From 424b624ea9adde47b992e16d4aa00e7cde552081 Mon Sep 17 00:00:00 2001
From: zadam <zadam.apps@gmail.com>
Date: Sun, 15 Jan 2023 13:48:01 +0100
Subject: [PATCH] small mermaid fixes

---
 package-lock.json                                | 10 ++++++----
 package.json                                     |  1 +
 src/public/app/widgets/dialogs/note_revisions.js |  2 +-
 src/share/content_renderer.js                    |  7 ++++---
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f33caa45f..c05b691e7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,11 +1,12 @@
 {
   "name": "trilium",
-  "version": "0.58.3-beta",
+  "version": "0.58.5",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
-      "version": "0.58.3-beta",
+      "name": "trilium",
+      "version": "0.58.5",
       "hasInstallScript": true,
       "license": "AGPL-3.0-only",
       "dependencies": {
@@ -29,6 +30,7 @@
         "electron-debug": "3.2.0",
         "electron-dl": "3.5.0",
         "electron-window-state": "5.0.3",
+        "escape-html": "^1.0.3",
         "express": "4.18.2",
         "express-partial-content": "1.0.2",
         "express-rate-limit": "6.7.0",
@@ -4774,7 +4776,7 @@
     "node_modules/escape-html": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="
     },
     "node_modules/escape-string-regexp": {
       "version": "1.0.5",
@@ -14267,7 +14269,7 @@
     "escape-html": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="
     },
     "escape-string-regexp": {
       "version": "1.0.5",
diff --git a/package.json b/package.json
index 9184da1de..28da4d750 100644
--- a/package.json
+++ b/package.json
@@ -49,6 +49,7 @@
     "electron-debug": "3.2.0",
     "electron-dl": "3.5.0",
     "electron-window-state": "5.0.3",
+    "escape-html": "1.0.3",
     "express": "4.18.2",
     "express-partial-content": "1.0.2",
     "express-rate-limit": "6.7.0",
diff --git a/src/public/app/widgets/dialogs/note_revisions.js b/src/public/app/widgets/dialogs/note_revisions.js
index c936c45be..6bad87617 100644
--- a/src/public/app/widgets/dialogs/note_revisions.js
+++ b/src/public/app/widgets/dialogs/note_revisions.js
@@ -234,7 +234,7 @@ export default class NoteRevisionsDialog extends BasicWidget {
                 renderMathInElement($content[0], {trust: true});
             }
         }
-        else if (revisionItem.type === 'code') {
+        else if (revisionItem.type === 'code' || revisionItem.type === 'mermaid') {
             this.$content.html($("<pre>").text(fullNoteRevision.content));
         }
         else if (revisionItem.type === 'image') {
diff --git a/src/share/content_renderer.js b/src/share/content_renderer.js
index 9b9aef442..d73fa6206 100644
--- a/src/share/content_renderer.js
+++ b/src/share/content_renderer.js
@@ -2,6 +2,7 @@ const {JSDOM} = require("jsdom");
 const shaca = require("./shaca/shaca");
 const assetPath = require("../services/asset_path");
 const shareRoot = require('./share_root');
+const escapeHtml = require('escape-html');
 
 function getContent(note) {
     if (note.isProtected) {
@@ -112,17 +113,17 @@ function renderCode(result) {
 
 function renderMermaid(result) {
     result.content = `
-<div class="mermaid">${result.content}</div>
+<div class="mermaid">${escapeHtml(result.content)}</div>
 <hr>
 <details>
     <summary>Chart source</summary>
-    <pre>${result.content}</pre>
+    <pre>${escapeHtml(result.content)}</pre>
 </details>`
     result.header += `<script src="../../${assetPath}/libraries/mermaid.min.js"></script>`;
 }
 
 function renderImage(result, note) {
-    result.content = `<img src="api/images/${note.noteId}/${note.title}?${note.utcDateModified}">`;
+    result.content = `<img src="api/images/${note.noteId}/${note.escapedTitle}?${note.utcDateModified}">`;
 }
 
 function renderFile(note, result) {