From e5396c390f18f7820704e379a246b2e80cfa9b58 Mon Sep 17 00:00:00 2001
From: Christian Sarnataro <c.sarnataro@arduino.cc>
Date: Wed, 19 Mar 2025 13:45:36 +0100
Subject: [PATCH 1/2] fix: sanitize messages in notification component

---
 .gitignore                                                     | 2 ++
 .../src/browser/theia/messages/notification-component.tsx      | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 570b7df39..c9859c929 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,5 @@ electron-app/traces
 inols*.log
 # The electron-builder output.
 electron-app/dist
+
+build/
\ No newline at end of file
diff --git a/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx b/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx
index 2f1203b97..8cfe66543 100644
--- a/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx
+++ b/arduino-ide-extension/src/browser/theia/messages/notification-component.tsx
@@ -2,6 +2,7 @@ import React from '@theia/core/shared/react';
 import { NotificationComponent as TheiaNotificationComponent } from '@theia/messages/lib/browser/notification-component';
 import { nls } from '@theia/core/lib/common';
 import { codicon } from '@theia/core/lib/browser';
+import { sanitize } from 'dompurify';
 
 export class NotificationComponent extends TheiaNotificationComponent {
   override render(): React.ReactNode {
@@ -20,7 +21,7 @@ export class NotificationComponent extends TheiaNotificationComponent {
             />
             <div className="theia-notification-message">
               <span
-                dangerouslySetInnerHTML={{ __html: message }}
+                dangerouslySetInnerHTML={{ __html: sanitize(message) }}
                 onClick={this.onMessageClick}
               />
             </div>

From f94c0eb30e3dee6f3bb146d64cb0ed3bba893ed3 Mon Sep 17 00:00:00 2001
From: Christian Sarnataro <c.sarnataro@arduino.cc>
Date: Wed, 19 Mar 2025 14:08:50 +0100
Subject: [PATCH 2/2] fix(gitignore): removing useless entry

---
 .gitignore | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index c9859c929..570b7df39 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,5 +20,3 @@ electron-app/traces
 inols*.log
 # The electron-builder output.
 electron-app/dist
-
-build/
\ No newline at end of file