Skip to content

fix: Markdown editor xss attack #4553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shaohuzhang1 merged 1 commit into from
Dec 23, 2025
Merged

fix: Markdown editor xss attack #4553

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ui/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@
"nprogress": "^0.2.0",
"pinia": "^3.0.1",
"recorder-core": "^1.3.25011100",
"sanitize-html": "^2.17.0",
"screenfull": "^6.0.2",
"sortablejs": "^1.15.6",
"svg2pdf.js": "^2.5.0",
Expand Down
13 changes: 8 additions & 5 deletions ui/src/components/markdown/MdEditor.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<template>
<MdEditor :language="language" noIconfont noPrettier v-bind="$attrs">
<MdEditor :language="language" noIconfont noPrettier v-bind="$attrs" :sanitize="sanitize">
<template #defFooters>
<slot name="defFooters"> </slot>
</template>
Expand All @@ -13,14 +13,17 @@ import { getBrowserLang } from '@/locales/index'
import './assets/markdown-iconfont.js'
// 引入公共库中的语言配置
import ZH_TW from '@vavt/cm-extension/dist/locale/zh-TW'

import sanitizeHtml from 'sanitize-html'
defineOptions({ name: 'MdEditor' })
const language = computed(() => localStorage.getItem('MaxKB-locale') || getBrowserLang() || '')
config({
editorConfig: {
languageUserDefined: {
'zh-Hant': ZH_TW
}
}
'zh-Hant': ZH_TW,
},
},
})
const sanitize = (html: any) => {
return sanitizeHtml(html)
}
</script>
14 changes: 12 additions & 2 deletions ui/src/components/markdown/MdPreview.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
<template>
<MdPreview :language="language" noIconfont noPrettier :codeFoldable="false" v-bind="$attrs" />
<MdPreview
:language="language"
noIconfont
noPrettier
:sanitize="sanitize"
:codeFoldable="false"
v-bind="$attrs"
/>
</template>

<script setup lang="ts">
Expand All @@ -9,7 +16,7 @@ import { getBrowserLang } from '@/locales/index'
import useStore from '@/stores'
// 引入公共库中的语言配置
import ZH_TW from '@vavt/cm-extension/dist/locale/zh-TW'

import sanitizeHtml from 'sanitize-html'
defineOptions({ name: 'MdPreview' })

const emit = defineEmits(['clickPreview'])
Expand All @@ -23,6 +30,9 @@ config({
},
},
})
const sanitize = (html: any) => {
return sanitizeHtml(html)
}
</script>

<style lang="scss" scoped>
Expand Down
Loading