Is there a reason to use DOMPurify here? I had used it originally for security reasons just in case, but now that we've got artifacts that render unsanitised HTML I don't see why sanitising it in citations is necessary.
Or is there another mechanism that prevents artifacts from running malicious code, in which case, can we re-use that?
DOMPurify with the default configuration breaks things like iframe which can be useful for citations
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/6888
**Author:** [@michaelpoluektov](https://github.com/michaelpoluektov)
**Created:** 11/12/2024
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `revert-6879-fix/render-html-in-citations`
---
### 📝 Commits (2)
- [`d0f13d7`](https://github.com/open-webui/open-webui/commit/d0f13d7c07e57fee87b1dc18eb380020bd007dd4) Revert "fix/feat: add HTML rendering to citations back"
- [`f3210ec`](https://github.com/open-webui/open-webui/commit/f3210ec7db79b40dc7be8897e3476a250695ace9) bring html back
### 📊 Changes
**1 file changed** (+1 additions, -3 deletions)
<details>
<summary>View changed files</summary>
📝 `src/lib/components/chat/Messages/CitationsModal.svelte` (+1 -3)
</details>
### 📄 Description
Reverts open-webui/open-webui#6879
Is there a reason to use `DOMPurify` here? I had used it originally for security reasons just in case, but now that we've got artifacts that render unsanitised HTML I don't see why sanitising it in citations is necessary.
Or is there another mechanism that prevents artifacts from running malicious code, in which case, can we re-use that?
`DOMPurify` with the default configuration breaks things like `iframe` which can be useful for citations
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/6888
Author: @michaelpoluektov
Created: 11/12/2024
Status: ❌ Closed
Base:
dev← Head:revert-6879-fix/render-html-in-citations📝 Commits (2)
d0f13d7Revert "fix/feat: add HTML rendering to citations back"f3210ecbring html back📊 Changes
1 file changed (+1 additions, -3 deletions)
View changed files
📝
src/lib/components/chat/Messages/CitationsModal.svelte(+1 -3)📄 Description
Reverts open-webui/open-webui#6879
Is there a reason to use
DOMPurifyhere? I had used it originally for security reasons just in case, but now that we've got artifacts that render unsanitised HTML I don't see why sanitising it in citations is necessary.Or is there another mechanism that prevents artifacts from running malicious code, in which case, can we re-use that?
DOMPurifywith the default configuration breaks things likeiframewhich can be useful for citations🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.