fix: sanitize message in notification component (#2664)

csarnataro · web-flow · commit d298b3ffc940 · 2025-03-24T12:42:48.000+01:00
fix: sanitize messages in notification component
diff --git a/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx b/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx
@@ -2,6 +2,7 @@ import React from '@theia/core/shared/react';
 import { NotificationComponent as TheiaNotificationComponent } from '@theia/messages/lib/browser/notification-component';
 import { nls } from '@theia/core/lib/common';
 import { codicon } from '@theia/core/lib/browser';
+import { sanitize } from 'dompurify';
 
 export class NotificationComponent extends TheiaNotificationComponent {
   override render(): React.ReactNode {
@@ -20,7 +21,7 @@ export class NotificationComponent extends TheiaNotificationComponent {
             />
             <div className="theia-notification-message">
               <span
-                dangerouslySetInnerHTML={{ __html: message }}
+                dangerouslySetInnerHTML={{ __html: sanitize(message) }}
                 onClick={this.onMessageClick}
               />
             </div>
