From f083b4a6670b4722204c246416dae13e004ebe7d Mon Sep 17 00:00:00 2001
From: Oliver <oliver@derez.ai>
Date: Sun, 7 Jun 2026 16:50:34 -0300
Subject: [PATCH] chat: render HTML in bot messages (safe innerHTML, strips
 scripts & event handlers)

---
 index.html | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/index.html b/index.html
index e000e42..91e8c40 100644
--- a/index.html
+++ b/index.html
@@ -2415,7 +2415,10 @@
             const msgs = document.getElementById("chat-msgs");
             const div = document.createElement("div");
             div.className = "chat-msg chat-msg-" + role;
-            div.textContent = text;
+            // strip <script> and on* handlers to prevent XSS, but render safe HTML
+            div.innerHTML = text.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+                               .replace(/\son\w+\s*=\s*"[^"]*"/gi, '')
+                               .replace(/\son\w+\s*=\s*'[^']*'/gi, '');
             msgs.appendChild(div);
             msgs.scrollTop = msgs.scrollHeight;
             return div;