Flowchart securityLevel: "antiscript" disables click callback functionality

[jonmattgray]

Description

Following the flowchart documentation, I've created a clickable element that triggers a javascript callback function. This callback works when securityLevel: "loose" but fails to trigger when securityLevel: "antiscript". I've linked a jsfiddle where you can swap between securityLevel settings to see. Is this intended behaviour?

I was hoping antiscript would remove any potential malicious <script> from the markdown but retain the functionality of click A callback

Steps to reproduce

https://jsfiddle.net/Lb6q8uyz/2

Screenshots

No response

Code Sample

<pre class="mermaid">
    flowchart LR
        A
        click A callback
</pre>

var callback = function () {
      alert('Callback triggered');
};
const config = {
      startOnLoad: true,
      securityLevel: 'antiscript',
};
mermaid.initialize(config);

Setup

• Mermaid version: 11.3.0
• Browser and Version: Firefox 131.0

Suggested Solutions

No response

Additional Context

No response