gitops/optimclaw
1
0
Fork 0
mirror of https://github.com/outbackdingo/optimclaw.git synced 2026-08-30 16:19:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: sanitize HTML error bodies from MCP servers to prevent web UI white screen (#263) (#656)

Browse Source 
* fix: sanitize HTML error bodies from MCP servers to prevent web UI white screen (#263)

* style: fix cargo fmt formatting in sanitize_error_body tests
This commit is contained in:
Reid
2026-03-08 02:53:02 +00:00
committed by GitHub
parent 3b57d5bec9
commit a20e19ab16
3 changed files with 132 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/channels/web/static/app.js
+7
View File
@@ -563,6 +563,13 @@ function sendApprovalAction(requestId, action) {
function renderMarkdown(text) {
if (typeof marked !== 'undefined') {
// Escape raw HTML error pages instead of rendering them as markup.
// Only triggers when the text *starts with* a doctype or <html> tag
// (after optional whitespace), so normal messages that mention HTML
// tags in prose or code fences are not affected. See #263.
if (/^\s*<!doctype\s/i.test(text) || /^\s*<html[\s>]/i.test(text)) {
return escapeHtml(text);
}
let html = marked.parse(text);
// Sanitize HTML output to prevent XSS from tool output or LLM responses.
html = sanitizeRenderedHtml(html);