mirror of
https://github.com/lfnovo/open-notebook.git
synced 2026-08-31 02:24:18 +00:00
58ce1dd5d0
* fix: sanitize raw HTML in the note/transformation markdown preview MarkdownEditor's live preview renders through @uiw/react-markdown- preview, which parses literal HTML in the markdown source into real elements (its `raw` default) - including a live <iframe>. Notes can hold AI-generated content that echoes an indirect prompt injection from an ingested document, so this was reachable without the user writing any HTML themselves. Add rehype-sanitize (default schema) ahead of rehype-katex in the preview pipeline. Ordering matters: sanitizing after katex strips katex's own generated markup (not in the default allowlist), while sanitizing before it only touches the raw-HTML-derived tree and leaves not-yet-rendered math nodes alone. Verified against the real preview component that this strips <iframe>/<script>/<style>/ javascript: URLs while fully preserving math, syntax highlighting, and GFM tables/task-lists. * fix: make validate_url() async so DNS resolution doesn't block the event loop socket.getaddrinfo() in validate_url()'s hostname-resolution branch ran synchronously on every call - and this is called on the hot path of model provisioning, potentially once per chat message/transformation. A slow or hanging DNS lookup stalled every other concurrent request, not just the one that triggered it. Run the resolution via asyncio.to_thread() instead, and thread `await` through every call site: credentials_service.py's discover functions, routers/credentials.py's create/update, routers/sources.py's source-URL ingestion, and connection_tester.py's three provider test functions.
91 lines
2.7 KiB
JSON
91 lines
2.7 KiB
JSON
{
|
|
"name": "frontend",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "node start-server.js",
|
|
"lint": "eslint src/",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:ui": "vitest --ui",
|
|
"test:coverage": "vitest run --coverage"
|
|
},
|
|
"dependencies": {
|
|
"@hookform/resolvers": "^5.1.1",
|
|
"@monaco-editor/react": "^4.7.0",
|
|
"@radix-ui/react-accordion": "^1.2.12",
|
|
"@radix-ui/react-alert-dialog": "^1.1.14",
|
|
"@radix-ui/react-checkbox": "^1.3.2",
|
|
"@radix-ui/react-collapsible": "^1.1.11",
|
|
"@radix-ui/react-dialog": "^1.1.15",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.15",
|
|
"@radix-ui/react-label": "^2.1.7",
|
|
"@radix-ui/react-popover": "^1.1.15",
|
|
"@radix-ui/react-progress": "^1.1.7",
|
|
"@radix-ui/react-radio-group": "^1.3.8",
|
|
"@radix-ui/react-scroll-area": "^1.2.9",
|
|
"@radix-ui/react-select": "^2.2.5",
|
|
"@radix-ui/react-separator": "^1.1.7",
|
|
"@radix-ui/react-slot": "^1.2.3",
|
|
"@radix-ui/react-tabs": "^1.1.12",
|
|
"@radix-ui/react-tooltip": "^1.2.7",
|
|
"@tailwindcss/typography": "^0.5.16",
|
|
"@tanstack/react-query": "^5.83.0",
|
|
"@types/react-syntax-highlighter": "^15.5.13",
|
|
"@uiw/react-md-editor": "^4.0.8",
|
|
"axios": "^1.16.0",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"cmdk": "^1.1.1",
|
|
"date-fns": "^4.1.0",
|
|
"i18next": "^25.7.3",
|
|
"i18next-browser-languagedetector": "^8.2.0",
|
|
"katex": "^0.16.47",
|
|
"lucide-react": "^0.525.0",
|
|
"next": "^16.2.6",
|
|
"next-themes": "^0.4.6",
|
|
"react": "^19.2.3",
|
|
"react-dom": "^19.2.3",
|
|
"react-hook-form": "^7.60.0",
|
|
"react-i18next": "^16.5.0",
|
|
"react-markdown": "^10.1.0",
|
|
"react-syntax-highlighter": "^16.1.1",
|
|
"rehype-katex": "^7.0.1",
|
|
"rehype-sanitize": "^6.0.0",
|
|
"remark-gfm": "^4.0.1",
|
|
"remark-math": "^6.0.0",
|
|
"sonner": "^2.0.6",
|
|
"tailwind-merge": "^3.3.1",
|
|
"use-debounce": "^10.0.6",
|
|
"zod": "^4.0.5",
|
|
"zustand": "^5.0.6"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/eslintrc": "^3",
|
|
"@tailwindcss/postcss": "^4",
|
|
"@testing-library/jest-dom": "^6.6.3",
|
|
"@testing-library/react": "^16.2.0",
|
|
"@types/node": "^20",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@vitejs/plugin-react": "^4.3.4",
|
|
"@vitest/coverage-v8": "^4.1.8",
|
|
"@vitest/ui": "^4.1.8",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "15.4.2",
|
|
"jsdom": "^26.0.0",
|
|
"tailwindcss": "^4",
|
|
"tw-animate-css": "^1.3.5",
|
|
"typescript": "^5",
|
|
"vitest": "^4.1.8"
|
|
},
|
|
"overrides": {
|
|
"ws": "8.21.0",
|
|
"brace-expansion": "1.1.15",
|
|
"ajv": "6.15.0",
|
|
"@eslint/plugin-kit": "0.7.2",
|
|
"postcss": "8.5.10"
|
|
}
|
|
}
|