chat: render HTML in bot messages (safe innerHTML, strips scripts & event handlers)

2026-06-07 16:50:34 -03:00
parent df934f0676
commit f083b4a667
1 changed files with 4 additions and 1 deletions
@@ -2415,7 +2415,10 @@
            const msgs = document.getElementById("chat-msgs");
            const div = document.createElement("div");
            div.className = "chat-msg chat-msg-" + role;
-            div.textContent = text;
+            // strip <script> and on* handlers to prevent XSS, but render safe HTML
+            div.innerHTML = text.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+                               .replace(/\son\w+\s*=\s*"[^"]*"/gi, '')
+                               .replace(/\son\w+\s*=\s*'[^']*'/gi, '');
            msgs.appendChild(div);
            msgs.scrollTop = msgs.scrollHeight;
            return div;