From a5a293558592cf53bf6bdde44e793dd6ab243837 Mon Sep 17 00:00:00 2001
From: Kit La Touche <kit@transneptune.net>
Date: Sat, 2 Nov 2024 15:35:17 -0400
Subject: Actually sanitize rendered Markdown

---
 ui/lib/components/Message.svelte | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'ui/lib/components/Message.svelte')

diff --git a/ui/lib/components/Message.svelte b/ui/lib/components/Message.svelte
index 75e4cc9..c9dd301 100644
--- a/ui/lib/components/Message.svelte
+++ b/ui/lib/components/Message.svelte
@@ -1,9 +1,12 @@
 <script>
-    import SvelteMarkdown from 'svelte-markdown';
+    import { marked } from 'marked';
+    import DOMPurify from 'dompurify';
 
     export let at;
     export let body;
 
+    let renderedBody = DOMPurify.sanitize(marked.parse(body));
+
     let scroll = (message) => {
         message.scrollIntoView();
     }
@@ -12,7 +15,7 @@
 <div class="message relative">
     <span class="timestamp chip variant-soft absolute top-0 right-0">{at}</span>
     <section use:scroll class="py-1">
-        <SvelteMarkdown source={body} />
+        {@html renderedBody}
     </section>
 </div>
 
-- 
cgit v1.2.3