AI/dify
1
0
Fork 0
mirror of https://git.mirrors.martin98.com/https://github.com/langgenius/dify.git synced 2025-08-16 20:35:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: xss in render svg (#16437)

Browse Source
This commit is contained in:
Joel 2025-03-21 15:24:58 +08:00 committed by GitHub
parent 0e33a3aa5f
commit 21561df10f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
web/app/components/base/markdown.tsx
View File

@ -18,7 +18,7 @@ import ImageGallery from '@/app/components/base/image-gallery'
import { useChatContext } from '@/app/components/base/chat/chat/context' import { useChatContext } from '@/app/components/base/chat/chat/context'
import VideoGallery from '@/app/components/base/video-gallery' import VideoGallery from '@/app/components/base/video-gallery'
import AudioGallery from '@/app/components/base/audio-gallery' import AudioGallery from '@/app/components/base/audio-gallery'
import SVGRenderer from '@/app/components/base/svg-gallery' // import SVGRenderer from '@/app/components/base/svg-gallery'
import MarkdownButton from '@/app/components/base/markdown-blocks/button' import MarkdownButton from '@/app/components/base/markdown-blocks/button'
import MarkdownForm from '@/app/components/base/markdown-blocks/form' import MarkdownForm from '@/app/components/base/markdown-blocks/form'
@ -118,13 +118,13 @@ const CodeBlock: CodeComponent = memo(({ inline, className, children, ...props }
</div> </div>
) )
} }
else if (language === 'svg' && isSVG) { // else if (language === 'svg' && isSVG) {
return ( // return (
<ErrorBoundary> // <ErrorBoundary>
<SVGRenderer content={content} /> // <SVGRenderer content={content} />
</ErrorBoundary> // </ErrorBoundary>
) // )
} // }
else { else {
return ( return (
<SyntaxHighlighter <SyntaxHighlighter
@ -224,8 +224,16 @@ const Link = ({ node, ...props }: any) => {
} }
} }
function escapeSVGTags(htmlString: string): string {
return htmlString.replace(/(<svg[\s\S]*?>)([\s\S]*?)(<\/svg>)/gi, (match: string, openTag: string, innerContent: string, closeTag: string): string => {
return openTag.replace(/</g, '&lt;').replace(/>/g, '&gt;')
+ innerContent.replace(/</g, '&lt;').replace(/>/g, '&gt;')
+ closeTag.replace(/</g, '&lt;').replace(/>/g, '&gt;')
})
}
export function Markdown(props: { content: string; className?: string }) { export function Markdown(props: { content: string; className?: string }) {
const latexContent = preprocessLaTeX(props.content) const latexContent = preprocessLaTeX(escapeSVGTags(props.content))
return ( return (
<div className={cn(props.className, 'markdown-body')}> <div className={cn(props.className, 'markdown-body')}>
<ReactMarkdown <ReactMarkdown