Repository navigation
Chat AI bubble uses unsanitized innerHTML #505
Description
chat.js renderTextContent sets innerHTML for Elara messages. Sanitize (e.g. DOMPurify allowlist strong, em, br) or build DOM nodes to reduce XSS risk from AI/proxy responses.
Assign to me: @devanshi14malhotra
Activity
vaanni47 commentedon May 14, 2026
pls assign this to me under gssoc
I’ll be fortifying our security by refactoring the renderTextContent function in chat.js to eliminate the risks associated with setting raw innerHTML. To mitigate potential XSS vulnerabilities from AI or proxy responses, I plan to implement a strict sanitization layer using a library like DOMPurify with a minimal allowlist for safe tags like strong, em, and br.
aishwaryagangaraj-web commentedon May 15, 2026
Hi @diksha78dev, I went through the issue and understand the XSS risk in chat.js due to unsafe innerHTML usage.
I would like to contribute by refactoring the renderTextContent function. My approach would be:
Replace unsafe innerHTML usage with DOMPurify sanitization (allowing only safe tags like strong, em, br)
Or refactor to use DOM-based rendering to fully avoid HTML injection risks
I will start implementing this and raise a PR soon. Please let me know if I can proceed.
diksha78dev commentedon May 15, 2026
@aishwaryagangaraj-web I have asked for the issue assignment to me
You can explore the codebase and raise new issues
aishwaryagangaraj-web commentedon May 15, 2026
Got it, thanks for the clarification. I’ll look for another open issue and contribute there.
fix: replace innerHTML with DOM node builder for AI chat rendering (#505
Merge pull request #616 from diksha78dev/fix/issue-505