import { createRequire } from 'node:module'
|
|
|
|
const require = createRequire(import.meta.url)
|
|
const scriptDir = import.meta.dirname
|
|
const mobileRoot = path.resolve(scriptDir, '..')
|
|
const outputPath = path.join(
|
|
mobileRoot,
|
|
'src',
|
|
'components',
|
|
'pr-sidebar',
|
|
'mermaid-webview-engine.generated.ts'
|
|
)
|
|
|
|
// Why: unlike the terminal engine (esbuilt from source for old-WebView shims),
|
|
// mermaid's prebuilt UMD bundle is embedded verbatim — it is the exact artifact
|
|
// the diagram WebView previously fetched from a CDN, now pinned and
|
|
// integrity-checked through the lockfile and available offline.
|
|
async function main() {
|
|
const packageJsonPath = require.resolve('mermaid/package.json')
|
|
const [packageJson, bundleJs] = await Promise.all([
|
|
readFile(packageJsonPath, 'utf8').then(JSON.parse),
|
|
readFile(path.join(path.dirname(packageJsonPath), 'dist', 'mermaid.min.js'), 'utf8')
|
|
])
|
|
|
|
// A literal </script> inside the bundle would close the inline script tag it
|
|
// is embedded in; \/ is identical to / in JS strings, regexes, and comments.
|
|
const inlineSafeJs = bundleJs.replace(/<\/script/gi, '<\\/script')
|
|
|
|
const source = [
|
|
'// Generated by scripts/build-mermaid-webview-engine.mjs.',
|
|
`// Package: mermaid@${packageJson.version} (dist/mermaid.min.js, embedded verbatim).`,
|
|
'// Do not edit by hand; regenerate via pnpm postinstall.',
|
|
`export const MERMAID_ENGINE_JS = ${JSON.stringify(inlineSafeJs)}`,
|
|
''
|
|
].join('\n')
|
|
|
|
await writeFile(outputPath, source)
|
|
}
|
|
|
|
await main()
|