XSS vulnerability in labels about force-graph

[juusaw]

Even though the id should be relatively safe, I would recommend escaping the label value just in case, for example by using lodash escape or another utility.

[vasturiano]

@juusaw thanks, those are good points. I've extended the docs, to make it more clear that the HTML is being (dangerously) set in these label methods, and the consumer should protect against it.

[pielco11]

Hi all,

I use this library in many projects and just saw this issue. Said that I'm not into web browser infosec, how should I mitigate this vulnerability?

Thank you

PS: currently nodeLabel is given by {node.id}, by JS so the user does not choose "manually" which label give

[pielco11]

Could be a workaround using Canvas images and placing some text and so removing nodeLabel? The code works, though