refac

src/lib/components/chat/ChatPlaceholder.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { WEBUI_API_BASE_URL, WEBUI_BASE_URL } from '$lib/constants';
 	import { marked } from 'marked';
+	import DOMPurify from 'dompurify';
 
 	import { config, user, models as _models, temporaryChatEnabled } from '$lib/stores';
 	import { onMount, getContext } from 'svelte';
@@ -96,11 +97,11 @@
 						<div
 							class="mt-0.5 text-base font-normal text-gray-500 dark:text-gray-400 line-clamp-3 markdown"
 						>
-							{@html marked.parse(
+							{@html DOMPurify.sanitize(marked.parse(
 								sanitizeResponseContent(
 									models[selectedModelIdx]?.info?.meta?.description
 								).replaceAll('\n', '<br>')
-							)}
+							))}
 						</div>
 						{#if models[selectedModelIdx]?.info?.meta?.user}
 							<div class="mt-0.5 text-sm font-normal text-gray-400 dark:text-gray-500">

src/lib/components/chat/Placeholder.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { toast } from 'svelte-sonner';
 	import { marked } from 'marked';
+	import DOMPurify from 'dompurify';
 
 	import { onMount, getContext, tick, createEventDispatcher } from 'svelte';
 	import { blur, fade } from 'svelte/transition';
@@ -174,11 +175,11 @@
 								<div
 									class="mt-0.5 px-2 text-sm font-normal text-gray-500 dark:text-gray-400 line-clamp-2 max-w-xl markdown"
 								>
-									{@html marked.parse(
+									{@html DOMPurify.sanitize(marked.parse(
 										sanitizeResponseContent(
 											models[selectedModelIdx]?.info?.meta?.description ?? ''
 										).replaceAll('\n', '<br>')
-									)}
+									))}
 								</div>
 							</Tooltip>
 

src/lib/components/layout/Overlay/AccountPending.svelte

@@ -41,11 +41,9 @@
 					style="white-space: pre-wrap;"
 				>
 					{#if ($config?.ui?.pending_user_overlay_content ?? '').trim() !== ''}
-						{@html marked.parse(
-							DOMPurify.sanitize(
-								($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>')
-							)
-						)}
+						{@html DOMPurify.sanitize(marked.parse(
+							($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>')
+						))}
 					{:else}
 						{$i18n.t('Your account status is currently pending activation.')}{'\n'}{$i18n.t(
 							'To access the WebUI, please reach out to the administrator. Admins can manage user statuses from the Admin Panel.'