Skip to content

Feat/mdstream safe #280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DingGao-Devin wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Feat/mdstream safe #280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
640414d
feat: 解决html的xss问题
Jun 16, 2025
d03310f
chore: Publish feat/mdstream-safe
Jun 16, 2025
c88ff82
feat: 修改g
Jun 16, 2025
0dc6513
feat: change file url
Jul 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions common/changes/@coze/chat-sdk/feat-mdstream-safe_2025-06-16-02-57.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"changes": [
{
"packageName": "@coze/chat-sdk",
"comment": "解决html的xss问题",
"type": "minor"
}
],
"packageName": "@coze/chat-sdk",
"email": "gaoding.devingao@bytedance.com"
}
11 changes: 11 additions & 0 deletions common/changes/@coze/chat-sdk/feat-mdstream-safe_2025-06-16-04-00.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"changes": [
{
"packageName": "@coze/chat-sdk",
"comment": "修改g",
"type": "minor"
}
],
"packageName": "@coze/chat-sdk",
"email": "gaoding.devingao@bytedance.com"
}
11 changes: 11 additions & 0 deletions common/changes/@coze/chat-sdk/feat-mdstream-safe_2025-07-01-12-49.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"changes": [
{
"packageName": "@coze/chat-sdk",
"comment": "change file url",
"type": "minor"
}
],
"packageName": "@coze/chat-sdk",
"email": "gaoding.devingao@bytedance.com"
}
18 changes: 18 additions & 0 deletions common/config/subspaces/default/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions packages/chat-sdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@coze/chat-sdk",
"version": "0.1.11-beta.17",
"version": "0.1.11-beta.18",
"description": "Coze chat components for taro",
"license": "MIT",
"author": "gaoding.devingao@bytedance.com",
Expand Down Expand Up @@ -84,6 +84,7 @@
"micromark-extension-gfm-table": "^2.1.0",
"micromark-extension-gfm-task-list-item": "^2.1.0",
"micromark-extension-misc-radio-list-item": "^2.1.0",
"xss": "^1.0.15",
"zustand": "^4.4.7"
},
"devDependencies": {
Expand Down Expand Up @@ -162,4 +163,4 @@
"css": "Less",
"framework": "React"
}
}
}
5 changes: 4 additions & 1 deletion packages/chat-sdk/src/libs/services/helper/message/send-message/multi-send-message.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,8 @@ export class MultiSendMessage extends RawSendMessage {
message.content = JSON.stringify(
fileList.map(item => ({
type: item.type,
file_id: item.file_id,
file_id: item.file_id || undefined,
file_url: item.file_url || undefined,
})),
);
this.sendMessage(message, historyMessages);
Expand Down Expand Up @@ -134,6 +135,8 @@ export class MultiSendMessage extends RawSendMessage {
file: item.file,
});
packResult.file_id = res.id;
// @ts-expect-error -- linter-disable-autofix
packResult.file_url = res.url;
Comment on lines +138 to +139
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jul 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Address TypeScript type issues instead of suppressing them.

The TypeScript linter disable suggests that the upload response type doesn't include a url property. Consider updating the type definitions to properly reflect the API response structure.

-            // @ts-expect-error -- linter-disable-autofix
-            packResult.file_url = res.url;
+            packResult.file_url = res.url;

Update the upload response type definition to include the url property, or verify that the API actually returns this field.

🏁 Script executed:

#!/bin/bash
# Description: Verify the upload response type definition includes url property
# Expected: Find type definitions for upload response to confirm url property

# Search for upload response type definitions
ast-grep --pattern 'interface $_ {
  $$$
  id: $_
  $$$
}'

# Also search for upload method return types
rg -A 10 -B 5 "upload.*:" --type ts

Length of output: 56007

🏁 Script executed:

#!/bin/bash
# Search for FileResult type definitions
rg -R "interface FileResult" -A5 -B5 --type ts

Length of output: 453

🏁 Script executed:

#!/bin/bash
# Display context around the ts-expect-error in multi-send-message.ts
sed -n '120,160p' packages/chat-sdk/src/libs/services/helper/message/send-message/multi-send-message.ts

Length of output: 1304





🏁 Script executed:


