From 28286d69b916282740b19bd9778c73a301966b5e Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Wed, 15 Jul 2026 11:08:28 +0800
Subject: [PATCH] ui: xss fix

---
 packages/ui-default/backendlib/markdown-it-media.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/ui-default/backendlib/markdown-it-media.ts b/packages/ui-default/backendlib/markdown-it-media.ts
index 4a748fdd2..5ca23dbfd 100644
--- a/packages/ui-default/backendlib/markdown-it-media.ts
+++ b/packages/ui-default/backendlib/markdown-it-media.ts
@@ -96,7 +96,7 @@ export function Media(md: MarkdownIt, { pdfToolbar = false }: { pdfToolbar?: boo
   const supported = ['youtube', 'vimeo', 'vine', 'prezi', 'bilibili', 'youku', 'msoffice'];
   md.renderer.rules.video = function tokenizeReturn(tokens, idx) {
     let src = md.utils.escapeHtml(tokens[idx].attrGet('src'));
-    const service = md.utils.escapeHtml(tokens[idx].attrGet('service')).toLowerCase();
+    const service = tokens[idx].attrGet('service').replace(/[^A-Z0-9]/gi, '').toLowerCase();
     if (Hydro?.module?.richmedia?.[service]) {
       const result = Hydro?.module?.richmedia[service].get(service, src, md);
       if (result) return result;