diff options
| author | Adam Malczewski <[email protected]> | 2026-05-20 13:31:58 +0900 |
|---|---|---|
| committer | Adam Malczewski <[email protected]> | 2026-05-20 13:31:58 +0900 |
| commit | 6ec5803e953534c077f863d723972c78796fe16a (patch) | |
| tree | ed49ea0853d62497dfa0c580f466fa2ae3cf5b0c /packages/frontend/src | |
| parent | 19144599bcb6d6a180d4a2cfe1bdc7f58780ac0c (diff) | |
| download | dispatch-6ec5803e953534c077f863d723972c78796fe16a.tar.gz dispatch-6ec5803e953534c077f863d723972c78796fe16a.zip | |
fix: gemini review — XSS sanitization, collapse-arrow padding, redundant alias
Diffstat (limited to 'packages/frontend/src')
| -rw-r--r-- | packages/frontend/src/lib/components/ChatMessage.svelte | 2 | ||||
| -rw-r--r-- | packages/frontend/src/lib/components/MarkdownRenderer.svelte | 6 |
2 files changed, 4 insertions, 4 deletions
diff --git a/packages/frontend/src/lib/components/ChatMessage.svelte b/packages/frontend/src/lib/components/ChatMessage.svelte index 1b92de3..09182f3 100644 --- a/packages/frontend/src/lib/components/ChatMessage.svelte +++ b/packages/frontend/src/lib/components/ChatMessage.svelte @@ -13,7 +13,7 @@ const isUser = $derived(message.role === "user"); {#if message.thinking} <div class="collapse collapse-arrow mb-2"> <input type="checkbox" /> - <div class="collapse-title text-sm opacity-60 italic p-0 min-h-0">Thinking...</div> + <div class="collapse-title text-sm opacity-60 italic py-0 pl-0 pr-8 min-h-0">Thinking...</div> <div class="collapse-content text-sm opacity-60 italic p-0"> <p class="whitespace-pre-wrap mt-1">{message.thinking}</p> </div> diff --git a/packages/frontend/src/lib/components/MarkdownRenderer.svelte b/packages/frontend/src/lib/components/MarkdownRenderer.svelte index 88dd42a..f9925c6 100644 --- a/packages/frontend/src/lib/components/MarkdownRenderer.svelte +++ b/packages/frontend/src/lib/components/MarkdownRenderer.svelte @@ -1,6 +1,7 @@ <script lang="ts"> import { Marked } from "marked"; import { markedHighlight } from "marked-highlight"; + import DOMPurify from "dompurify"; import hljs from "highlight.js/lib/core"; // Hot set — matches roughly what ChatGPT preloads. Registered eagerly so // common code blocks highlight on first paint without a network roundtrip. @@ -71,7 +72,6 @@ svg: "xml", md: "markdown", mdx: "markdown", - dockerfile: "dockerfile", golang: "go", rs: "rust", kt: "kotlin", @@ -159,8 +159,8 @@ const myToken = ++renderToken; (async () => { try { - const result = (await md.parse(src)) as string; - if (myToken === renderToken) html = result; + const raw = (await md.parse(src)) as string; + if (myToken === renderToken) html = DOMPurify.sanitize(raw); } catch { // swallow — keeps last successful render visible } |