Changeset 0.9.4 (#54)

src/js/ui.js

@@ -1823,7 +1823,9 @@ function formatMessage(content) {
     text = text.replace(/<(?:thinking|think)>([\s\S]*?)<\/(?:thinking|think)>/gi, (_, inner) => {
         const id = 'think-' + Math.random().toString(36).slice(2, 9);
         thinkingBlocks.push({ id, content: inner.trim() });
-        return `THINK_PLACEHOLDER_${id}`;
+        // Newlines ensure the placeholder is its own markdown block so adjacent
+        // code fences (e.g. "</think>```html") start on a fresh line for marked.
+        return `\n\nTHINK_PLACEHOLDER_${id}\n\n`;
     });
 
     let html;
@@ -1845,10 +1847,35 @@ function formatMessage(content) {
 }
 
 function _formatMarked(text) {
+    // Close any unclosed code fences to prevent raw HTML injection during
+    // streaming (closing ``` hasn't arrived yet) or when the model forgets
+    // to close a fence. An odd number of ``` markers means one is unclosed.
+    const fences = text.match(/^```/gm);
+    if (fences && fences.length % 2 !== 0) {
+        text += '\n```';
+    }
+
     const rendered = marked.parse(text, { breaks: true, gfm: true });
     let html = DOMPurify.sanitize(rendered, {
-        ADD_TAGS: ['details', 'summary', 'iframe'],
-        ADD_ATTR: ['id', 'class', 'onclick', 'sandbox', 'srcdoc']
+        // Strict allowlist: only elements that marked.js actually produces.
+        // This prevents ANY raw HTML (canvas, style, script, iframe, form, etc.)
+        // from rendering live even if a code fence fails to parse.
+        ALLOWED_TAGS: [
+            // Block elements
+            'p', 'br', 'hr', 'pre', 'code', 'blockquote',
+            'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+            // Lists
+            'ul', 'ol', 'li',
+            // Tables
+            'table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td',
+            // Inline formatting
+            'strong', 'em', 'b', 'i', 'u', 's', 'del', 'sub', 'sup',
+            'a', 'img', 'span', 'div',
+            // Think blocks (injected post-sanitize, but placeholders may be in <p>)
+            'details', 'summary',
+        ],
+        ALLOWED_ATTR: ['id', 'class', 'href', 'target', 'rel', 'src', 'alt', 'title',
+                        'colspan', 'rowspan', 'align'],
     });
 
     // Process code blocks: add copy button, collapse toggle, HTML preview