Repository-influenced model output is rendered as active slide HTML #606

Affected versions: confirmed on main at commit d92819a (the project publishes no tagged release).

Summary

The Slides view (src/app/[owner]/[repo]/slides/page.tsx) places repository-derived wiki content into a prompt asking the model to generate a single HTML slide, extracts HTML from the response with a few regexes, and renders it with dangerouslySetInnerHTML without sanitizing it.

Details

content: `Create a single HTML slide ...
Use the following wiki content as reference:
${wikiContent}
...
I need ONLY the HTML for this slide.`

const codeBlockMatch = slideContent.match(/```(?:html)?\s*([\s\S]*?)\s*```/);
...
slideHtml = slideContent;   // fallback: raw model output, unsanitized

<div className="w-full h-full" dangerouslySetInnerHTML={{ __html: slides[currentSlideIndex]?.html || '' }} />

If the model's own output already contains a <style> tag, the page's default-styling wrapper is skipped entirely and the raw output is used as-is.

POC

(available upon request)

Impact

A repository whose content (README, code comments, etc.) can induce the model to emit an onerror/onclick handler or a <script> tag causes that script to execute in the DeepWiki origin when a victim opens that repository's Slides view.

Suggested fix: sanitize the extracted HTML with a strict sanitizer before rendering, or render it in a sandboxed iframe. A fix is included in the linked PR.

Fix: #599