@difizen/libro-markdown 0.3.4 → 0.3.5

package/es/markdown-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown-render.d.ts","sourceRoot":"","sources":["../src/markdown-render.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAIrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,UAAU,MAAM,aAAa,CAAC;AAIrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,0BAA0B,CAAC;AAElC,qBACa,cAAe,YAAW,cAAc;IACnD,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;IAC1B,OAAO,wBAAW;IAClB,eAAe,UAAS;IACM,SAAS,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAGnF,IAAI;IAyDJ,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM;CAIrE"}
+{"version":3,"file":"markdown-render.d.ts","sourceRoot":"","sources":["../src/markdown-render.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAIrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,UAAU,MAAM,aAAa,CAAC;AAKrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,0BAA0B,CAAC;AAElC,qBACa,cAAe,YAAW,cAAc;IACnD,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;IAC1B,OAAO,wBAAW;IAClB,eAAe,UAAS;IACM,SAAS,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAGnF,IAAI;IAgEJ,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM;CAIrE"}

package/es/markdown-render.js

@@ -11,6 +11,7 @@ function _initializerWarningHelper(descriptor, context) { throw new Error('Decor
 import { ConfigurationService, inject, postConstruct, singleton } from '@difizen/mana-app';
 import latexPlugin from '@traptitech/markdown-it-katex';
 import MarkdownIt from 'markdown-it';
+import MarkdownItSanitizer from 'markdown-it-sanitizer';
 import { libroAnchor, linkInsideHeader, slugify } from "./anchor.js";
 import { LibroMarkdownConfiguration } from "./config.js";
 import { MarkdownParser } from "./markdown-protocol.js";
@@ -44,6 +45,15 @@ export var MarkdownRender = (_dec = singleton({
         slugify: this.slugify
       });
       this.mkt.use(latexPlugin);
+      this.mkt.use(MarkdownItSanitizer, {
+        allowedTags: ['p', 'a', 'img', 'strong', 'em'],
+        // 允许的标签
+        allowedAttributes: {
+          a: ['href', 'target'],
+          // 允许的属性
+          img: ['src', 'alt']
+        }
+      });
       this.configurationService.get(LibroMarkdownConfiguration.TargetToBlank).then(function (value) {
         if (value) {
           _this.mkt.use(function (md) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@difizen/libro-markdown",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "",
   "keywords": [
     "libro",
@@ -39,7 +39,11 @@
     "@types/markdown-it": "^12.2.3",
     "katex": "^0.16.10",
     "markdown-it": "^13.0.1",
-    "markdown-it-anchor": "^8.6.5"
+    "markdown-it-anchor": "^8.6.5",
+    "sanitize-html": "^2.14.0"
+  },
+  "devDependencies": {
+    "@types/sanitize-html": "^2.13.0"
   },
   "scripts": {
     "setup": "father build",

package/src/markdown-render.ts

@@ -6,6 +6,7 @@ import {
 } from '@difizen/mana-app';
 import latexPlugin from '@traptitech/markdown-it-katex';
 import MarkdownIt from 'markdown-it';
+import sanitizeHtml from 'sanitize-html';
 
 import { libroAnchor, linkInsideHeader, slugify } from './anchor.js';
 import { LibroMarkdownConfiguration } from './config.js';
@@ -32,7 +33,9 @@ export class MarkdownRender implements MarkdownParser {
       permalink: this.enablePermalink ? linkInsideHeader : false,
       slugify: this.slugify,
     });
+
     this.mkt.use(latexPlugin);
+
     this.configurationService
       .get(LibroMarkdownConfiguration.TargetToBlank)
       .then((value) => {
@@ -78,8 +81,63 @@ export class MarkdownRender implements MarkdownParser {
       });
   }
 
+  // 使用 sanitize-html 清理 HTML
+  private sanitizeHTML(html: string): string {
+    return sanitizeHtml(html, {
+      allowedTags: sanitizeHtml.defaults.allowedTags.concat([
+        'a',
+        'abbr',
+        'acronym',
+        'b',
+        'blockquote',
+        'br',
+        'code',
+        'col',
+        'colgroup',
+        'dd',
+        'del',
+        'div',
+        'em',
+        'h1',
+        'h2',
+        'h3',
+        'h4',
+        'h5',
+        'h6',
+        'hr',
+        'i',
+        'img',
+        'li',
+        'ol',
+        'p',
+        'pre',
+        'q',
+        's',
+        'small',
+        'strong',
+        'sub',
+        'sup',
+        'table',
+        'tbody',
+        'td',
+        'th',
+        'tr',
+        'tt',
+        'u',
+        'ul',
+        'kbd',
+        'var',
+      ]), // 允许的标签
+      allowedAttributes: {
+        // 允许的属性
+        a: ['href', 'title'],
+        img: ['src', 'alt'],
+      },
+    });
+  }
+
   render(markdownText: string, options?: MarkdownRenderOption): string {
     const unsanitizedRenderedMarkdown = this.mkt.render(markdownText, options);
-    return unsanitizedRenderedMarkdown;
+    return this.sanitizeHTML(unsanitizedRenderedMarkdown);
   }
 }