Feature/support markdown

[dabbinavo]

Summary:

Closes #1326

Description for the changelog:

Add markdown support.

Declaration:

Thanks for submitting a pull request, please make sure:

• content meets the license for this project
• appropriate unit tests have been created and/or modified
• you have considered any changes required for the functional tests
• you have read the contribution guide and agree to the Code of Conduct
• either no AI-generated content has been used in this pull request
• or any use of AI in this pull request has been disclosed below:
  • AI Tools: GitHub Copilot Inline Suggestions

Other info:

Work in Progress. Already added markdown support to

• High level system description
• Threat Description
• Threat Mitigations
• Components: Descriptions
• Components: Reason for out of scope
• Add markdown switch to threat model
• Render preview conditionally based on switch

[lreading]

I know this is still a WIP - but I wanted to bring up a potential security concern with using Vue's v-html. v-html does not sanitize input, nor does marked. This means this could become an XSS vector:

<img src=x onerror=alert(1)>
[click me](javascript:alert(1))
<svg onload=alert(1)>
<a href="javascript:alert(1)">x</a>

OWASP's XSS CheatSheet recommends using DOMPurify for HTML sanitzation.

Instead of sanitizing at every element where we render markdown, we could use a shared helper instead:

import { marked } from 'marked';
import DOMPurify from 'dompurify';

export function renderMarkdown(input = '') {
    const html = marked.parse(input, {
        gfm: true,
        breaks: true
    });

    //  allow all safe HTML elements but neither SVG nor MathML
    // https://github.com/cure53/DOMPurify#control-our-allow-lists-and-block-lists
    return DOMPurify.sanitize(html, { USE_PROFILES: { html: true } })
}

Then every place Markdown is rendered, we can call the shared function for consistent rendering and sanitization:

<div v-html="renderMarkdown(threat.description)"></div>

Again, if there's anything I can help with, please let me know! Really appreciate all the work you're putting into this!

[dabbinavo]

Thanks for this awesome thoughts and input. This is really a big thing regarding security and also simplifies the code/logic 👍