fix: review

Author: hexqi

packages/plugins/robot/src/mcp/MarkdownRenderer.vue

@@ -44,24 +44,23 @@ const props = defineProps({
 
 const themeClass = computed(() => `hljs-theme-${props.theme}`)
 
+const escapeHtml = (s: string) =>
+  s.replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch]!))
+
 const markdownIt = new MarkdownIt({
   html: true,
   breaks: true,
   typographer: true,
   highlight: (str: string, lang: string) => {
     if (lang && hljs.getLanguage(lang)) {
       try {
-        return `<pre class="hljs"><code>${
-          hljs.highlight(str, {
-            language: lang,
-            ignoreIllegals: true
-          }).value
-        }</code></pre>`
+        const { value } = hljs.highlight(str, { language: lang, ignoreIllegals: true })
+        return `<pre class="hljs"><code class="language-${lang}">${value}</code></pre>`
       } catch (e) {
         /* ignore */
       }
     }
-    return `<pre class="hljs"><code>${DOMPurify.sanitize(str)}</code></pre>`
+    return `<pre class="hljs"><code>${escapeHtml(str)}</code></pre>`
   },
   ...props.options
 })
@@ -88,17 +87,13 @@ const renderContent = computed(() => {
   // TODO: 适配TInyEngine主题，实现跟随主题自动切换
   /* 亮色主题 */
   &.hljs-theme-light {
-    @import 'highlight.js/styles/github.css';
-
     pre {
       background-color: #f6f8fa;
     }
   }
 
   /* 暗色主题 */
   &.hljs-theme-dark {
-    @import 'highlight.js/styles/github-dark.css';
-
     pre {
       background-color: #0d1117;
     }