Renderer: sanitize raw HTML in every Markdown Streamdown renders

[ramnique]

Security fix. It affects the shipping desktop app.

The bug

Streamdown parses raw HTML in Markdown (rehype-raw) and only hardens URLs. Any Markdown the renderer shows through it could therefore carry live HTML: a Spaces message from another member, a model's reply (prompt injection from an email or web page), a meeting summary.

<iframe srcdoc="<script>…</script>"> runs its script in the renderer's own origin, where window.ipc is in reach. React blocks <img onerror> and javascript: links, but nothing blocks srcdoc.

Reproduced against a local Harbor: Arjun posted a message with that payload, and its script ran when another member's client rendered it.

The fix

• components/streamdown.tsx wraps Streamdown with a fixed plugin list: rehype-raw, then rehype-sanitize with GitHub's allowlist, then KaTeX and harden as before. The list is set last, so no caller can turn the sanitizer off.
• Kept: <br>, <details>, <sub>, tables and the like.
• Dropped: scripts, frames, styles and event handlers.
• Allowed on top of GitHub's list:
  • app://, which Spaces rewrites mentions, files and blobs to before parsing.
  • rowboat:// deep links.
  • blob: and data: images, which Streamdown already allowed.
  • remark-math's classes on <code>.
• All nine call sites import the wrapper.
• streamdown.test.tsx pins the attack payloads and the safe HTML, and fails if anything imports Streamdown from 'streamdown' directly.
• New dependency: rehype-sanitize@6.0.0. The lockfile adds only it and hast-util-sanitize.

Verified

• The renderer's full suite passes (141 files, 1157 tests) and tsc -b is clean.
• In a browser (the Spaces web build against a local Harbor):
  • The srcdoc message renders empty and the page title is unchanged.
  • Math (KaTeX), fenced code, <br>, <sub> and <details> still render.
  • Mentions, space chips, files and images still render; the existing Spaces markdown tests cover these.
• Not run in the packaged desktop app.

🤖 Generated with Claude Code