Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

输出部分 HTML <input /> 渲染成输入框 #403

Open
iFwu opened this issue Jun 7, 2023 · 7 comments
Open

输出部分 HTML <input /> 渲染成输入框 #403

iFwu opened this issue Jun 7, 2023 · 7 comments

Comments

@iFwu
Copy link
Contributor

iFwu commented Jun 7, 2023

问题描述
输出内容时似乎没有对包含HTML标签的内容进行转义，导致可能出现一些未预期行为。

如何复现
翻译一段包含裸HTML代码的文字片段（不在代码块或代码格式标记中）。

期望行为
将HTML的内容进行转义，防止意外产生元素、防止可能的XSS风险（不过因为是用户主动发起的，被攻击的风险不大）

截图说明
image
@iFwu iFwu changed the title 输出内容未转义，可能存在XSS风险并会让结果显示异常 输出HTML片段未转义，可能存在XSS风险并会让结果显示异常 Jun 7, 2023
@josStorer
Copy link
Owner

通常期望的行为是要求AI将代码回答包裹在代码块中， 因为有时候一些格式化输出会用到html代码

@iFwu
Copy link
Contributor Author

iFwu commented Jun 7, 2023 •
edited
Loading

通常期望的行为是要求AI将代码回答包裹在代码块中， 因为有时候一些格式化输出会用到html代码

翻译应该尽量避免改变原始格式吧。可以把HTML内容复制为Markdown，避免网页获取选择文字时丢失格式的问题，不过这是另一个功能了。

@josStorer
Copy link
Owner

是，其实这个问题就是框选没有获取到markdown格式，只获取到了纯文本的问题

@iFwu iFwu changed the title 输出HTML片段未转义，可能存在XSS风险并会让结果显示异常 输出部分 HTML <input /> 渲染成输入框 Jun 9, 2023
@iFwu
Copy link
Contributor Author

iFwu commented Jun 9, 2023

是，其实这个问题就是框选没有获取到markdown格式，只获取到了纯文本的问题

看了一下，是react-markdown的remarkjs/remark-gfm插件会把input渲染出来

@josStorer
Copy link
Owner

josStorer commented Jun 9, 2023 •
edited
Loading

是的，原本设想的就是不被代码块包裹的html代码会被渲染出来，当时没有考虑到会出现翻译<input>这样的情况

@thepro-3418
Copy link

if we send an iframe tag it renders in chatgptbox chat page

josStorer added a commit that referenced this issue Jan 26, 2024
@josStorer
safe markdown renderer (#609, #403)
35cb508
@josStorer
Copy link
Owner

fixed in v2.4.9

mrichtarsky added a commit to mrichtarsky/chatGPTBox that referenced this issue Feb 13, 2024
@mrichtarsky
Merge remote-tracking branch 'origin/master' into custom
a436eb9 
* origin/master:
  Update OpenAI ChatGPT Turbo models (API) (josStorer#620)
  release v2.4.9
  when opening IndependentPanel, if the latest session has been used, automatically create a new session (josStorer#601)
  presearch support (josStorer#592)
  formattedError (josStorer#572)
  safe markdown renderer (josStorer#609, josStorer#403)
  improve the stability of response language (josStorer#611)
  improve bilibili summary
  fix mounting failure caused by DuckDuckGo's initial rendering delay. josStorer#610
  gpt-4 web DALL·E support
  chore
  improve josStorer#603
  improve markdown styles (josStorer#585)
  fix gpt-4 web unusual activity (josStorer#615)
  fix: bilibili reload (josStorer#603)
  refactor(selection-tools): remove redundant `getPreferredLanguage` calls (josStorer#593)
  Fix GPT-4 model name and confusion in names (josStorer#584)
  chore(deps): bump actions/upload-artifact from 3 to 4 (josStorer#594)
  chore(deps): bump actions/setup-python from 4 to 5 (josStorer#586)
  update readme news
  release v2.4.8
  update core content adapters
  fix eventsource meta (josStorer#579, josStorer#567)
  josStorer#573's patch
  release v2.4.7
  fix josStorer#569 and reduce menu items
  add gpt-3.5-turbo-instruct
  fix global side_panel
  patch to josStorer#564
  Update Claude.ai web to Claude v2.1, fix josStorer#570 (josStorer#573)
  Add ChatGLM API (josStorer#567)
  Optimize Logic in `selection-tools` Module (josStorer#564)
  release v2.4.6
  support for chromium side panel (josStorer#111)
  allow filling in the API Key of CustomModel mode (josStorer#561, previously designed for local offline model or custom server, now you can also use it for regular openai API calls and freely fill in the model name(josStorer#563))
  update for chatgpt3.5 web (josStorer#562, josStorer#551#issuecomment-1803668105, josStorer#543#issuecomment-1803666487)
  Added box for gh pr's and issues (josStorer#558)
  Replace legacy gpt-3.5-turbo-0613 with the latest gpt-3.5-turbo-1106
  Add OpenAI API GPT-4 Turbo Preview
  Turkish readme Translation (josStorer#553)
  chore
  firefox patch
  release v2.4.5
  update build scripts
  force scroll to bottom after submission
  docs: phrase translation according language README_IN
  improve render performance (josStorer#265)
  docs: add Japanese README
  Create .gitattributes
  improve chatgpt web user guide
  release v2.4.4
  improve chatgpt web mode compatibility
  improve chatgpt web user guide
  Add site adapters for Golem, EETimes
  release v2.4.3
  fix safari background (josStorer#512 (comment))
  improve fetchSSE (josStorer#532)
  re-order parse process
  fix: parse sse
  Make summarization work for text/plain content
  chore(deps-dev): bump @babel/traverse from 7.21.4 to 7.23.2
  fix josStorer#539 bing web
  blob file read for gitlab (josStorer#544)
  fix chatgpt web mode arkose_token (josStorer#469, josStorer#543, josStorer#545)
  remove BingImageCreator
  disable poe temporarily
  upgrade caniuse-lite
  remove commands permission
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@josStorer @iFwu @thepro-3418