discourse/plugins/discourse-graphviz/db/post_migrate/20260218104617_rebake_graphviz_posts.rb
Penar Musaraj 472f9e1f78 SECURITY: Sanitize graphviz SVG anchor links to prevent XSS
Graphviz can generate SVG output with anchor elements containing
arbitrary URLs specified by users. This change implements server-side
sanitization to allow only http and https URLs.
2026-03-19 15:21:28 +00:00

17 lines
370 B
Ruby

# frozen_string_literal: true
class RebakeGraphvizPosts < ActiveRecord::Migration[7.2]
def up
# Rebake posts with graphviz graphs to apply updated link sanitization
execute <<~SQL
UPDATE posts
SET baked_version = 0
WHERE raw LIKE '%[graphviz]%'
OR cooked LIKE '%class="graphviz%'
SQL
end
def down
# Do nothing
end
end