Classic298 bf6325ff33 fix: sanitize mermaid SVG output to prevent stored XSS in file preview (#25219) ...

renderMermaidDiagram returned raw mermaid SVG, which FilePreview.svelte injects
via wrapper.innerHTML = svg. Mermaid runs with securityLevel: 'loose', so it
neither sanitizes click hrefs (formatUrl skips sanitizeUrl) nor DOMPurifies its
output; a .md file with a click X href "javascript:..." directive (or an
HTML-label payload) therefore executes script in the app origin when previewed.
The chat path was already safe because SVGPanZoom DOMPurifies before rendering;
file preview was not.

Sanitize at the source: renderMermaidDiagram now returns DOMPurify-cleaned SVG
via a shared sanitizeSvg helper (same policy as SVGPanZoom), so every consumer
including the FilePreview innerHTML sink receives safe output.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-31 14:49:43 -07:00

..

lib

fix: sanitize mermaid SVG output to prevent stored XSS in file preview (#25219)

2026-05-31 14:49:43 -07:00

routes

fix: wire workspace.skills into the sidebar + workspace-index gates (#24729)

2026-05-15 09:34:23 +09:00

app.css

refac

2026-04-21 13:57:43 +09:00

app.d.ts

…

app.html

Enhance image loading performance by adding preload links and setting loading attributes for logos in app.html (#24011)

2026-04-24 15:25:54 +09:00

tailwind.css

refac

2026-03-23 23:39:52 -05:00