clay-server 2.25.0-beta.2 → 2.25.1-beta.1

package/lib/public/modules/markdown.js

@@ -187,22 +187,18 @@ export function svgToPngDataUrl(svgEl) {
     var svgBlob = new Blob([svgStr], { type: "image/svg+xml;charset=utf-8" });
     var url = URL.createObjectURL(svgBlob);
 
-    // Inline external styles into SVG to avoid tainted canvas from cross-origin refs
-    var styleSheets = "";
-    try {
-      var computed = svgEl.querySelectorAll("style");
-      for (var si = 0; si < computed.length; si++) {
-        styleSheets += computed[si].textContent;
-      }
-    } catch (e) {}
-    // Strip any external references (url(), @import) that would taint the canvas
-    svgStr = svgStr.replace(/@import\s+url\([^)]*\)[^;]*;?/g, "");
+    // Strip all external references that would taint the canvas
+    // 1. @import rules
+    svgStr = svgStr.replace(/@import\s+[^;]*;?/g, "");
+    // 2. CSS url() pointing to external resources (keep data: and fragment-only refs)
+    svgStr = svgStr.replace(/url\(\s*['"]?(?!data:|#)([^'")]+)['"]?\s*\)/g, "url()");
+    // 3. xlink:href / href attributes pointing to external URLs
+    svgStr = svgStr.replace(/(xlink:href|href)\s*=\s*["'](?!#|data:)[^"']*["']/g, '$1=""');
     svgBlob = new Blob([svgStr], { type: "image/svg+xml;charset=utf-8" });
     URL.revokeObjectURL(url);
     url = URL.createObjectURL(svgBlob);
 
     var img = new Image();
-    img.crossOrigin = "anonymous";
     img.onload = function () {
       var canvas = document.createElement("canvas");
       canvas.width = w;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.25.0-beta.2",
+  "version": "2.25.1-beta.1",
   "description": "Self-hosted Claude Code in your browser. Multi-session, multi-user, push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",