From a6ea3fa53c4e2019a0fce8501bfb4cfa6a397add Mon Sep 17 00:00:00 2001
From: Liang Jiaqing <l.j.q.light@gmail.com>
Date: Tue, 11 Aug 2026 08:31:03 +0800
Subject: [PATCH] fix(conductor): escape raw HTML before marked to block stored
 XSS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

renderMd fed untrusted chat/log into marked → innerHTML; strip '<' so
scripts/on* payloads cannot navigate (e.g. /login?from=/scriptText).
Markdown links and bare URLs remain intact.
---
 frontends/conductor.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontends/conductor.html b/frontends/conductor.html
index 5e1621a1..9959b75a 100644
--- a/frontends/conductor.html
+++ b/frontends/conductor.html
@@ -381,7 +381,7 @@
     let ws, fileDir='', fileParent='';
 
     function esc(s){ return String(s||'').replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])); }
-    function renderMd(s){ try { return marked.parse(s||'', { breaks: true, gfm: true }); } catch(e){ return esc(s); } }
+    function renderMd(s){ try { return marked.parse(String(s||'').replace(/</g,'&lt;'), { breaks: true, gfm: true }); } catch(e){ return esc(s); } }
     function fileUrl(path){ return '/file?path='+encodeURIComponent(path); }
     function humanSize(n){ return n==null?'':n<1024?n+' B':n<1048576?(n/1024).toFixed(1)+' KB':(n/1048576).toFixed(1)+' MB'; }
     async function browseFiles(path=''){