| 1543 | |
| 1544 | // Add helper to sanitize markmap nodes against XSS using the global preventXSS |
| 1545 | function sanitizeMarkmapNode (node) { |
| 1546 | if (!node || typeof node !== 'object') return |
| 1547 | if (typeof node.content === 'string') { |
| 1548 | try { |
| 1549 | node.content = window.preventXSS(node.content) |
| 1550 | } catch (e) { |
| 1551 | // fallback: strip potentially dangerous characters |
| 1552 | node.content = node.content.replace(/[<>]/g, '') |
| 1553 | } |
| 1554 | } |
| 1555 | // remove dangerous href like javascript: |
| 1556 | if (node.payload && typeof node.payload === 'object' && typeof node.payload.href === 'string') { |
| 1557 | if (/^\s*javascript:/i.test(node.payload.href)) { |
| 1558 | delete node.payload.href |
| 1559 | } |
| 1560 | } |
| 1561 | if (Array.isArray(node.children)) { |
| 1562 | node.children.forEach(sanitizeMarkmapNode) |
| 1563 | } |
| 1564 | } |