From 5eab125f13560a7d972c4311152fc68954f4d41b Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Sun, 12 Apr 2026 18:12:49 +0200
Subject: [PATCH] fix: sanitize model description HTML with DOMPurify in chat
 placeholders (#23621)

---
 src/lib/components/chat/ChatPlaceholder.svelte | 16 +++++++---------
 src/lib/components/chat/Placeholder.svelte     | 16 +++++++---------
 2 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/src/lib/components/chat/ChatPlaceholder.svelte b/src/lib/components/chat/ChatPlaceholder.svelte
index 0f44f8693..ce54ecd55 100644
--- a/src/lib/components/chat/ChatPlaceholder.svelte
+++ b/src/lib/components/chat/ChatPlaceholder.svelte
@@ -46,11 +46,11 @@
 						}}
 					>
 						<Tooltip
-							content={marked.parse(
+							content={DOMPurify.sanitize(marked.parse(
 								sanitizeResponseContent(
 									models[selectedModelIdx]?.info?.meta?.description ?? ''
 								).replaceAll('\n', '<br>')
-							)}
+							))}
 							placement="right"
 						>
 							<img
@@ -97,13 +97,11 @@
 						<div
 							class="mt-0.5 text-base font-normal text-gray-500 dark:text-gray-400 line-clamp-3 markdown"
 						>
-							{@html DOMPurify.sanitize(
-								marked.parse(
-									sanitizeResponseContent(
-										models[selectedModelIdx]?.info?.meta?.description
-									).replaceAll('\n', '<br>')
-								)
-							)}
+							{@html DOMPurify.sanitize(marked.parse(
+								sanitizeResponseContent(
+									models[selectedModelIdx]?.info?.meta?.description
+								).replaceAll('\n', '<br>')
+							))}
 						</div>
 						{#if models[selectedModelIdx]?.info?.meta?.user}
 							<div class="mt-0.5 text-sm font-normal text-gray-400 dark:text-gray-500">
diff --git a/src/lib/components/chat/Placeholder.svelte b/src/lib/components/chat/Placeholder.svelte
index 1a235b50d..676ed9846 100644
--- a/src/lib/components/chat/Placeholder.svelte
+++ b/src/lib/components/chat/Placeholder.svelte
@@ -165,23 +165,21 @@
 						{#if models[selectedModelIdx]?.info?.meta?.description ?? null}
 							<Tooltip
 								className=" w-fit"
-								content={marked.parse(
+								content={DOMPurify.sanitize(marked.parse(
 									sanitizeResponseContent(
 										models[selectedModelIdx]?.info?.meta?.description ?? ''
 									).replaceAll('\n', '<br>')
-								)}
+								))}
 								placement="top"
 							>
 								<div
 									class="mt-0.5 px-2 text-sm font-normal text-gray-500 dark:text-gray-400 line-clamp-2 max-w-xl markdown"
 								>
-									{@html DOMPurify.sanitize(
-										marked.parse(
-											sanitizeResponseContent(
-												models[selectedModelIdx]?.info?.meta?.description ?? ''
-											).replaceAll('\n', '<br>')
-										)
-									)}
+									{@html DOMPurify.sanitize(marked.parse(
+										sanitizeResponseContent(
+											models[selectedModelIdx]?.info?.meta?.description ?? ''
+										).replaceAll('\n', '<br>')
+									))}
 								</div>
 							</Tooltip>