ui: fix safeAttrValue

packages/ui-default/backendlib/markdown-it-xss.ts

@@ -1,4 +1,4 @@
-import { FilterXSS } from 'xss';
+import { FilterXSS, safeAttrValue } from 'xss';
 
 const stack = [];
 const voidTags = ['br', 'hr', 'input', 'img', 'link', 'source', 'col', 'area', 'base', 'meta', 'embed', 'param', 'track', 'wbr'];
@@ -111,9 +111,10 @@ export const xss = new FilterXSS({
   },
   allowCommentTag: false,
   stripIgnoreTagBody: ['script'],
-  safeAttrValue(tag, name, value) { // eslint-disable-line consistent-return
+  safeAttrValue(tag, name, value) {
     if (name === 'id') return `xss-id-${value}`;
     if (name === 'class') return value.replace(/badge/g, 'xss-badge');
+    return safeAttrValue(tag, name, value, this.cssFilter);
   },
 });
 
@@ -166,9 +167,10 @@ export const xssInline = new FilterXSS({
   allowCommentTag: false,
   stripIgnoreTag: true,
   stripIgnoreTagBody: ['script'],
-  safeAttrValue(tag, name, value) { // eslint-disable-line consistent-return
+  safeAttrValue(tag, name, value) {
     if (name === 'id') return `xss-id-${value}`;
     if (name === 'class') return value.replace(/badge/g, 'xss-badge');
+    return safeAttrValue(tag, name, value, this.cssFilter);
   },
 });
 

packages/ui-default/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.49.8",
+  "version": "4.49.9",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "index.ts",