fix: sanitize model description HTML with DOMPurify in chat placeholders (#23621)

src/lib/components/chat/ChatPlaceholder.svelte

@@ -46,11 +46,11 @@
 						}}
 					>
 						<Tooltip
-							content={marked.parse(
+							content={DOMPurify.sanitize(marked.parse(
 								sanitizeResponseContent(
 									models[selectedModelIdx]?.info?.meta?.description ?? ''
 								).replaceAll('\n', '<br>')
-							)}
+							))}
 							placement="right"
 						>
 							<img
@@ -97,13 +97,11 @@
 						<div
 							class="mt-0.5 text-base font-normal text-gray-500 dark:text-gray-400 line-clamp-3 markdown"
 						>
-							{@html DOMPurify.sanitize(
-								marked.parse(
-									sanitizeResponseContent(
-										models[selectedModelIdx]?.info?.meta?.description
-									).replaceAll('\n', '<br>')
-								)
-							)}
+							{@html DOMPurify.sanitize(marked.parse(
+								sanitizeResponseContent(
+									models[selectedModelIdx]?.info?.meta?.description
+								).replaceAll('\n', '<br>')
+							))}
 						</div>
 						{#if models[selectedModelIdx]?.info?.meta?.user}
 							<div class="mt-0.5 text-sm font-normal text-gray-400 dark:text-gray-500">

src/lib/components/chat/Placeholder.svelte

@@ -165,23 +165,21 @@
 						{#if models[selectedModelIdx]?.info?.meta?.description ?? null}
 							<Tooltip
 								className=" w-fit"
-								content={marked.parse(
+								content={DOMPurify.sanitize(marked.parse(
 									sanitizeResponseContent(
 										models[selectedModelIdx]?.info?.meta?.description ?? ''
 									).replaceAll('\n', '<br>')
-								)}
+								))}
 								placement="top"
 							>
 								<div
 									class="mt-0.5 px-2 text-sm font-normal text-gray-500 dark:text-gray-400 line-clamp-2 max-w-xl markdown"
 								>
-									{@html DOMPurify.sanitize(
-										marked.parse(
-											sanitizeResponseContent(
-												models[selectedModelIdx]?.info?.meta?.description ?? ''
-											).replaceAll('\n', '<br>')
-										)
-									)}
+									{@html DOMPurify.sanitize(marked.parse(
+										sanitizeResponseContent(
+											models[selectedModelIdx]?.info?.meta?.description ?? ''
+										).replaceAll('\n', '<br>')
+									))}
 								</div>
 							</Tooltip>