fix(webui): unwrap untrusted-content envelope client-side, escape on render - #118
Merged
Merged
Conversation
…render Standardize on client-side sanitization for odek serve: the server sends all WebSocket content raw and unsanitized (it already did); the WebUI now handles the model-facing <untrusted_content_*> envelope properly instead of displaying the escaped tag text. - ui/js/untrusted.js: nonce-backreferenced envelope parser (parseUntrusted, unwrapUntrusted, hasUntrustedWrapper, stripAttachmentBodies) mirroring the grammar of cmd/odek/untrusted.go; forged/mismatched nonces pass through as plain text - ui/js/render.js: tool results unwrap the envelope and render via textContent only (no innerHTML/data-full for bodies); envelope source shows as a badge. Fixes live + history paths via shared helper. Also drops the redundant escapeHtml() under markdownToHtml in addMessage and renderAssistantMessage (markdownToHtml escapes all input by default), so history and live stream render identically - ui/js/utils.js: stripAttachmentBodies re-exported from untrusted.js; attachment envelopes collapse to chip placeholders again (stale '--- name (size) ---' format replaced by source="attachment:<name>") - ui/style.css: .tb-source badge styling - ui/js/untrusted.test.js: node:test regression suite incl. double-escape and escaped-render-chain contract pins - docs/WEBUI.md: content sanitization contract for third-party clients, corrected WS protocol table (tool_call/tool_result data fields, missing event types), updated frontend description
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
odek | 4a18724 | Commit Preview URL Branch Preview URL |
Jul 27 2026, 10:39 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Standardizes on client-side sanitization for
odek serve: the server sends all WebSocket message content raw and unsanitized (it already did — no server changes), and the WebUI now handles the model-facing<untrusted_content_<nonce> source="...">envelope correctly instead of rendering the escaped tag text plus the escaped tool body.What was wrong
<untrusted_content_a1b2c3 source="shell">) along with the escaped body — the envelope is model-facing trust metadata, not user content.stripAttachmentBodiestargeted a stale--- name (size) ---format that no longer matches the server'ssource="attachment:<name>"envelope.addMessage/renderAssistantMessagecalledmarkdownToHtml(escapeHtml(content))even thoughmarkdownToHtmlescapes all input by default, so history bubbles rendered<literally while the live stream rendered<.Changes
ui/js/untrusted.js(new): envelope parser with nonce-backreferenced regex mirroringcmd/odek/untrusted.go; forged/mismatched nonces are treated as plain text. ExportsparseUntrusted,unwrapUntrusted,hasUntrustedWrapper,stripAttachmentBodies.ui/js/render.js: tool results unwrap the envelope and render viatextContentonly (no moreinnerHTML/data-fullfor bodies); the envelope source shows as a🔒 <source>badge. Shared by live and history paths. Double-escape removed inaddMessage/renderAssistantMessage.ui/js/utils.js:stripAttachmentBodiesre-exported fromuntrusted.js(pure, node-testable).ui/style.css:.tb-sourcebadge styling.ui/js/untrusted.test.js(new): 11 node:test cases — parsing, nonce-mismatch forgery, attachment chips, escaped render chain, double-escape regression pin.docs/WEBUI.md: new Content sanitization contract section for third-party/TUI clients (server sends raw; clients MUST escape; envelope SHOULD be unwrapped for display), corrected protocol table (tool_call/tool_resultusedata, full untruncated output; addedthinking,subagent_log,skill_event,memory_event,agent_signal,approval_ack), updated stale frontend description.Testing
node --test cmd/odek/ui/js/*.test.js— 35/35 passgo build ./...+go test ./cmd/odek/ -count=1— passodek servesession with a model)