@2kog/pkg-editor 0.0.3 → 0.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@2kog/pkg-editor",
-    "version": "0.0.3",
+    "version": "0.0.4",
     "description": "Custom Tinymce、Article Renderer",
     "scripts": {
         "serve": "npm run dev",
@@ -62,6 +62,6 @@
     },
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/2kog/pkg-editor.git"
+        "url": "git+https://github.com/RX-PLANET/pkg-editor.git"
     }
 }

package/src/assets/js/xss.js

@@ -33,7 +33,7 @@ export default function sanitizeRichText(html) {
         },
 
         allowedSchemes: ["http", "https", "mailto", "tel"],
-        allowProtocolRelative: false,
+        allowProtocolRelative: true,
         allowedSchemesByTag: { img: ["http", "https", "data"],iframe: ["http", "https"], },
 
         transformTags: {

package/src/components/Article.vue

@@ -125,11 +125,18 @@ export default {
     methods: {
         doReg: function (data) {
             if (data) {
-                // 过滤内容
-                data = execLazyload(data, this.cdnDomain);
-                data = execFilterIframe(data, this.iframeWhitelist);
+                // 1. 先执行 XSS 过滤（xss.js 已包含所有配置）
                 data = execFilterXSS(data);
+
+                // 2. 然后执行 iframe 白名单过滤
+                data = execFilterIframe(data, this.iframeWhitelist);
+
+                // 3. 处理图片懒加载
+                data = execLazyload(data, this.cdnDomain);
+
+                // 4. 最后处理链接
                 data = execFilterLink(data, this.linkWhitelist, this.linkStrict);
+
                 return data;
             } else {
                 return "";