From 9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214 Mon Sep 17 00:00:00 2001
From: Timothy Carambat <rambat1010@gmail.com>
Date: Thu, 12 Mar 2026 20:51:05 -0700
Subject: [PATCH] sanitize promptReply Output

---
 .../ChatContainer/ChatHistory/PromptReply/index.jsx          | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/PromptReply/index.jsx b/frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/PromptReply/index.jsx
index 2b0f6c4d..8f09f18a 100644
--- a/frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/PromptReply/index.jsx
+++ b/frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/PromptReply/index.jsx
@@ -2,6 +2,7 @@
 import { memo, useRef, useEffect } from "react";
 import { Warning } from "@phosphor-icons/react";
 import renderMarkdown from "@/utils/chat/markdown";
+import DOMPurify from "@/utils/chat/purify";
 import Citations from "../Citation";
 import {
   THOUGHT_REGEX_CLOSE,
@@ -96,7 +97,9 @@ function RenderAssistantChatContent({ message, messageId }) {
       )}
       <span
         className="break-words"
-        dangerouslySetInnerHTML={{ __html: renderMarkdown(contentRef.current) }}
+        dangerouslySetInnerHTML={{
+          __html: DOMPurify.sanitize(renderMarkdown(contentRef.current)),
+        }}
       />
     </div>
   );