UniqAI/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui synced 2024-11-16 05:24:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #5584 from open-webui/dev

Browse Source 
fix: node tooltip xss issue
This commit is contained in:
Timothy Jaeryang Baek 2024-09-21 21:44:25 +02:00 committed by GitHub
commit 6b463164f4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/lib/components/chat/Overview/Node.svelte
View File

@ -15,6 +15,7 @@
<Tooltip
content={data?.message?.error ? data.message.error.content : data.message.content}
class="w-full"
allowHTML={false}
>
{#if data.message.role === 'user'}
<div class="flex w-full">

11
src/lib/components/common/Tooltip.svelte
View File

@ -1,4 +1,6 @@
<script lang="ts">
import DOMPurify from 'dompurify';
import { onDestroy } from 'svelte';
import { marked } from 'marked';
@ -10,18 +12,19 @@
export let touch = true;
export let className = 'flex';
export let theme = '';
export let allowHTML = true;
let tooltipElement;
let tooltipInstance;
$: if (tooltipElement && content) {
if (tooltipInstance) {
tooltipInstance.setContent(content);
tooltipInstance.setContent(DOMPurify.sanitize(content));
} else {
tooltipInstance = tippy(tooltipElement, {
content: content,
content: DOMPurify.sanitize(content),
placement: placement,
allowHTML: true,
allowHTML: allowHTML,
touch: touch,
...(theme !== '' ? { theme } : { theme: 'dark' }),
arrow: false,
@ -41,6 +44,6 @@
});
</script>
<div bind:this={tooltipElement} aria-label={content} class={className}>
<div bind:this={tooltipElement} aria-label={DOMPurify.sanitize(content)} class={className}>
<slot />
</div>