fix(chat): allow file-only messages with no text to be sent in chat panel and deployed chat by waleedlatif1 · Pull Request #1635 · simstudioai/sim

waleedlatif1 · 2025-10-15T03:26:36Z

Summary

allow file-only messages with no text to be sent in chat panel and deployed chat

Type of Change

Bug fix

Testing

Tested manually by sending messages with no text and only images.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…anel and deployed chat

vercel · 2025-10-15T03:26:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Oct 15, 2025 3:26am

greptile-apps

Greptile Overview

Summary

Enables sending messages with file attachments only (no text required) in both chat panel and deployed chat by conditionally rendering the message text bubble.

Key Changes:

Conditionally renders message bubble only when text content exists and doesn't start with "Sent"/"Uploaded"
Adds enhanced image attachment preview that opens in a new window with custom HTML
Adds validation to check dataUrl.startsWith('data:') before rendering images or enabling click handlers
Fixes missing useCallback dependencies in chat.tsx (chatFiles, isUploadingFiles, setter functions)

Critical Issues Found:

XSS vulnerabilities: attachment.name is directly interpolated into HTML (document.write) without escaping in 4 locations across 2 files. A malicious filename like </title><script>alert('XSS')</script> will execute JavaScript.

Confidence Score: 1/5

This PR contains critical XSS vulnerabilities that must be fixed before merging
Score reflects 4 XSS vulnerabilities where user-controlled filenames are injected into HTML without escaping. While the dependency array fix is correct, the security issues make this unsafe to merge.
Pay close attention to apps/sim/app/chat/components/message/message.tsx and apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/chat/components/chat-message/chat-message.tsx - both contain XSS vulnerabilities

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/app/chat/components/message/message.tsx	1/5	Allows file-only messages by conditionally rendering text bubble; adds image preview in new window with XSS vulnerabilities in attachment.name handling
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/chat/chat.tsx	4/5	Added missing dependencies (`chatFiles`, `isUploadingFiles`, `setChatMessage`, `setChatFiles`, `setUploadErrors`) to `handleSendMessage` useCallback
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/chat/components/chat-message/chat-message.tsx	1/5	Allows file-only messages by conditionally rendering text bubble; adds image preview in new window with XSS vulnerabilities in attachment.name handling

Sequence Diagram

sequenceDiagram
participant User
participant ChatInput
participant ChatComponent
participant MessageComponent
participant Browser
User->>ChatInput: Upload file + optional text
ChatInput->>ChatComponent: handleSendMessage()
alt Has text content
ChatComponent->>MessageComponent: Render attachments + text bubble
else File-only (no text)
ChatComponent->>MessageComponent: Render attachments only (skip text bubble)
end
User->>MessageComponent: Click attachment
MessageComponent->>MessageComponent: Check dataUrl.startsWith('data:')
MessageComponent->>Browser: window.open('', '_blank')
MessageComponent->>Browser: document.write(HTML with attachment.name)
Browser->>User: Display attachment in new window

_{3 files reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2025-10-15T03:29:56Z

+ <!DOCTYPE html>
+ <html>
+ <head>
+ <title>${attachment.name}</title>


logic: XSS vulnerability: ${attachment.name} is not HTML-escaped. If a user uploads a file named </title><script>alert('XSS')</script>, it will execute JavaScript in the new window.
Suggested change
<title>${attachment.name}</title>
<title>${attachment.name.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''')}</title>
Prompt To Fix With AI
This is a comment left during a code review. Path: apps/sim/app/chat/components/message/message.tsx Line: 105:105 Comment: **logic:** XSS vulnerability: `${attachment.name}` is not HTML-escaped. If a user uploads a file named `</title><script>alert('XSS')</script>`, it will execute JavaScript in the new window. ```suggestion <title>${attachment.name.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''')}</title>``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2025-10-15T03:29:56Z

