Summary

This PR fixes two XSS vulnerabilities where untrusted content is injected via dangerouslySetInnerHTML without sanitization.

1. NPM README XSS in MCP Description — CWE-79

File: src/renderer/src/pages/settings/MCPSettings/McpDescription.tsx

NPM package README content (fetched from the npm registry) is rendered through markdown-it and injected directly into the DOM. A malicious NPM package could include XSS payloads in its README:

# Innocent Package
<img src=x onerror="require('child_process').exec('...')">

Fix: Sanitize the rendered HTML with DOMPurify (already a project dependency) before injection:

setMcpInfo(DOMPurify.sanitize(result))

2. Stored XSS in Search Result Highlighting — CWE-79

File: src/renderer/src/pages/history/components/SearchResults.tsx

LLM response text is injected via dangerouslySetInnerHTML without HTML escaping. If an LLM response contains HTML (via prompt injection or adversarial input), it will execute when the user searches chat history:

// Before: raw text with potential HTML injected directly
return <span dangerouslySetInnerHTML={{ __html: text }} />

Fix: Escape HTML entities before applying highlight markup:

const escapeHtml = (s: string) =>
  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
const safeText = escapeHtml(text)

Impact

Both vulnerabilities allow arbitrary JavaScript execution in the Electron renderer process. Combined with sandbox: false in the current BrowserWindow configuration, this could escalate to full system access.