@befe/brick-comp-rich-text 0.2.53 → 0.2.54

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [0.2.54](https://icode.baidu.com/repos/baidu/be-fe/brick/merge/%40befe%2Fbrick-comp-rich-text%400.2.53...%40befe%2Fbrick-comp-rich-text%400.2.54) (2026-05-29)
+
+**Note:** Version bump only for package @befe/brick-comp-rich-text
+
+
+
+
+
 ## [0.2.53](https://icode.baidu.com:8235/baidu/be-fe/brick//%40befe%2Fbrick-comp-rich-text%400.2.52...%40befe%2Fbrick-comp-rich-text%400.2.53) (2026-05-25)
 
 **Note:** Version bump only for package @befe/brick-comp-rich-text

package/es/rich-text-view.js

@@ -1,9 +1,3 @@
-import _defineProperty from "@babel/runtime-corejs3/helpers/defineProperty";
-import _objectWithoutProperties from "@babel/runtime-corejs3/helpers/objectWithoutProperties";
-var _excluded = ["value", "className"];
-function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
-import _concatInstanceProperty from "@babel/runtime-corejs3/core-js-stable/instance/concat";
 import _Object$keys from "@babel/runtime-corejs3/core-js-stable/object/keys";
 import _Object$getOwnPropertySymbols from "@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols";
 import _filterInstanceProperty from "@babel/runtime-corejs3/core-js-stable/instance/filter";
@@ -12,26 +6,28 @@ import _forEachInstanceProperty from "@babel/runtime-corejs3/core-js-stable/inst
 import _Object$getOwnPropertyDescriptors from "@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptors";
 import _Object$defineProperties from "@babel/runtime-corejs3/core-js-stable/object/define-properties";
 import _Object$defineProperty from "@babel/runtime-corejs3/core-js-stable/object/define-property";
+import _defineProperty from "@babel/runtime-corejs3/helpers/defineProperty";
+import _objectWithoutProperties from "@babel/runtime-corejs3/helpers/objectWithoutProperties";
+var _excluded = ["value", "className"];
+function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
 import { forwardRef } from 'react';
 import cx from 'classnames';
-import sanitizeHtml from 'sanitize-html';
+import DOMPurify from 'dompurify';
 import { imagePreview } from '@befe/brick-comp-preview';
 import { jsx as _jsx } from "react/jsx-runtime";
 export var RichTextView = /*#__PURE__*/forwardRef(function (props, ref) {
-  var _context;
   var value = props.value,
     className = props.className,
     restProps = _objectWithoutProperties(props, _excluded);
   var classes = cx('brick-rich-text-view', {}, className);
   var sanitizedHtml = {
-    __html: sanitizeHtml(value || '', {
-      // 需要接受行内样式，姑且允许所有 attributes
-      allowedAttributes: false,
-      allowedSchemesByTag: {
-        img: ['data']
-      },
-      allowVulnerableTags: true,
-      allowedTags: _concatInstanceProperty(_context = sanitizeHtml.defaults.allowedTags).call(_context, ['img', 'style'])
+    __html: DOMPurify.sanitize(value || '', {
+      // 允许 <style> 标签（富文本编辑器产出内容含内联样式表）
+      ADD_TAGS: ['style'],
+      // 允许 img 使用 data: URI
+      ADD_DATA_URI_TAGS: ['img'],
+      FORCE_BODY: true
     })
   };
   var handleClick = function handleClick(e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@befe/brick-comp-rich-text",
-  "version": "0.2.53",
+  "version": "0.2.54",
   "repository": {
     "type": "git",
     "url": "ssh://git@icode.baidu.com:8235/baidu/be-fe/brick",
@@ -26,14 +26,14 @@
   "license": "ISC",
   "dependencies": {
     "@befe/brick-comp-button": "^0.2.96",
-    "@befe/brick-comp-drop-menu": "^0.2.111",
+    "@befe/brick-comp-drop-menu": "^0.2.112",
     "@befe/brick-comp-icon": "^0.2.93",
     "@befe/brick-comp-input": "^0.2.100",
     "@befe/brick-comp-link": "^0.2.93",
     "@befe/brick-comp-loading": "^0.2.94",
     "@befe/brick-comp-popper": "^0.2.97",
     "@befe/brick-comp-preview": "^0.2.31",
-    "@befe/brick-comp-select": "^0.2.115",
+    "@befe/brick-comp-select": "^0.2.116",
     "@befe/brick-comp-textarea": "^0.2.96",
     "@befe/brick-comp-toast": "^0.2.98",
     "@befe/brick-comp-upload": "^0.2.108",
@@ -58,9 +58,9 @@
     "@lexical/table": "^0.16.0",
     "@lexical/text": "^0.16.0",
     "@lexical/utils": "^0.16.0",
+    "dompurify": "^3.0.0",
     "lexical": "^0.16.0",
-    "react-color": "^2.19.3",
-    "sanitize-html": "^2.13.0"
+    "react-color": "^2.19.3"
   },
   "peerDependencies": {
     "classnames": "^2.0.0",
@@ -68,5 +68,5 @@
     "react": "^16.9.0 || ^17.0.0",
     "react-dom": "^16.9.0 || ^17.0.0"
   },
-  "gitHead": "b9584834398ed68526441721bf84bcd22022168e"
+  "gitHead": "762a207abaa9a1c1af35d7a2cafb2921aedd35ec"
 }

package/src/rich-text-view.tsx

@@ -1,6 +1,6 @@
 import {forwardRef, HTMLAttributes, MouseEvent} from 'react'
 import cx from 'classnames'
-import sanitizeHtml from 'sanitize-html'
+import DOMPurify from 'dompurify'
 import {imagePreview} from '@befe/brick-comp-preview'
 
 export interface RichTextViewProps extends HTMLAttributes<HTMLDivElement> {
@@ -24,12 +24,12 @@ export const RichTextView = forwardRef<HTMLDivElement, RichTextViewProps>((props
     )
 
     const sanitizedHtml = {
-        __html: sanitizeHtml(value || '', {
-            // 需要接受行内样式，姑且允许所有 attributes
-            allowedAttributes: false,
-            allowedSchemesByTag: {img: ['data']},
-            allowVulnerableTags: true,
-            allowedTags: sanitizeHtml.defaults.allowedTags.concat(['img', 'style']),
+        __html: DOMPurify.sanitize(value || '', {
+            // 允许 <style> 标签（富文本编辑器产出内容含内联样式表）
+            ADD_TAGS: ['style'],
+            // 允许 img 使用 data: URI
+            ADD_DATA_URI_TAGS: ['img'],
+            FORCE_BODY: true,
         }),
     }