opensource/kilocode
3
0
Fork 0
mirror of https://github.com/Kilo-Org/kilocode.git synced 2026-09-24 16:02:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7440 from Kilo-Org/mark/fix-codespan-html-escape

Browse Source 
fix(ui): escape HTML in codespan renderer to prevent tag injection
This commit is contained in:
Mark IJbema
2026-03-23 13:25:44 +01:00
committed by GitHub
parent feced2b991 18824710c7
commit f597677376
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ui/src/context/marked.tsx
+8 -2
View File
@@ -632,12 +632,18 @@ export const { use: useMarked, provider: MarkedProvider } = createSimpleContext(
// kilocode_change start
codespan({ text }) {
const file = parseFilePath(text)
const escaped = text
.replace(/&/g, "&")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;")
if (file) {
const lineAttr = file.line ? ` data-file-line="${file.line}"` : ""
const colAttr = file.column ? ` data-file-col="${file.column}"` : ""
return `<code class="file-link" data-file-path="${file.path}"${lineAttr}${colAttr}>${text}</code>`
return `<code class="file-link" data-file-path="${file.path}"${lineAttr}${colAttr}>${escaped}</code>`
}
return `<code>${text}</code>`
return `<code>${escaped}</code>`
},
code({ text, lang }) {
const escaped = text