Tech
The Security Fix That Would Have Silently Broken My Feature
I recently shipped Mermaid diagram support to Forem , the open source platform that powers DEV. Fenced mermaid code blocks now render as actual diagrams instead of plain highlighted source.
Which means this renders, right here, on this post:
flowchart TD
A[CodeQL flags innerHTML] --> B[Add DOMPurify]
B --> C{Measure the output}
C -->|assumed| D[Ship it]
C -->|actually| E[Labels are gone]
E --> F[Find the real bug]
The feature itself is not the...
Read the full discussion on Dev.to
This article was aggregated from Dev.to. Click to join the conversation.
View on Dev.to