From d298b3ffc94008e89066cd999d891e84190da18f Mon Sep 17 00:00:00 2001
From: Christian Sarnataro <csarnataro@users.noreply.github.com>
Date: Mon, 24 Mar 2025 11:42:48 +0000
Subject: [PATCH] fix: sanitize message in notification component (#2664)

fix: sanitize messages in notification component
---
 .../src/browser/theia/messages/notification-component.tsx      | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx b/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx
index 2f1203b9..8cfe6654 100644
--- a/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx
+++ b/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx
@@ -2,6 +2,7 @@ import React from '@theia/core/shared/react';
 import { NotificationComponent as TheiaNotificationComponent } from '@theia/messages/lib/browser/notification-component';
 import { nls } from '@theia/core/lib/common';
 import { codicon } from '@theia/core/lib/browser';
+import { sanitize } from 'dompurify';
 
 export class NotificationComponent extends TheiaNotificationComponent {
   override render(): React.ReactNode {
@@ -20,7 +21,7 @@ export class NotificationComponent extends TheiaNotificationComponent {
             />
             <div className="theia-notification-message">
               <span
-                dangerouslySetInnerHTML={{ __html: message }}
+                dangerouslySetInnerHTML={{ __html: sanitize(message) }}
                 onClick={this.onMessageClick}
               />
             </div>