#!/bin/bash
# Find FileResult definition and context in mini-coze-api
grep -R "FileResult" -n packages/chat-sdk/src/libs/utils/mini-coze-api.ts || true
sed -n '1,200p' packages/chat-sdk/src/libs/utils/mini-coze-api.ts


Length of output: 6304






Add the url field to your FileObject type and remove the suppression


You’re suppressing a real TypeScript error because the upload response TypeScript definitions don’t include the URL property. To fix:


• packages/coze-js/src/resources/files/files.ts

– Extend FileObject with the url field to match what the API actually returns.


export interface FileObject {
  /** The ID of the uploaded file. */
  id: string;
  /** The total number of bytes in the file. */
  bytes: number;
  /** The upload time, formatted as a 10-digit Unix timestamp in seconds. */
  created_at: number;
  /** The name of the file. */
  file_name: string;
+ /** Public URL of the uploaded file. */
+ url: string;
}


• packages/chat-sdk/src/libs/services/helper/message/send-message/multi-send-message.ts

– Remove the @ts-expect-error and re-enable the assignment once the type is correct.


-            // @ts-expect-error -- linter-disable-autofix
-            packResult.file_url = res.url;
+            packResult.file_url = res.url;


After updating the type, run your build to verify the error is gone and the field is available at runtime.



🤖 Prompt for AI Agents

In packages/coze-js/src/resources/files/files.ts, extend the FileObject type to
include the url field to reflect the actual API response. Then, in
packages/chat-sdk/src/libs/services/helper/message/send-message/multi-send-message.ts
at lines 138-139, remove the @ts-expect-error comment and keep the assignment of
packResult.file_url = res.url. Finally, run the build to confirm the TypeScript
error is resolved and the url field is properly recognized.






    

  
  




    


        

      
  
  

    
  
    
    

  

  

  



          

              

      








    


  





        

    


    


  		



    

    

    

  
                fileList.push(packResult);






    

    

    

  
              }






    

    

    

  
            }),






  

    
          
            
          
          Expand Down
    
    
  



                
              


          


    

  



      
  

    

      

        


          

            
            
          


          



          
            3 changes: 2 additions & 1 deletion
          
          

        

  packages/chat-sdk/src/libs/ui-kit/atomic/md-stream/render/phrase/html/index.tsx

  
  
      
      
  





        
      


      

        











            


          

          

            
              

                
    

              

            
            
                            

                            


                              
   View file



                                    


                                  


                            


                            

                            

    Open in desktop



                
            
          

        

      

    



    

      

          

            




              
      
    
              

                
                  

                      Original file line number
                      Diff line number
                      Diff line change
                  

                
                
                      
      

    
    
    @@ -1,5 +1,6 @@
  


    

    

    

  
    import { FC, memo } from 'react';






    

    

    

  
    







    

    

    

  
    import xss from 'xss';






    

    

    

  
    import type { Html as HtmlMdType, Text as TextMdType } from 'mdast';






    

    

    

  
    import { RichText } from '@tarojs/components';






    

    

    

  
    







      

    
        
          
        
        Expand All
    
    @@ -13,7 +14,7 @@ export const Html: FC<{
  


    

    

    

  
      return (






    

    

    

  
        <>






    

    

    

  
          {enableHtmlTags ? (






    

    

    

  
            <RichText nodes={`${node.value}`} />






    

    

    

  
            <RichText nodes={`${xss(node.value)}`} />






    

    

    

  
          ) : (






    

    

    

  
            <Text node={node as unknown as TextMdType} />






    

    

    

  
          )}






  

    
          
            
          
          Expand Down
    
    
  



                
              


          


    

  



      
  

    

      

        


          

            
            
          


          



          
            2 changes: 1 addition & 1 deletion
          
          

        

  packages/chat-sdk/src/libs/ui-kit/atomic/md-stream/render/phrase/link/index.tsx

  
  
      
      
  





        
      


      

        











            


          

          

            
              

                
    

              

            
            
                            

                            


                              
   View file



                                    


                                  


                            


                            

                            

    Open in desktop



                
            
          

        

      

    



    

      

          

            




              
      
    
              

                
                  

                      Original file line number
                      Diff line number
                      Diff line change
                  

                
                
                      
      

