Merge branch 'security-mermaid-block-12-1' into '12-1-stable'

Only render fixed number of mermaid blocks

See merge request gitlab/gitlabhq!3413

app/assets/javascripts/behaviors/markdown/render_mermaid.js

@@ -35,6 +35,8 @@ export default function renderMermaid($els) {
         },
       });
+      let renderedChars = 0;
+
       $els.each((i, el) => {
         // Mermaid doesn't like `<br />` tags, so collapse all like tags into `<br>`, which is parsed correctly.
         const source = el.textContent.replace(/<br\s*\/>/g, '<br>');
@@ -44,7 +46,7 @@ export default function renderMermaid($els) {
          * prevent mermaidjs from hanging up the entire thread and
          * causing a DoS.
          */
-        if (source && source.length > MAX_CHAR_LIMIT) {
+        if ((source && source.length > MAX_CHAR_LIMIT) || renderedChars > MAX_CHAR_LIMIT) {
           el.textContent = sprintf(
             __(
               'Cannot render the image. Maximum character count (%{charLimit}) has been exceeded.',
@@ -54,6 +56,7 @@ export default function renderMermaid($els) {
           return;
         }
+        renderedChars += source.length;
         // Remove any extra spans added by the backend syntax highlighting.
         Object.assign(el, { textContent: source });

changelogs/unreleased/security-mermaid-block.yml

+---
+title: Only render fixed number of mermaid blocks
+merge_request:
+author:
+type: security