From 01d334b0b971008e3565adcffcb053ebb99e11f8 Mon Sep 17 00:00:00 2001 From: Dawood Khan Date: Thu, 1 Jun 2023 05:52:24 -0700 Subject: [PATCH] Use DOMPurify to sanitize html in chatbot (#4360) * dompurify * changelog * format * clean * changelog * Update run.py * update happy-dom --------- Co-authored-by: pngwn --- CHANGELOG.md | 1 + js/chatbot/package.json | 4 +- js/chatbot/src/ChatBot.svelte | 5 +- package.json | 2 +- pnpm-lock.yaml | 3497 ++++++++++++++++++--------------- 5 files changed, 1876 insertions(+), 1633 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a05e404fa1..ae5ab3bba9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ - Fixes favicon path on Windows by [@abidlabs](https://github.com/abidlabs) in [PR 4369](https://github.com/gradio-app/gradio/pull/4369). - Prevent path traversal in `/file` routes by [@abidlabs](https://github.com/abidlabs) in [PR 4370](https://github.com/gradio-app/gradio/pull/4370). - Do not send HF token to other domains via `/proxy` route by [@abidlabs](https://github.com/abidlabs) in [PR 4368](https://github.com/gradio-app/gradio/pull/4368). +- Replace default `markedjs` sanitize function with DOMPurify sanitizer for `gr.Chatbot()` by [@dawoodkhan82](https://github.com/dawoodkhan82) in [PR 4360](https://github.com/gradio-app/gradio/pull/4360) ## Other Changes: diff --git a/js/chatbot/package.json b/js/chatbot/package.json index f7bb1bccea..d6299bc14c 100644 --- a/js/chatbot/package.json +++ b/js/chatbot/package.json @@ -17,6 +17,8 @@ "prismjs": "1.29.0", "@types/prismjs": "1.26.0", "katex": "^0.16.7", - "@types/katex": "^0.16.0" + "@types/katex": "^0.16.0", + "dompurify": "^3.0.3", + "@types/dompurify": "^3.0.2" } } diff --git a/js/chatbot/src/ChatBot.svelte b/js/chatbot/src/ChatBot.svelte index 887b670a67..f521862a32 100644 --- a/js/chatbot/src/ChatBot.svelte +++ b/js/chatbot/src/ChatBot.svelte @@ -4,6 +4,7 @@ import "prismjs/components/prism-python"; import "prismjs/components/prism-latex"; import "katex/dist/katex.min.css"; + import DOMPurify from "dompurify"; import render_math_in_element from "katex/dist/contrib/auto-render.js"; import { beforeUpdate, afterUpdate, createEventDispatcher } from "svelte"; import type { Styles, SelectData } from "@gradio/utils"; @@ -39,7 +40,7 @@ gfm: true, breaks: true, pedantic: false, - sanitize: true, + sanitize: false, smartLists: true, smartypants: false }); @@ -137,7 +138,7 @@ })} > {#if typeof message === "string"} - {@html marked.parse(message)} + {@html DOMPurify.sanitize(marked.parse(message))} {#if feedback && j == 1}