Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-20 01:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

ui: fix xss

Browse Source
This commit is contained in:
undefined committed 2024-03-27 05:53:58 +08:00
1 parent 1fba7ebb38
commit 659c0f75be
1 file changed
+2 -6
Download Patch File Download Diff File Expand all files Collapse all files
packages/ui-default/backendlib/markdown-it-xss.ts
+2 -6
View File
@@ -111,11 +111,9 @@ export const xss = new FilterXSS({
}, },
allowCommentTag: false, allowCommentTag: false,
stripIgnoreTagBody: ['script'], stripIgnoreTagBody: ['script'],
safeAttrValue(tag, name, value) { safeAttrValue(tag, name, value) { // eslint-disable-line consistent-return
if (name === 'id') return `xss-id-${value}`; if (name === 'id') return `xss-id-${value}`;
if (name === 'class') return value.replace(/badge/g, 'xss-badge'); if (name === 'class') return value.replace(/badge/g, 'xss-badge');
if (name === 'href') return value.trim().startsWith('javascript:') ? '#' : value;
return value;
}, },
}); });
@@ -168,11 +166,9 @@ export const xssInline = new FilterXSS({
allowCommentTag: false, allowCommentTag: false,
stripIgnoreTag: true, stripIgnoreTag: true,
stripIgnoreTagBody: ['script'], stripIgnoreTagBody: ['script'],
safeAttrValue(tag, name, value) { safeAttrValue(tag, name, value) { // eslint-disable-line consistent-return
if (name === 'id') return `xss-id-${value}`; if (name === 'id') return `xss-id-${value}`;
if (name === 'class') return value.replace(/badge/g, 'xss-badge'); if (name === 'class') return value.replace(/badge/g, 'xss-badge');
if (name === 'href') return value.trim().startsWith('javascript:') ? '#' : value;
return value;
}, },
}); });