Files
openwork/packages
TY 8e42fc549b fix: allow data:image/* URLs in markdown renderer (#491)
The isSafeUrl function was blocking all data: URLs including
data:image/jpeg;base64,... returned by AI image generation models.
This caused markdown images like ![image](data:image/jpeg;base64,...)
to render with empty src, showing only the alt text 'Image'.

Now data:image/* URIs are whitelisted while other data: schemes
(e.g. data:text/html) remain blocked to prevent XSS.

Co-authored-by: taoyuan <taoyuan@gmail.com>
2026-02-07 13:06:06 -08:00
..