Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use DOMPurify to sanitize html in chatbot #4360

Merged
merged 8 commits into from
Jun 1, 2023
Merged

Use DOMPurify to sanitize html in chatbot #4360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
63abfa4
dompurify
dawoodkhan82 May 30, 2023
9475127
changelog
dawoodkhan82 May 30, 2023
9038a00
format
dawoodkhan82 May 30, 2023
cd458e9
clean
dawoodkhan82 May 30, 2023
4277e13
changelog
dawoodkhan82 May 30, 2023
644f110
Update run.py
dawoodkhan82 May 30, 2023
9f673c5
update happy-dom
pngwn Jun 1, 2023
76bd46d
Merge branch 'main' into sanitize
pngwn Jun 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
- Fixes favicon path on Windows by [@abidlabs](https://github.com/abidlabs) in [PR 4369](https://github.com/gradio-app/gradio/pull/4369).
- Prevent path traversal in `/file` routes by [@abidlabs](https://github.com/abidlabs) in [PR 4370](https://github.com/gradio-app/gradio/pull/4370).
- Do not send HF token to other domains via `/proxy` route by [@abidlabs](https://github.com/abidlabs) in [PR 4368](https://github.com/gradio-app/gradio/pull/4368).
- Replace default `markedjs` sanitize function with DOMPurify sanitizer for `gr.Chatbot()` by [@dawoodkhan82](https://github.com/dawoodkhan82) in [PR 4360](https://github.com/gradio-app/gradio/pull/4360)

## Other Changes:

Expand Down
4 changes: 3 additions & 1 deletion js/chatbot/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@
"prismjs": "1.29.0",
"@types/prismjs": "1.26.0",
"katex": "^0.16.7",
"@types/katex": "^0.16.0"
"@types/katex": "^0.16.0",
"dompurify": "^3.0.3",
"@types/dompurify": "^3.0.2"
}
}
5 changes: 3 additions & 2 deletions js/chatbot/src/ChatBot.svelte
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
import "prismjs/components/prism-python";
import "prismjs/components/prism-latex";
import "katex/dist/katex.min.css";
import DOMPurify from "dompurify";
import render_math_in_element from "katex/dist/contrib/auto-render.js";
import { beforeUpdate, afterUpdate, createEventDispatcher } from "svelte";
import type { Styles, SelectData } from "@gradio/utils";
Expand Down Expand Up @@ -39,7 +40,7 @@
gfm: true,
breaks: true,
pedantic: false,
sanitize: true,
sanitize: false,
smartLists: true,
smartypants: false
pngwn marked this conversation as resolved.
Show resolved Hide resolved
});
Expand Down Expand Up @@ -137,7 +138,7 @@
})}
>
{#if typeof message === "string"}
{@html marked.parse(message)}
{@html DOMPurify.sanitize(marked.parse(message))}
{#if feedback && j == 1}
<div class="feedback">
{#each feedback as f}
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
"autoprefixer": "^10.4.4",
"babylonjs": "^5.17.1",
"babylonjs-loaders": "^5.17.1",
"happy-dom": "^2.49.0",
"happy-dom": "^9.20.3",
"msw": "^1.0.0",
"node-html-parser": "^5.3.3",
"npm-run-all": "^4.1.5",
Expand Down
Loading