fix: fixed bug for prompt code format, prevent xss attacks

2025-11-11 03:33:48 +08:00 · 2023-12-07 14:02:13 +08:00
parent e841a61bf0
commit a6025e6fab
6 changed files with 14 additions and 13 deletions
--- a/api/handler/chatimpl/openai_handler.go
+++ b/api/handler/chatimpl/openai_handler.go
@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"gorm.io/gorm"
+	"html/template"
 	"io"
 	"strings"
 	"time"
@@ -199,7 +200,7 @@ func (h *ChatHandler) sendOpenAiMessage(
 					RoleId:     role.Id,
 					Type:       types.PromptMsg,
 					Icon:       userVo.Avatar,
-					Content:    prompt,
+					Content:    template.HTMLEscapeString(prompt),
 					Tokens:     promptToken,
 					UseContext: useContext,
 				}