Files
GenericAgent/frontends
Liang Jiaqing a6ea3fa53c fix(conductor): escape raw HTML before marked to block stored XSS
renderMd fed untrusted chat/log into marked → innerHTML; strip '<' so
scripts/on* payloads cannot navigate (e.g. /login?from=/scriptText).
Markdown links and bare URLs remain intact.
2026-08-11 08:31:03 +08:00
..