Oliver/derez.ai
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chat: render HTML in bot messages (safe innerHTML, strips scripts & event handlers)

Browse Source
This commit is contained in:
Oliver
2026-06-07 16:50:34 -03:00
parent df934f0676
commit f083b4a667
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
index.html
+4 -1
View File
@@ -2415,7 +2415,10 @@
const msgs = document.getElementById("chat-msgs"); const msgs = document.getElementById("chat-msgs");
const div = document.createElement("div"); const div = document.createElement("div");
div.className = "chat-msg chat-msg-" + role; div.className = "chat-msg chat-msg-" + role;
div.textContent = text; // strip <script> and on* handlers to prevent XSS, but render safe HTML
div.innerHTML = text.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
.replace(/\son\w+\s*=\s*"[^"]*"/gi, '')
.replace(/\son\w+\s*=\s*'[^']*'/gi, '');
msgs.appendChild(div); msgs.appendChild(div);
msgs.scrollTop = msgs.scrollHeight; msgs.scrollTop = msgs.scrollHeight;
return div; return div;