mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-21 00:21:19 +00:00
bf6325ff33
renderMermaidDiagram returned raw mermaid SVG, which FilePreview.svelte injects via wrapper.innerHTML = svg. Mermaid runs with securityLevel: 'loose', so it neither sanitizes click hrefs (formatUrl skips sanitizeUrl) nor DOMPurifies its output; a .md file with a click X href "javascript:..." directive (or an HTML-label payload) therefore executes script in the app origin when previewed. The chat path was already safe because SVGPanZoom DOMPurifies before rendering; file preview was not. Sanitize at the source: renderMermaidDiagram now returns DOMPurify-cleaned SVG via a shared sanitizeSvg helper (same policy as SVGPanZoom), so every consumer including the FilePreview innerHTML sink receives safe output. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| characters | ||
| marked | ||
| transitions | ||
| _template_old.ts | ||
| audio.ts | ||
| codeHighlight.ts | ||
| codemirror.ts | ||
| connections.ts | ||
| csp.ts | ||
| excelToTable.ts | ||
| google-drive-picker.ts | ||
| hash.ts | ||
| index.ts | ||
| onedrive-file-picker.ts | ||
| pptxToHtml.ts | ||
| safeImageUrl.ts | ||
| text-scale.ts | ||