Copilot commented on code in PR #1511:
URL: https://github.com/apache/dubbo-admin/pull/1511#discussion_r3651605794
##########
ui-vue3/src/api/service/ai.ts:
##########
@@ -69,7 +49,11 @@ export const aiService = {
},
// 发送聊天消息（流式响应）
- async sendChatMessage(message: string, sessionId?: string):
Promise<ReadableStream> {
+ async sendChatMessage(
+ message: string,
+ sessionId?: string,
+ context?: AIContextSnapshot
+ ): Promise<ReadableStream> {
Review Comment:
`aiService` is typed as `ChatService<AIContextSnapshot>`, whose contract
returns `Promise<ReadableStream<Uint8Array>>`, but `sendChatMessage` is
declared as `Promise<ReadableStream>`. Tightening the return type avoids losing
the chunk type and prevents mismatch with consumers expecting `Uint8Array`.
##########
ui-vue3/src/components/ai-chat/MessageItem.vue:
##########
@@ -46,7 +46,7 @@
<div v-if="message === messages[messages.length - 1] &&
isAiThinking"
class="flex items-center text-gray-400 text-xs mt-2">
<LoadingOutlined class="mr-1" />
- <span class="animate-pulse">正在思考...</span>
+ <span class="animate-pulse">{{ labels.thinking
}}</span>
Review Comment:
Rendering AI/model content via `v-html` is unsafe if the Markdown renderer
allows raw HTML. In this PR, the chat markdown renderer is configured with
`html: true`, which allows injected HTML/script in AI responses to be executed
in the browser (XSS). Disable raw HTML (`html: false`) and/or sanitize the
rendered output before binding it to `v-html`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
