From da1c7cd8cf65324d1058c09dad49b8d8bad44b2c Mon Sep 17 00:00:00 2001
From: CrescentLeaf <crescentleaf@noreply.codeberg.org>
Date: Wed, 24 Sep 2025 10:57:21 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20Markdown=20=E6=B2=92=E6=9C=89=E8=A2=AB?=
 =?UTF-8?q?=E6=B8=B2=E6=9F=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 client/deno.jsonc               | 3 ++-
 client/ui/chat/ChatFragment.tsx | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/client/deno.jsonc b/client/deno.jsonc
index befdfad..0901a68 100644
--- a/client/deno.jsonc
+++ b/client/deno.jsonc
@@ -26,6 +26,7 @@
     "split.js": "npm:split.js@1.3.2",
     "crypto-js": "npm:crypto-js@4.2.0",
     "socket.io-client": "npm:socket.io-client@4.8.1",
-    "marked": "npm:marked@16.3.0"
+    "marked": "npm:marked@16.3.0",
+    "dompurify": "npm:dompurify@3.2.7"
   }
 }
diff --git a/client/ui/chat/ChatFragment.tsx b/client/ui/chat/ChatFragment.tsx
index 41746ad..41186fc 100644
--- a/client/ui/chat/ChatFragment.tsx
+++ b/client/ui/chat/ChatFragment.tsx
@@ -11,6 +11,7 @@ import data from "../../Data.ts"
 import { checkApiSuccessOrSncakbar } from "../snackbar.ts"
 import useAsyncEffect from "../useAsyncEffect.ts"
 import * as marked from 'marked'
+import DOMPurify from 'dompurify'
 
 interface Args extends React.HTMLAttributes<HTMLElement> {
     target: string
@@ -186,7 +187,7 @@ export default function ChatFragment({ target, showReturnButton, onReturnButtonC
                                 <Element_Message
                                     key={msg.id}
                                     userId={msg.user_id}>
-                                    {markedInstance.parse(msg.text) as string}
+                                    <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(markedInstance.parse(msg.text) as string) }}></div>
                                 </Element_Message>
                             )
                         }