test: block, er, gantt, git, pie

docs/config/setup/modules/mermaidAPI.md

@@ -190,12 +190,12 @@ the string with all the user styles
 
 #### Parameters
 
-| Name        | Type                                                      |
-| :---------- | :-------------------------------------------------------- |
-| `config`    | `MermaidConfig`                                           |
-| `graphType` | `string`                                                  |
+| Name        | Type                                                   |
+| :---------- | :----------------------------------------------------- |
+| `config`    | `MermaidConfig`                                        |
+| `graphType` | `string`                                               |
 | `classDefs` | `undefined` \| `Map`<`string`, `DiagramStyleClassDef`> |
-| `svgId`     | `string`                                                  |
+| `svgId`     | `string`                                               |
 
 #### Returns
 

packages/mermaid/src/diagrams/block/parser/block.spec.ts

@@ -410,7 +410,9 @@ columns 1
   describe('prototype properties', function () {
     function validateProperty(prop: string) {
       expect(() => block.parse(`block-beta\n${prop}`)).not.toThrow();
-      expect(() => block.parse(`block-beta\nA; classDef ${prop} color:#ffffff,fill:#000000; class A ${prop}`)).not.toThrow(); 
+      expect(() =>
+        block.parse(`block-beta\nA; classDef ${prop} color:#ffffff,fill:#000000; class A ${prop}`)
+      ).not.toThrow();
     }
 
     it('should work with a prototype property', function () {

packages/mermaid/src/diagrams/er/parser/erDiagram.spec.js

@@ -809,5 +809,5 @@ describe('when parsing ER diagram it...', function () {
     it('should work with a constructor property', function () {
       validateProperty('constructor');
     });
-  })
+  });
 });

packages/mermaid/src/diagrams/gantt/parser/gantt.spec.js

@@ -258,11 +258,13 @@ row2`;
   );
 
   it.each(['__proto__', 'constructor', 'prototype'])('should allow for a link to %s id', (prop) => {
-    expect(() => parser.parse(`gantt
+    expect(() =>
+      parser.parse(`gantt
     dateFormat YYYY-MM-DD
     section Section
     A task :${prop}, 2024-10-01, 3d
     click ${prop} href "https://mermaid.js.org/"
-    `)).not.toThrow();
+    `)
+    ).not.toThrow();
   });
 });

packages/mermaid/src/diagrams/git/gitGraphParserV2.spec.js

@@ -1095,4 +1095,26 @@ describe('when parsing a gitGraph', function () {
       expect(parser.yy.getAccDescription()).toBe('This is a description\nusing multiple lines');
     });
   });
+
+  describe('unsafe properties', () => {
+    for (const prop of ['__proto__', 'constructor', 'prototype']) {
+      it(`should work with custom commit id or branch name ${prop}`, () => {
+        const str = `gitGraph
+    commit id:"${prop}"
+    branch ${prop}
+    checkout ${prop}
+    commit
+    checkout main
+    merge ${prop}
+    `;
+        parser.parse(str);
+        const commits = parser.yy.getCommits();
+        expect(commits.size).toBe(3);
+        expect(commits.keys().next().value).toBe(prop);
+        expect(parser.yy.getCurrentBranch()).toBe('main');
+        expect(parser.yy.getBranches().size).toBe(2);
+        expect(parser.yy.getBranchesAsObjArray()[1].name).toBe(prop);
+      });
+    }
+  });
 });

packages/mermaid/src/diagrams/pie/pie.spec.ts

@@ -138,6 +138,14 @@ describe('pie', () => {
         `);
       }).rejects.toThrowError();
     });
+
+    it('should handle unsafe properties', async () => {
+      await expect(parser.parse(`pie title Unsafe props test
+        "__proto__" : 386
+        "constructor" : 85
+        "prototype" : 15`)).resolves.toBeUndefined();
+      expect([...db.getSections().keys()]).toEqual(['__proto__', 'constructor', 'prototype']);
+    });
   });
 
   describe('config', () => {