    
          
            
          
          Expand Up
    
    @@ -19,7 +19,7 @@ export const Link: FC<{
  


    

    

    

  
      const { eventCallbacks } = useMdStreamContext();






    

    

    

  
      const isValidUrl = useMemo(() => {






    

    

    

  
        let isValid = node.url && node.url !== '#';






    

    

    

  
        if (node.url.startsWith('javascript:')) {






    

    

    

  
        if (/^javascript/i.test(node.url.replace(/\s/g, ''))) {






    

    

    

  
          isValid = false;






    

    

    

  
        }






    

    

    

  
        return isValid;






  

    
          
            
          
          Expand Down
    
    
  



                
              


          


    

  



      
  

    

      

        


          

            
            
          


          



          
            80 changes: 79 additions & 1 deletion
          
          

        

  packages/chat-sdk/src/pages/markdown/const.ts

  
  
      
      
  





        
      


      

        











            


          

          

            
              

                
    

              

            
            
                            

                            


                              
   View file



                                    


                                  


                            


                            

                            

    Open in desktop



                
            
          

        

      

    



    

      

          

            




              
      
    
              

                
                  

                      Original file line number
                      Diff line number
                      Diff line change
                  

                
                
                      
      

    
    
    @@ -1,4 +1,82 @@
  


    

    

    

  
    export const markdown = `






    

    

    

  
    <a href="javas\x00cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x07cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x0Dcript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x0Acript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x08cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x02cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x03cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x04cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x01cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x05cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x0Bcript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x09cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x06cript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <a href="javas\x0Ccript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    







    

    

    

  
    <a href="\x12javascript:javascript:alert(1)" id="fuzzelement1">test</a>






    

    

    

  
    <script type="text/javascript">alert(1)</script>






    

    

    

  
    "-prompt(8)-"






    

    

    

  
    '-prompt(8)-'






    

    

    

  
    ";a=prompt,a()//






    

    

    

  
    ';a=prompt,a()//






    

    

    

  
    '-eval("window['pro'%2B'mpt'](8)")-'






    

    

    

  
    "-eval("window['pro'%2B'mpt'](8)")-"






    

    

    

  
    "onclick=prompt(8)>"@x.y






    

    

    

  
    "onclick=prompt(8)><svg/onload=prompt(8)>"@x.y






    

    

    

  
    <image/src/onerror=prompt(8)>






    

    

    

  
    <img/src/onerror=prompt(8)>






    

    

    

  
    <image src/onerror=prompt(8)>






    

    

    

  
    <img src/onerror=prompt(8)>






    

    

    

  
    <image src =q onerror=prompt(8)>






    

    

    

  
    <img src =q onerror=prompt(8)>






    

    

    

  
    </scrip</script>t><img src =q onerror=prompt(8)>






    

    

    

  
    <script\x20type="text/javascript">javascript:alert(1);</script>






    

    

    

  
    <script\x3Etype="text/javascript">javascript:alert(1);</script>






    

    

    

  
    <script\x0Dtype="text/javascript">javascript:alert(1);</script>






    

    

    

  
    <script\x09type="text/javascript">javascript:alert(1);</script>






    

    

    

  
    <script\x0Ctype="text/javascript">javascript:alert(1);</script>






    

    

    

  
    <script\x2Ftype="text/javascript">javascript:alert(1);</script>






    

    

    

  
    <script\x0Atype="text/javascript">javascript:alert(1);</script>






    

    

    

  
    '"><\x3Cscript>javascript:alert(1)</script>






    

    

    

  
    '"><\x00script>javascript:alert(1)</script>






    

    

    

  
    <img src=1 href=1 onerror="javascript:alert(1)"></img>






    

    

    

  
    <audio src=1 href=1 onerror="javascript:alert(1)"></audio>






    

    

    

  
    <video src=1 href=1 onerror="javascript:alert(1)"></video>






    

    

    

  
    <body src=1 href=1 onerror="javascript:alert(1)"></body>






    

    

    

  
    <image src=1 href=1 onerror="javascript:alert(1)"></image>






    

    

    

  
    <object src=1 href=1 onerror="javascript:alert(1)"></object>






    

    

    

  
    <script src=1 href=1 onerror="javascript:alert(1)"></script>






    

