Skip to content

fix: sanitizer svg to avoid xss #16606

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 24, 2025
Merged

fix: sanitizer svg to avoid xss #16606

merged 1 commit into from
Mar 24, 2025

Conversation

iamjoel
Copy link
Collaborator

@iamjoel iamjoel commented Mar 24, 2025

Checklist

Important

Please review the checklist below before submitting your pull request.

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran dev/reformat(backend) and cd web && npx lint-staged(frontend) to appease the lint gods

@dosubot dosubot bot added size:M This PR changes 30-99 lines, ignoring generated files. 🐞 bug Something isn't working labels Mar 24, 2025
@iamjoel iamjoel changed the title fix: sanitizer svg xss fix: sanitizer svg to avoid xss Mar 24, 2025
@dosubot dosubot bot added the lgtm This PR has been approved by a maintainer label Mar 24, 2025
@iamjoel iamjoel merged commit 16b6ffd into main Mar 24, 2025
13 checks passed
@iamjoel iamjoel deleted the chore/purify-svg branch March 24, 2025 06:36
parambharat pushed a commit to parambharat/dify that referenced this pull request Mar 31, 2025
Scorpion1221 added a commit to yybht155/dify that referenced this pull request Apr 8, 2025
* commit '1be0d26c1feb4bcbbdd2b4ae4eeb25874aadaddb': (134 commits)
  fix metadata filter not affect in keyword-search and fulltext-search (langgenius#16644)
  chore: bump the package version to 1.1.3 (langgenius#16612)
  fix: fix inner API workspace Account.query error. (langgenius#16630)
  fix: update retrieval configuration to correctly handle reranking mod… (langgenius#16641)
  chore: update release trigger to include all tags in build-push workflow (langgenius#16631)
  Fix: style of sidebar with in mobile (langgenius#16629)
  Fix: style issue of app detail panel in jp (langgenius#16620)
  Fix: show feedback status in conversation (langgenius#16615)
  fix: cancel marketplace debounced search when clear search keywords (langgenius#16614)
  feat: add openGauss PQ acceleration feature (langgenius#16432)
  fix: sanitizer svg to avoid xss (langgenius#16606)
  feat: add datasets detail context and provider for improved data vali… (langgenius#16451)
  feat: datasets openapi list segements support paged resp (langgenius#16603)
  Fix: web app sidebar cannot close when long title conversation existed (langgenius#16593)
  fix: transition in simple select causes page crash (langgenius#16587)
  fix: workflow if-else node variable tag style (langgenius#16583)
  chore: enable eslint cache (langgenius#16570)
  fix: update app mode display text for advanced-chat type (langgenius#16578)
  fix: fix variable-aggregator cannot pass node check in group mode (langgenius#16439)
  feat: Make the logic of APP filtering and creation the same (langgenius#16079)
  ...

# Conflicts:
#	.github/workflows/build-push.yml
#	api/poetry.lock
#	web/.husky/pre-commit
#	web/pnpm-lock.yaml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐞 bug Something isn't working lgtm This PR has been approved by a maintainer size:M This PR changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants