Replace v-html + DOMPurify sanitization with plain Vue text
interpolation ({{ }}) and CSS white-space: pre-wrap for the
thinking content display.
The thinking content is raw model output that should never be
interpreted as HTML. Using v-html here created an unnecessary XSS
attack surface — even with DOMPurify, the \n→<br/> replacement
happened before sanitization, and future changes to sanitizer config
could introduce vulnerabilities.
Plain text rendering with pre-wrap:
- Eliminates XSS risk entirely (no HTML parsing)
- Preserves line breaks natively via CSS
- Removes the sanitizeHTML import and safeProcessThinkContent function
- Simpler code with identical visual output
lyingbug
03fda55261