From b54b54a3f44992ee7678622d953935fd21a333a0 Mon Sep 17 00:00:00 2001
From: shaohuzhang1 <shaohu.zhang@fit2cloud.com>
Date: Thu, 26 Mar 2026 15:28:55 +0800
Subject: [PATCH] fix: The EchartsRander component injects stored XSS via Eval

---
 ui/src/components/markdown/EchartsRander.vue | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/ui/src/components/markdown/EchartsRander.vue b/ui/src/components/markdown/EchartsRander.vue
index d0e6ea7ed32..f5bcd06c406 100644
--- a/ui/src/components/markdown/EchartsRander.vue
+++ b/ui/src/components/markdown/EchartsRander.vue
@@ -1,6 +1,12 @@
 <template>
   <div class="charts-container">
-    <iframe v-show="false" ref="iframeRef" :srcdoc="iframeHtml" @load="onIframeLoad"></iframe>
+    <iframe
+      v-show="false"
+      ref="iframeRef"
+      sandbox="allow-scripts"
+      :srcdoc="iframeHtml"
+      @load="onIframeLoad"
+    ></iframe>
     <div ref="chartsRef" :style="style" v-resize="onResize"></div>
   </div>
 </template>