Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ui): add data protocol support for base64 images in markdown #3290

Conversation

devin-ai-integration[bot]
Copy link

Add support for data protocol URLs in markdown component to allow rendering of base64 encoded images.

Changes made:

  • Added validation for data URLs in the markdown sanitization schema
  • Implemented strict validation to only allow base64-encoded image data URLs
  • Added comprehensive tests to verify proper handling of both valid and invalid data URLs
  • Removed redundant sanitization step to fix data URL handling

Security considerations:

  • Only base64-encoded image data URLs are allowed
  • Non-image data URLs are blocked to prevent XSS attacks
  • URL validation is handled entirely in the attribute validator for better control
  • Maintained existing security measures for other URL types

Testing:

  • Added test cases for both valid base64 image data URLs and invalid data URLs
  • Verified that existing security tests continue to pass
  • Manually tested with various data URL formats

Link to Devin run: https://app.devin.ai/sessions/34929b2acde64a9cbe3d8e211bbdd704

@devin-ai-integration devin-ai-integration bot requested a review from a team as a code owner December 19, 2024 01:02
Copy link
Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR
  • Look at CI failures and help fix them

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

Add "(aside)" to your comment to have me ignore it.

@circle-job-mirror
Copy link

circle-job-mirror bot commented Dec 19, 2024

@trane293
Copy link

TESTING ONLY NO NEED TO REVIEW

@trane293 trane293 closed this Dec 19, 2024
@github-actions github-actions bot locked and limited conversation to collaborators Dec 19, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant