vrr/agent-zero
2
0
Fork 0
mirror of https://github.com/agent0ai/agent-zero.git synced 2026-05-05 07:10:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

sanitize plugin markdown rendering with shared helper

Browse source 
Add a shared safe markdown pipeline for plugin READMEs and docs.

- vendor DOMPurify and introduce a shared safe-markdown helper
- centralize GitHub README link/image rebasing, including repo routes like `releases`
- sanitize rendered HTML before all plugin-related x-html sinks
- apply the shared renderer to Plugin Hub README, installed plugin README, and markdown modal docs
- preserve target/rel handling for external links
This commit is contained in:
Alessandro 2026-03-28 19:29:26 +01:00
parent f577dad6bf
commit c2e14b6cd1
7 changed files with 1617 additions and 119 deletions
Download patch file Download diff file Expand all files Collapse all files

6
webui/components/plugins/list/pluginListStore.js
View file

@ -1,7 +1,6 @@
import { createStore } from "/js/AlpineStore.js";
import * as api from "/js/api.js";
import { marked } from "/vendor/marked/marked.esm.js";
import { addBlankTargetsToLinks } from "/js/messages.js";
import { renderSafeMarkdown } from "/js/safe-markdown.js";
import { store as pluginSettingsStore } from "/components/plugins/plugin-settings-store.js";
import { store as pluginToggleStore } from "/components/plugins/toggle/plugin-toggle-store.js";
import { store as pluginExecuteStore } from "/components/plugins/list/plugin-execute-store.js";
@ -167,8 +166,7 @@ const model = {
doc: "readme",
});
if (response?.error) throw new Error(response.error);
const html = marked.parse(response.content || "", { breaks: true });
this.readmeContent = addBlankTargetsToLinks(html);
this.readmeContent = renderSafeMarkdown(response.content || "");
} catch (e) {
const error = e instanceof Error ? e : new Error(String(e));
this.readmeError = error.message || "Failed to load README";