Parsing error while using Mermaid diagrams with annotations

[plbonneville]

When using Mermaid diagrams with annotations on classes, for example <<interface>>, an error is thrown.

This is due to the fact that the parser is not able to parse the annotation.

classDiagram
class Shape
<<interface>> Shape
Shape : noOfVertices
Shape : draw()

Loading

Removing safeHTML in render-codeblock-mermaid.html fixes the issue.

<div class="mermaid">
    {{- .Inner | safeHTML }}
</div>
{{ .Page.Store.Set "hasMermaid" true }}

<div class="mermaid">
    {{- .Inner }}
</div>
{{ .Page.Store.Set "hasMermaid" true }}

[joshed-io]

@plbonneville Thanks for opening the issue. Let me see who added that code and if it's safe to remove the safeHTML part.

[davidovich]

@dzello That would be me :-), and mermaid support was added by taking inspiration from https://gohugo.io/content-management/diagrams/#mermaid-diagrams where safeHTML is suggested. Since the input to this codeblock is user defined, I guess we could be ok to remove it. It essentially means that we need to understand what would be the attack vector if we were to remove it.