Update app.py

app.py

@@ -127,10 +127,8 @@ def render_message(history):
 
     seen_messages = set()  # Track (role, message) pairs to avoid duplicates
 
-    # Tags and attributes explicitly allowed
     allowed_tags = [
-        'p', 'strong', 'em', 'ul', 'ol', 'li', 'a', 'code', 'pre', 'br', 'blockquote', 'hr', 
-        'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'img'
+        'p', 'strong', 'em', 'ul', 'ol', 'li', 'a', 'code', 'pre', 'br', 'blockquote', 'hr', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'img'
     ]
     allowed_attributes = {
         '*': ['class', 'style'],
@@ -138,18 +136,14 @@ def render_message(history):
         'img': ['src', 'alt', 'title', 'width', 'height']
     }
 
-    # Iterate through history and render each message
     for user_message, assistant_message, user_profile, assistant_profile, user_pic, assistant_pic in history:
         if user_message and ("user", user_message) not in seen_messages:
             seen_messages.add(("user", user_message))
-            # Render markdown -> sanitize output
             user_message_html = markdown.markdown(
-                user_message,  # Process markdown
+                escape_html(user_message),
                 extensions=["fenced_code", "codehilite"]
             )
-            user_message_html = bleach.clean(
-                user_message_html, tags=allowed_tags, attributes=allowed_attributes, strip=True
-            )
+            user_message_html = bleach.clean(user_message_html, tags=allowed_tags, attributes=allowed_attributes, strip=True)
             messages_html += f"""
             <div style='display: flex; flex-direction: column; align-items: flex-start; margin-bottom: 10px;'>
                 <img src='{user_pic}' style='width: 40px; height: 40px; border-radius: 50%; margin-bottom: 5px;'>
@@ -158,14 +152,11 @@ def render_message(history):
 
         if assistant_message and ("assistant", assistant_message) not in seen_messages:
             seen_messages.add(("assistant", assistant_message))
-            # Render markdown -> sanitize output
             assistant_message_html = markdown.markdown(
-                assistant_message,  # Process markdown
+                escape_html(assistant_message),
                 extensions=["fenced_code", "codehilite"]
             )
-            assistant_message_html = bleach.clean(
-                assistant_message_html, tags=allowed_tags, attributes=allowed_attributes, strip=True
-            )
+            assistant_message_html = bleach.clean(assistant_message_html, tags=allowed_tags, attributes=allowed_attributes, strip=True)
             messages_html += f"""
             <div style='display: flex; flex-direction: column; align-items: flex-start; margin-bottom: 10px;'>
                 <img src='{assistant_pic}' style='width: 40px; height: 40px; border-radius: 50%; margin-bottom: 5px;'>
@@ -176,7 +167,6 @@ def render_message(history):
     return messages_html
 
 
-
 def escape_html(unsafe_text):
     escaped_text = ''.join(f"&#{ord(char)};" if char not in ('\n', '\r') else '<br>' for char in unsafe_text)
     return escaped_text