Update app.py

app.py

@@ -6,6 +6,7 @@ import markdown
 from markdown.extensions.codehilite import CodeHiliteExtension
 import markdown.extensions.fenced_code
 import bleach
+from html import escape
 
 API_URL = "https://host.palple.polrambora.com/pmsq"
 
@@ -138,13 +139,19 @@ def render_message(history):
     for user_message, assistant_message, user_profile, assistant_profile, user_pic, assistant_pic in history:
         if user_message and ("user", user_message) not in seen_messages:
             seen_messages.add(("user", user_message))
+            
             user_message_html = markdown.markdown(
                 user_message,  
-                extensions=["fenced_code", "codehilite"]
+                extensions=["fenced_code", "codehilite"],
+                output_format="html5"
             )
+            
             user_message_html = bleach.clean(
                 user_message_html, tags=allowed_tags, attributes=allowed_attributes, strip=True
             )
+            
+            user_message_html = escape(user_message_html)
+
             messages_html += f"""
             <div style='display: flex; flex-direction: column; align-items: flex-start; margin-bottom: 10px;'>
                 <img src='{user_pic}' style='width: 40px; height: 40px; border-radius: 50%; margin-bottom: 5px;'>
@@ -153,13 +160,19 @@ def render_message(history):
 
         if assistant_message and ("assistant", assistant_message) not in seen_messages:
             seen_messages.add(("assistant", assistant_message))
+            
             assistant_message_html = markdown.markdown(
-                assistant_message,  
-                extensions=["fenced_code", "codehilite"]
+                assistant_message, 
+                extensions=["fenced_code", "codehilite"],
+                output_format="html5"
             )
+            
             assistant_message_html = bleach.clean(
                 assistant_message_html, tags=allowed_tags, attributes=allowed_attributes, strip=True
             )
+            
+            assistant_message_html = escape(assistant_message_html)
+
             messages_html += f"""
             <div style='display: flex; flex-direction: column; align-items: flex-start; margin-bottom: 10px;'>
                 <img src='{assistant_pic}' style='width: 40px; height: 40px; border-radius: 50%; margin-bottom: 5px;'>
@@ -169,7 +182,6 @@ def render_message(history):
     messages_html += "</div></div>"
     return messages_html
 
-
 def escape_html(unsafe_text):
     escaped_text = ''.join(f"&#{ord(char)};" if char not in ('\n', '\r') else '<br>' for char in unsafe_text)
     return escaped_text