ba78141ac5
Previously a DOCX citation only showed the extracted snippet + a Download button (Risk #3: never render a user-supplied .docx inline). Add a faithful inline render that keeps that guarantee: - New PreviewDocxView renders the .docx with docx-preview into an off-screen element, then injects DOMPurify-sanitized HTML into the live DOM (keeping <style> for docx-preview's scoped layout CSS). Script tags, event handlers and javascript: URLs are stripped, so a malicious .docx can't execute in the app origin. - preview-store now fetches the raw bytes for docx and exposes them via previewBlob, but deliberately keeps previewBlobUrl = null — no object URL is created, so the 'open raw original inline' path stays disabled (Risk #3) and Download remains the only raw-file path. - preview-panel routes docx -> PreviewDocxView when a blob is present, falling back to the text-view snippet otherwise. isInlineBlobAllowed still returns false for docx, so html/unknown behaviour is unchanged. - Deps: docx-preview + dompurify added to package.json. - Tests updated: docx now asserts bytes-fetched-without-object-URL. Not build/UI-verified in this environment (deps not installed here); needs bun install + browser check. |
||
|---|---|---|
| .. | ||
| backend | ||
| frontend | ||
| src-tauri | ||
| __init__.py | ||
| install_llama_prebuilt.py | ||
| install_python_stack.py | ||
| LICENSE.AGPL-3.0 | ||
| package-lock.json | ||
| package.json | ||
| setup.bat | ||
| setup.ps1 | ||
| setup.sh | ||
| Unsloth_Studio_Colab.ipynb | ||