From a8441ba17d90aab9867d1fdd5889e69e762327f5 Mon Sep 17 00:00:00 2001
From: Rin <shinohara-rin@users.noreply.github.com>
Date: Wed, 1 Apr 2026 23:18:02 +0800
Subject: [PATCH] fix(stage-pages): XSS vulnerability in provider definition
 (#1492)

Authored-by-agent: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: shinohara-rin <25588514+shinohara-rin@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Neko <neko@ayaka.moe>
---
 .../v2/settings/providers/edit/[providerId]/index.vue    | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/stage-pages/src/pages/v2/settings/providers/edit/[providerId]/index.vue b/packages/stage-pages/src/pages/v2/settings/providers/edit/[providerId]/index.vue
index fe0cf4e15..85764526e 100644
--- a/packages/stage-pages/src/pages/v2/settings/providers/edit/[providerId]/index.vue
+++ b/packages/stage-pages/src/pages/v2/settings/providers/edit/[providerId]/index.vue
@@ -3,6 +3,9 @@ import type { ProviderValidationStep } from '@proj-airi/stage-ui/libs'
 import type { ZodType } from 'zod'
 import type { $ZodType } from 'zod/v4/core'
 
+// TODO: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API
+import DOMPurify from 'dompurify'
+
 import { merge } from '@moeru/std'
 import {
   Alert,
@@ -69,6 +72,10 @@ const isOllamaProvider = computed(() => providerDefinition.value?.id === 'ollama
 const shouldShowTroubleshootingOllamaConnectivity = computed(() => {
   return isOllamaProvider.value && validationSteps.value.some(step => step.id === 'openai-compatible:check-connectivity' && step.status === 'invalid')
 })
+const safeOllamaConnectivityTroubleshootingHtml = computed(() => {
+  const content = providerDefinition.value?.business?.({ t }).troubleshooting?.validators?.openaiCompatibleCheckConnectivity?.content
+  return DOMPurify.sanitize(content || '')
+})
 
 function getSchemaShape(schema: $ZodType): Record<string, ZodType> {
   const anySchema = schema as unknown as { shape?: Record<string, ZodType> | (() => Record<string, ZodType>), _def?: { shape?: Record<string, ZodType> | (() => Record<string, ZodType>) } }
@@ -481,7 +488,7 @@ function handleDeleteProvider() {
               v-if="shouldShowTroubleshootingOllamaConnectivity && providerDefinition.business?.({ t }).troubleshooting?.validators?.openaiCompatibleCheckConnectivity"
               :label="providerDefinition.business?.({ t }).troubleshooting?.validators?.openaiCompatibleCheckConnectivity?.label"
             >
-              <div v-html="providerDefinition.business?.({ t }).troubleshooting?.validators?.openaiCompatibleCheckConnectivity?.content" />
+              <div v-html="safeOllamaConnectivityTroubleshootingHtml" />
             </Callout>
 
             <div :class="['flex', 'items-center', 'justify-between']">