Hoan/GenericAgent
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(conductor): escape raw HTML before marked to block stored XSS

Browse Source 
renderMd fed untrusted chat/log into marked → innerHTML; strip '<' so
scripts/on* payloads cannot navigate (e.g. /login?from=/scriptText).
Markdown links and bare URLs remain intact.
This commit is contained in:
Liang Jiaqing committed 2026-08-11 08:31:03 +08:00
1 parent 4570a63466
commit a6ea3fa53c
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
frontends/conductor.html
+1 -1
View File
@@ -381,7 +381,7 @@
let ws, fileDir='', fileParent=''; let ws, fileDir='', fileParent='';
function esc(s){ return String(s||'').replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])); } function esc(s){ return String(s||'').replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])); }
function renderMd(s){ try { return marked.parse(s||'', { breaks: true, gfm: true }); } catch(e){ return esc(s); } } function renderMd(s){ try { return marked.parse(String(s||'').replace(/</g,'&lt;'), { breaks: true, gfm: true }); } catch(e){ return esc(s); } }
function fileUrl(path){ return '/file?path='+encodeURIComponent(path); } function fileUrl(path){ return '/file?path='+encodeURIComponent(path); }
function humanSize(n){ return n==null?'':n<1024?n+' B':n<1048576?(n/1024).toFixed(1)+' KB':(n/1048576).toFixed(1)+' MB'; } function humanSize(n){ return n==null?'':n<1024?n+' B':n<1048576?(n/1024).toFixed(1)+' KB':(n/1048576).toFixed(1)+' MB'; }
async function browseFiles(path=''){ async function browseFiles(path=''){