From 6ec5803e953534c077f863d723972c78796fe16a Mon Sep 17 00:00:00 2001
From: Adam Malczewski <github@tradam.dev>
Date: Wed, 20 May 2026 13:31:58 +0900
Subject: fix: gemini review — XSS sanitization, collapse-arrow padding,
 redundant alias
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/frontend/src/lib/components/ChatMessage.svelte      | 2 +-
 packages/frontend/src/lib/components/MarkdownRenderer.svelte | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'packages/frontend/src/lib/components')

diff --git a/packages/frontend/src/lib/components/ChatMessage.svelte b/packages/frontend/src/lib/components/ChatMessage.svelte
index 1b92de3..09182f3 100644
--- a/packages/frontend/src/lib/components/ChatMessage.svelte
+++ b/packages/frontend/src/lib/components/ChatMessage.svelte
@@ -13,7 +13,7 @@ const isUser = $derived(message.role === "user");
 		{#if message.thinking}
 			<div class="collapse collapse-arrow mb-2">
 				<input type="checkbox" />
-				<div class="collapse-title text-sm opacity-60 italic p-0 min-h-0">Thinking...</div>
+				<div class="collapse-title text-sm opacity-60 italic py-0 pl-0 pr-8 min-h-0">Thinking...</div>
 				<div class="collapse-content text-sm opacity-60 italic p-0">
 					<p class="whitespace-pre-wrap mt-1">{message.thinking}</p>
 				</div>
diff --git a/packages/frontend/src/lib/components/MarkdownRenderer.svelte b/packages/frontend/src/lib/components/MarkdownRenderer.svelte
index 88dd42a..f9925c6 100644
--- a/packages/frontend/src/lib/components/MarkdownRenderer.svelte
+++ b/packages/frontend/src/lib/components/MarkdownRenderer.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { Marked } from "marked";
 	import { markedHighlight } from "marked-highlight";
+	import DOMPurify from "dompurify";
 	import hljs from "highlight.js/lib/core";
 	// Hot set — matches roughly what ChatGPT preloads. Registered eagerly so
 	// common code blocks highlight on first paint without a network roundtrip.
@@ -71,7 +72,6 @@
 		svg: "xml",
 		md: "markdown",
 		mdx: "markdown",
-		dockerfile: "dockerfile",
 		golang: "go",
 		rs: "rust",
 		kt: "kotlin",
@@ -159,8 +159,8 @@
 		const myToken = ++renderToken;
 		(async () => {
 			try {
-				const result = (await md.parse(src)) as string;
-				if (myToken === renderToken) html = result;
+				const raw = (await md.parse(src)) as string;
+				if (myToken === renderToken) html = DOMPurify.sanitize(raw);
 			} catch {
 				// swallow — keeps last successful render visible
 			}
-- 
cgit v1.2.3