fix(web): sanitize v-html (DOMPurify) + security/memory hardening#687
Merged
Conversation
Add dompurify + shared src/utils/sanitize.ts (renderMarkdown / sanitizeHtml / textToBr) and route chat messages, QA answers, and AI analysis reports through it. Prevents stored/reflected XSS from untrusted markdown rendered via v-html. Co-authored-by: Cursor <cursoragent@cursor.com>
Remove dead secondaryLoading ref, prefix unused param, and scope-disable no-explicit-any for dynamic Element Plus form values.
- WebShell: fix resize listener leak (removeEventListener used a new anon fn) - Add rel=noopener/noreferrer to external links and window.open calls (anti tabnabbing) - Add shared getSafeRedirect() and apply to SSO/post-login redirects (anti open-redirect)
- PlaygroundAgent: abort in-flight stream on onBeforeUnmount (fix leak) - Memoize parseThinkingContent and formatMessage (called many times per render/streaming) - Cap caches to avoid unbounded growth from streaming tokens
- useOptimizationEvents: cancel SSE reconnect timer on close; cap logs to 5000 - Clear debounce timers on unmount (Nodes, QABase, ModelOptimization) - FloatingChatBot: remove drag listeners if unmounted mid-drag
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
xiaofei-zheng
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security and stability hardening for the SaFE web app (
Web/apps/safe), centered on XSS sanitization plus low-risk memory/perf fixes surfaced by an audit.Changes
Security
dompurifyand a sharedsrc/utils/sanitize.ts(renderMarkdown/sanitizeHtml/textToBr); route every untrustedv-htmlsink (chat messages, QA answers, AI analysis reports, confirm dialogs) through it. Enablevue/no-v-htmllint guard to prevent regressions.getSafeRedirect()and apply it to SSO / post-login redirects (only same-origin relative paths allowed).rel=noopener noreferrer/noopenerto external links andwindow.opencalls.Memory / performance
removeEventListenerwas passed a new anonymous fn).onBeforeUnmount; memoizeparseThinkingContent(called many times per render).formatMessageoutput (capped) to avoid re-parsing markdown on every render / streaming tick.Chore
Verification
vue-tsc --noEmit -p tsconfig.app.jsonpasses (exit 0).vue/no-v-htmlwarnings are intentional (sanitized sinks).srcand tracked env files: clean.