🐛 Escape HTML brackets before sanitizing in Streaming bubble

Closes #1841
baptisteArno · Oct 21, 2024 · 91fc9eb · 91fc9eb
1 parent b33e2ee
commit 91fc9eb
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 9 deletions.
diff --git a/packages/embeds/js/package.json b/packages/embeds/js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typebot.io/js",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "description": "Javascript library to display typebots on your website",
   "license": "FSL-1.1-ALv2",
   "type": "module",

diff --git a/packages/embeds/js/src/components/bubbles/StreamingBubble.tsx b/packages/embeds/js/src/components/bubbles/StreamingBubble.tsx
@@ -34,9 +34,15 @@ export const StreamingBubble = (props: Props) => {
           if (index % 2 === 0) {
             return block.split("\n\n").map((line) =>
               domPurify.sanitize(
-                marked.parse(line.replace(/【.+】/g, ""), {
-                  breaks: true,
-                }),
+                marked.parse(
+                  line
+                    .replace(/【.+】/g, "")
+                    .replace(/</g, "&lt;")
+                    .replace(/>/g, "&gt;"),
+                  {
+                    breaks: true,
+                  },
+                ),
                 {
                   ADD_ATTR: ["target"],
                 },
@@ -45,9 +51,14 @@ export const StreamingBubble = (props: Props) => {
           } else {
             return [
               domPurify.sanitize(
-                marked.parse("```" + block + "```", {
-                  breaks: true,
-                }),
+                marked.parse(
+                  "```" +
+                    block +
+                    "```".replace(/</g, "&lt;").replace(/>/g, "&gt;"),
+                  {
+                    breaks: true,
+                  },
+                ),
                 {
                   ADD_ATTR: ["target"],
                 },

diff --git a/packages/embeds/nextjs/package.json b/packages/embeds/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typebot.io/nextjs",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "license": "FSL-1.1-ALv2",
   "description": "Convenient library to display typebots on your Next.js website",
   "type": "module",

diff --git a/packages/embeds/react/package.json b/packages/embeds/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@typebot.io/react",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "description": "Convenient library to display typebots on your React app",
   "license": "FSL-1.1-ALv2",
   "type": "module",