From 3746339cfc224f85953297da04c4a44ba0dfa58e Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Fri, 8 May 2026 22:10:31 +0200
Subject: [PATCH] refac: apply DOMPurify to excel and office HTML render
 assignments (#24468)

---
 src/lib/components/chat/FileNav.svelte         | 6 ++++--
 src/lib/components/common/FileItemModal.svelte | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lib/components/chat/FileNav.svelte b/src/lib/components/chat/FileNav.svelte
index 1bd204398c..c0043a2409 100644
--- a/src/lib/components/chat/FileNav.svelte
+++ b/src/lib/components/chat/FileNav.svelte
@@ -455,7 +455,8 @@
 							selectedExcelSheet = excelSheetNames[0];
 							const { excelToTable } = await import('$lib/utils/excelToTable');
 							const result = await excelToTable(wb.Sheets[selectedExcelSheet]);
-							fileOfficeHtml = result.html;
+							const DOMPurify = (await import('dompurify')).default;
+							fileOfficeHtml = DOMPurify.sanitize(result.html);
 						}
 					} else if (ext === 'pptx') {
 						const { pptxToImages } = await import('$lib/utils/pptxToHtml');
@@ -1282,7 +1283,8 @@
 						selectedExcelSheet = sheet;
 						const { excelToTable } = await import('$lib/utils/excelToTable');
 						const result = await excelToTable(excelWorkbook.Sheets[sheet]);
-						fileOfficeHtml = result.html;
+						const DOMPurify = (await import('dompurify')).default;
+						fileOfficeHtml = DOMPurify.sanitize(result.html);
 					}}
 					baseUrl={selectedTerminal?.url ?? ''}
 					apiKey={selectedTerminal?.key ?? ''}
diff --git a/src/lib/components/common/FileItemModal.svelte b/src/lib/components/common/FileItemModal.svelte
index 2fb6a16bad..470bb6b52e 100644
--- a/src/lib/components/common/FileItemModal.svelte
+++ b/src/lib/components/common/FileItemModal.svelte
@@ -161,7 +161,7 @@
 		const { excelToTable } = await import('$lib/utils/excelToTable');
 		const worksheet = excelWorkbook.Sheets[selectedSheet];
 		const result = await excelToTable(worksheet);
-		excelHtml = result.html;
+		excelHtml = DOMPurify.sanitize(result.html);
 		rowCount = result.rowCount;
 	};