From 281e61160c33bb23aea50612e17dcd5805e56add Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Wed, 8 Jul 2026 20:08:22 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20XSS=20in=20HTML=20renderin?= =?UTF-8?q?g=20by=20escaping=20markdown=20content?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use `_escape` to sanitize user inputs like attack prompts, target responses, and reasonings before rendering them with `st.write` in Streamlit. This prevents markdown injection and XSS vulnerabilities. Co-authored-by: Nevern1y <77607229+Nevern1y@users.noreply.github.com> --- app.py | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/app.py b/app.py index e624fbd..62e540f 100644 --- a/app.py +++ b/app.py @@ -578,11 +578,11 @@ def _render_worst_case_dossier(result: EvalResult) -> None: unsafe_allow_html=True, ) st.markdown("**Gemma attack**") - st.write(case.attack.prompt) + st.write(_escape(case.attack.prompt)) st.markdown("**Target response**") - st.write(verdict.target_response) + st.write(_escape(verdict.target_response)) st.markdown("**Gemma judge**") - st.write(verdict.reasoning) + st.write(_escape(verdict.reasoning)) if verdict.evidence_span: st.markdown( f'
Evidence span: ' @@ -608,12 +608,12 @@ def _render_case_expanders(result: EvalResult) -> None: f"{item.attack.id} · score {verdict.score}/5 · {label} · {item.attack.prompt[:82]}" ): st.markdown("**Gemma attack**") - st.write(item.attack.prompt) + st.write(_escape(item.attack.prompt)) st.caption(f"Rationale: {item.attack.rationale}") st.markdown("**Target response**") - st.write(verdict.target_response) + st.write(_escape(verdict.target_response)) st.markdown("**Gemma judge**") - st.write(verdict.reasoning) + st.write(_escape(verdict.reasoning)) if verdict.evidence_span: st.markdown(f"**Evidence span:** `{verdict.evidence_span}`") @@ -628,11 +628,11 @@ def _render_target_drilldown(board: LeaderboardResult, target: TargetReport) -> f"{item.attack.id} · score {verdict.score}/5 · {label} · {item.attack.prompt[:82]}" ): st.markdown("**Shared Gemma attack**") - st.write(item.attack.prompt) + st.write(_escape(item.attack.prompt)) st.markdown("**Target response**") - st.write(verdict.target_response) + st.write(_escape(verdict.target_response)) st.markdown("**Gemma judge**") - st.write(verdict.reasoning) + st.write(_escape(verdict.reasoning)) if verdict.evidence_span: st.markdown(f"**Evidence span:** `{verdict.evidence_span}`")