mirror of
https://github.com/different-ai/openwork
synced 2026-05-14 11:06:25 +02:00
The isSafeUrl function was blocking all data: URLs including data:image/jpeg;base64,... returned by AI image generation models. This caused markdown images like  to render with empty src, showing only the alt text 'Image'. Now data:image/* URIs are whitelisted while other data: schemes (e.g. data:text/html) remain blocked to prevent XSS. Co-authored-by: taoyuan <taoyuan@gmail.com>