+ </style>
+ </head>
+ <body>
+ <img src="${validDataUrl}" alt="${attachment.name}" />


logic: XSS vulnerability: ${attachment.name} in the alt attribute is not HTML-escaped.
Suggested change
<imgsrc="${validDataUrl}"alt="${attachment.name}"/>
<imgsrc="${validDataUrl}"alt="${attachment.name.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g,'"').replace(/'/g,''')}" />
Prompt To Fix With AI
This is a comment left during a code review. Path: apps/sim/app/chat/components/message/message.tsx Line: 112:112 Comment: **logic:** XSS vulnerability: `${attachment.name}` in the alt attribute is not HTML-escaped. ```suggestion <img src="${validDataUrl}" alt="${attachment.name.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''')}" />``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2025-10-15T03:29:57Z

+ <!DOCTYPE html>
+ <html>
+ <head>
+ <title>${attachment.name}</title>


logic: XSS vulnerability: ${attachment.name} is not HTML-escaped.
Suggested change
<title>${attachment.name}</title>
<title>${attachment.name.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''')}</title>
Prompt To Fix With AI
This is a comment left during a code review. Path: apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/chat/components/chat-message/chat-message.tsx Line: 113:113 Comment: **logic:** XSS vulnerability: `${attachment.name}` is not HTML-escaped. ```suggestion <title>${attachment.name.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''')}</title>``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2025-10-15T03:29:58Z

+ </style>
+ </head>
+ <body>
+ <img src="${validDataUrl}" alt="${attachment.name}" />


logic: XSS vulnerability: ${attachment.name} in the alt attribute is not HTML-escaped.
Suggested change
<imgsrc="${validDataUrl}"alt="${attachment.name}"/>
<imgsrc="${validDataUrl}"alt="${attachment.name.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g,'"').replace(/'/g,''')}" />
Prompt To Fix With AI
This is a comment left during a code review. Path: apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/chat/components/chat-message/chat-message.tsx Line: 120:120 Comment: **logic:** XSS vulnerability: `${attachment.name}` in the alt attribute is not HTML-escaped. ```suggestion <img src="${validDataUrl}" alt="${attachment.name.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''')}" />``` How can I resolve this? If you propose a fix, please make it concise.

…anel and deployed chat (#1635)

fix(chat): allow file-only messages with no text to be sent in chat p…
c951130
…anel and deployed chat

waleedlatif1 merged commit 7595e54 into stagingOct 15, 2025
4 checks passed

waleedlatif1 deleted the fix/chat branch October 15, 2025 03:27

greptile-appsBot reviewed Oct 15, 2025
View reviewed changes

waleedlatif1 mentioned this pull request Oct 15, 2025
v0.4.15: helm chart updates, telegram tools, youtube tools, file upload support for more blocks #1636
Merged

Sg312 pushed a commit that referenced this pull request Oct 15, 2025
fix(chat): allow file-only messages with no text to be sent in chat p…
069c6bd
…anel and deployed chat (#1635)

Navigation Menu

Uh oh!

fix(chat): allow file-only messages with no text to be sent in chat panel and deployed chat - #1635

fix(chat): allow file-only messages with no text to be sent in chat panel and deployed chat#1635
waleedlatif1 merged 1 commit into
stagingfrom
fix/chat

waleedlatif1 commented Oct 15, 2025

Uh oh!

vercelBot commented Oct 15, 2025

Uh oh!

Uh oh!

greptile-appsBot left a comment

Uh oh!

greptile-appsBotOct 15, 2025

Uh oh!

greptile-appsBotOct 15, 2025

Uh oh!

greptile-appsBotOct 15, 2025

Uh oh!

greptile-appsBotOct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	<title>${attachment.name}</title>
	<title>${attachment.name.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''')}</title>

	<imgsrc="${validDataUrl}"alt="${attachment.name}"/>
	<imgsrc="${validDataUrl}"alt="${attachment.name.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g,'"').replace(/'/g,''')}" />

Uh oh!

Conversation

waleedlatif1 commented Oct 15, 2025

Summary

Type of Change

Testing

Checklist

Uh oh!

vercelBot commented Oct 15, 2025

Uh oh!

Uh oh!

greptile-appsBot left a comment

Choose a reason for hiding this comment

Greptile Overview

Summary

Confidence Score: 1/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-appsBotOct 15, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-appsBotOct 15, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-appsBotOct 15, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-appsBotOct 15, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant