ba78141ac5
Previously a DOCX citation only showed the extracted snippet + a Download button (Risk #3: never render a user-supplied .docx inline). Add a faithful inline render that keeps that guarantee: - New PreviewDocxView renders the .docx with docx-preview into an off-screen element, then injects DOMPurify-sanitized HTML into the live DOM (keeping <style> for docx-preview's scoped layout CSS). Script tags, event handlers and javascript: URLs are stripped, so a malicious .docx can't execute in the app origin. - preview-store now fetches the raw bytes for docx and exposes them via previewBlob, but deliberately keeps previewBlobUrl = null — no object URL is created, so the 'open raw original inline' path stays disabled (Risk #3) and Download remains the only raw-file path. - preview-panel routes docx -> PreviewDocxView when a blob is present, falling back to the text-view snippet otherwise. isInlineBlobAllowed still returns false for docx, so html/unknown behaviour is unchanged. - Deps: docx-preview + dompurify added to package.json. - Tests updated: docx now asserts bytes-fetched-without-object-URL. Not build/UI-verified in this environment (deps not installed here); needs bun install + browser check. |
||
|---|---|---|
| .. | ||
| public | ||
| src | ||
| .gitignore | ||
| .gitkeep | ||
| .npmrc | ||
| biome.json | ||
| components.json | ||
| data-designer.openapi (1).yaml | ||
| eslint.config.js | ||
| index.html | ||
| package-lock.json | ||
| package.json | ||
| tsconfig.app.json | ||
| tsconfig.json | ||
| tsconfig.node.json | ||
| vite.config.ts | ||
| vitest.config.ts | ||