    

    

  
    <svg onResize svg onResize="javascript:javascript:alert(1)"></svg onResize>






    

    

    

  
    <title onPropertyChange title onPropertyChange="javascript:javascript:alert(1)"></title onPropertyChange>






    

    

    

  
    <iframe onLoad iframe onLoad="javascript:javascript:alert(1)"></iframe onLoad>






    

    

    

  
    <body onMouseEnter body onMouseEnter="javascript:javascript:alert(1)"></body onMouseEnter>






    

    

    

  
    <body onFocus body onFocus="javascript:javascript:alert(1)"></body onFocus>






    

    

    

  
    <frameset onScroll frameset onScroll="javascript:javascript:alert(1)"></frameset onScroll>






    

    

    

  
    <script onReadyStateChange script onReadyStateChange="javascript:javascript:alert(1)"></script onReadyStateChange>






    

    

    

  
    <html onMouseUp html onMouseUp="javascript:javascript:alert(1)"></html onMouseUp>






    

    

    

  
    <body onPropertyChange body onPropertyChange="javascript:javascript:alert(1)"></body onPropertyChange>






    

    

    

  
    <svg onLoad svg onLoad="javascript:javascript:alert(1)"></svg onLoad>






    

    

    

  
    <body onPageHide body onPageHide="javascript:javascript:alert(1)"></body onPageHide>






    

    

    

  
    <body onMouseOver body onMouseOver="javascript:javascript:alert(1)"></body onMouseOver>






    

    

    

  
    <body onUnload body onUnload="javascript:javascript:alert(1)"></body onUnload>






    

    

    

  
    <body onLoad body onLoad="javascript:javascript:alert(1)"></body onLoad>






    

    

    

  
    <bgsound onPropertyChange bgsound onPropertyChange="javascript:javascript:alert(1)"></bgsound onPropertyChange>






    

    

    

  
    <html onMouseLeave html onMouseLeave="javascript:javascript:alert(1)"></html onMouseLeave>






    

    

    

  
    <html onMouseWheel html onMouseWheel="javascript:javascript:alert(1)"></html onMouseWheel>






    

    

    

  
    <style onLoad style onLoad="javascript:javascript:alert(1)"></style onLoad>






    

    

    

  
    <iframe onReadyStateChange iframe onReadyStateChange="javascript:javascript:alert(1)"></iframe onReadyStateChange>






    

    

    

  
    <body onPageShow body onPageShow="javascript:javascript:alert(1)"></body onPageShow>






    

    

    

  
    <style onReadyStateChange style onReadyStateChange="javascript:javascript:alert(1)"></style onReadyStateChange>






    

    

    

  
    <frameset onFocus frameset onFocus="javascript:javascript:alert(1)"></frameset onFocus>






    

    

    

  
    <applet onError applet onError="javascript:javascript:alert(1)"></applet onError>






    

    

    

  
    <marquee onStart marquee onStart="javascript:javascript:alert(1)"></marquee onStart>






    

    

    

  
    <script onLoad script onLoad="javascript:javascript:alert(1)"></script onLoad>






    

    

    

  
    <html onMouseOver html onMouseOver="javascript:javascript:alert(1)"></html onMouseOver>






    

    

    

  
    







    

    

    

  
    <img src='https://www.qq.com/sad' />






    

    

    

  
    <p>sadfadf</p>






    

    

    

  
    







    

    

    

  
    # Code






    

    

    

  
    as






    

    

    

  
    \`\`\`javascript






      

    
        
          
        
        Expand All
    
    @@ -8,7 +86,7 @@ $(document).ready(function () {
  


    

    

    

  
    \`\`\`






    

    

    

  
    https://www.coze.com






    

    

    

  
    test@coze.com






    

    

    

  
    [coze](javascripdt://www.baidu.com)






    

    

    

  
    [coze](javascript:javascript:alert(1))






    

    

    

  
    ![Alt Text](https://pic1.zhimg.com/v2-b444070848d54baf536222b22a51fba4_b.jpg)






    

    

    

  
    







    

    

    

  
    ![Alt Text](https://s.coze.cn/t/cmdAkWul_g4/)






  

    
          
            
          
          Expand Down