feat: vtable-sheet support excel multiple sheets#4822
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // 自动更新表格 | ||
| if (options.autoTable && this._tableInstance) { | ||
| if (options.autoColumns) { | ||
| this._tableInstance.updateOption({ |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
General Approach:
To resolve the identified issue, the code should sanitize untrusted HTML before parsing it with DOMParser. This can be done by using a sanitization library (such as dompurify if available) to ensure only safe markup (or, more conservatively, only tables with no scripts/etc.) is parsed. This ensures that even if untrusted input contains scripts or dangerous tags, they are stripped or neutralized before parsing, preventing XSS regardless of later usage.
Detailed Remedy:
- In
ExcelImportPlugin._parseHTMLString, sanitize thetextinput beforeDOMParser.parseFromString, usingDOMPurify.sanitizeor equivalent. - Add an import for a standard HTML sanitization library (
dompurify) at the top of the filepackages/vtable-plugins/src/excel-import.ts. - Use
DOMPurify.sanitize(text, { ALLOWED_TAGS: ['table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td'] })to only allow table-related markup. - Update all
parseFromString(text, 'text/html')to use the sanitized string.
Required Changes:
- File:
packages/vtable-plugins/src/excel-import.ts- Add import for
dompurify(asDOMPurify). - Modify
_parseHTMLStringto sanitizetextbefore parsing.
- Add import for
Suggested changeset
2
packages/vtable-plugins/src/excel-import.ts
| @@ -4,7 +4,7 @@ | ||
| import { importExcelMultipleSheets, importCsvFile } from './excel-import/excel'; | ||
| import { applyImportToVTableSheet } from './excel-import/vtable-sheet'; | ||
| import type { ExcelImportOptions, ImportResult, MultiSheetImportResult } from './excel-import/types'; | ||
|
|
||
| import DOMPurify from 'dompurify'; | ||
| export type { ExcelImportOptions, ImportResult, MultiSheetImportResult, SheetData } from './excel-import/types'; | ||
|
|
||
| /** | ||
| @@ -652,8 +652,10 @@ | ||
| * 解析HTML字符串 | ||
| */ | ||
| private async _parseHTMLString(text: string, options: ExcelImportOptions): Promise<ImportResult> { | ||
| // Sanitize HTML to avoid XSS issues from untrusted input | ||
| const sanitized = DOMPurify.sanitize(text, { ALLOWED_TAGS: ['table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td'], ALLOWED_ATTR: [] }); | ||
| const parser = new DOMParser(); | ||
| const doc = parser.parseFromString(text, 'text/html'); | ||
| const doc = parser.parseFromString(sanitized, 'text/html'); | ||
| const table = doc.querySelector('table'); | ||
|
|
||
| if (!table) { |
packages/vtable-plugins/package.json
Outside changed files
| @@ -45,7 +45,8 @@ | ||
| "big.js": "6.2.2", | ||
| "exceljs": "4.4.0", | ||
| "file-saver": "2.0.5", | ||
| "@types/file-saver": "2.0.7" | ||
| "@types/file-saver": "2.0.7", | ||
| "dompurify": "^3.3.1" | ||
| }, | ||
| "peerDependencies": { | ||
| "@visactor/vtable": "workspace:*", |
This fix introduces these dependencies
| Package | Version | Security advisories |
| dompurify (npm) | 3.3.1 | None |
Copilot is powered by AI and may make mistakes. Always verify output.
…o feat/excel-multiply-sheet-import
Rui-Sun
approved these changes
Dec 16, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[中文版模板 / Chinese template]
🤔 This is a ...
🔗 Related issue link
💡 Background and solution
📝 Changelog
☑️ Self-Check before Merge
🚀 Summary
copilot:summary
🔍 Walkthrough
copilot:walkthrough