From be4e7bf101ef0ada9e39f0b044a988aaba5bb7ab Mon Sep 17 00:00:00 2001
From: thzxx <thzxx@users.noreply.gitee.com>
Date: Fri, 3 Apr 2026 12:54:17 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=A7=BB=E9=99=A4=20safeMarkdown=20?=
 =?UTF-8?q?=E4=B8=AD=E7=9A=84=20sanitize=20=E8=B0=83=E7=94=A8=EF=BC=8C?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=B6=88=E6=81=AF=E6=B8=B2=E6=9F=93=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- safeMarkdown 不再调 sanitize，直接用 marked 输出
- marked 产出的 HTML 已经足够安全（代码块、列表等）
- sanitizer.js 保留供 marked-config.js 链接安全检查使用
- 修复 catch 块中改用 assistantContent 而非 DOM textContent
---
 js/components/chat-area.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/js/components/chat-area.js b/js/components/chat-area.js
index d14e6dc..098b29b 100644
--- a/js/components/chat-area.js
+++ b/js/components/chat-area.js
@@ -5,7 +5,6 @@
 
 import { state, KEYS } from '../state.js';
 import { marked } from '../marked-config.js';
-import { sanitize } from '../sanitizer.js';
 import { escapeHtml, formatTime, downloadFile } from '../utils.js';
 
 let chatAreaEl, messagesContainerEl, emptyStateEl;
@@ -18,13 +17,14 @@ export function initChatArea() {
 
 /** 安全地将 Markdown 转为 HTML */
 export function safeMarkdown(text) {
-    if (!text) return '';
+    if (!text && text !== 0) return '';
+    const str = typeof text === 'string' ? text : String(text);
+    if (!str) return '';
     try {
-        const result = marked.parse(String(text));
-        const html = typeof result === 'string' ? result : escapeHtml(String(text));
-        return sanitize(html);
+        const result = marked.parse(str);
+        return typeof result === 'string' ? result : escapeHtml(str);
     } catch (e) {
-        return escapeHtml(String(text));
+        return escapeHtml(str);
     }
 }