search

juzser / vue-bot-ui

For the one who is finding a customizable chatbot UI.
MIT License
155 stars 32 forks source link

Fix: SingleText can display the msg as html #26

Closed ntt0102 closed 2 years ago

ntt0102 commented 3 years ago

.qkb-msg-bubble-componenttext {{ mainData.text }} -> .qkb-msg-bubble-componenttext(v-html="mainData.text")

juzser commented 3 years ago

@ntt0102 Hi there, thanks for your PR. But be careful with this one, because it may cause the XSS attack if you store the message. That's the reason I do not support rich text format.

There are 2 solutions for this, you should re-verify:

  1. We need a service to trim script tags for the messages before send to requests.
  2. Only allow formatting message from BOT side, not user side.

I'm happy to merge this PR if you have solution for this :) Thank you.