From 93fcb839c53fd3534c18fc5abdb31c68d6df65ba Mon Sep 17 00:00:00 2001 From: Siegfried Pammer Date: Sun, 8 Nov 2026 12:43:00 +0100 Subject: [PATCH] Sanitize Mermaid diagram template values Assisted-by: OpenCode:gpt-5.6-luna:OpenCode --- .../MermaidDiagrammer/Generator.Run.cs | 23 +++++++++++++------ 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/ICSharpCode.ILSpyX/MermaidDiagrammer/Generator.Run.cs b/ICSharpCode.ILSpyX/MermaidDiagrammer/Generator.Run.cs index 4a449531e2..fe37c085af 100644 --- a/ICSharpCode.ILSpyX/MermaidDiagrammer/Generator.Run.cs +++ b/ICSharpCode.ILSpyX/MermaidDiagrammer/Generator.Run.cs @@ -21,8 +21,10 @@ using System.Diagnostics; using System.IO; using System.Linq; +using System.Net; using System.Text.Json; using System.Text.Json.Serialization; +using System.Text.RegularExpressions; using ICSharpCode.Decompiler.Documentation; using ICSharpCode.ILSpyX.MermaidDiagrammer.Extensions; @@ -31,6 +33,18 @@ namespace ICSharpCode.ILSpyX.MermaidDiagrammer { partial class GenerateHtmlDiagrammer { + internal static string RenderTemplate(string template, ClassDiagrammer model, string modelJson) + { + return Regex.Replace(template, @"\{\{(?:SourceAssemblyName|SourceAssemblyVersion|BuilderVersion|RepoUrl|Model)\}\}", match => match.Value switch { + "{{SourceAssemblyName}}" => WebUtility.HtmlEncode(model.SourceAssemblyName), + "{{SourceAssemblyVersion}}" => WebUtility.HtmlEncode(model.SourceAssemblyVersion), + "{{BuilderVersion}}" => DecompilerVersionInfo.FullVersionWithCommitHash, + "{{RepoUrl}}" => RepoUrl, + "{{Model}}" => modelJson, + _ => match.Value + }); + } + public void Run() { var assemblyPath = Assembly; @@ -116,12 +130,7 @@ private void GenerateOutput(string assemblyPath, ClassDiagrammer model) { var htmlTemplate = EmbeddedResource.ReadText("template.html"); - var html = htmlTemplate - .Replace("{{SourceAssemblyName}}", model.SourceAssemblyName) - .Replace("{{SourceAssemblyVersion}}", model.SourceAssemblyVersion) - .Replace("{{BuilderVersion}}", DecompilerVersionInfo.FullVersionWithCommitHash) - .Replace("{{RepoUrl}}", RepoUrl) - .Replace("{{Model}}", modelJson); + var html = RenderTemplate(htmlTemplate, model, modelJson); File.WriteAllText(Path.Combine(outputFolder, "index.html"), html); @@ -148,4 +157,4 @@ private void GenerateOutput(string assemblyPath, ClassDiagrammer model) internal partial class DiagrammerJsonContext : JsonSerializerContext { } -} \ No newline at end of file +}