@difizen/libro-markdown 1.0.0 → 1.0.1

package/es/markdown-render.d.ts

@@ -9,6 +9,7 @@ export declare class MarkdownRender implements MarkdownParser {
     enablePermalink: boolean;
     protected configurationService: ConfigurationService;
     init(): void;
+    private sanitizeHTML;
     render(markdownText: string, options?: MarkdownRenderOption): string;
 }
 //# sourceMappingURL=markdown-render.d.ts.map

package/es/markdown-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown-render.d.ts","sourceRoot":"","sources":["../src/markdown-render.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,UAAU,MAAM,aAAa,CAAC;AAIrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,0BAA0B,CAAC;AAElC,qBACa,cAAe,YAAW,cAAc;IACnD,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;IAC1B,OAAO,wBAAW;IAClB,eAAe,UAAS;IACM,SAAS,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAGnF,IAAI;IAyDJ,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM;CAIrE"}
+{"version":3,"file":"markdown-render.d.ts","sourceRoot":"","sources":["../src/markdown-render.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,UAAU,MAAM,aAAa,CAAC;AAKrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,0BAA0B,CAAC;AAElC,qBACa,cAAe,YAAW,cAAc;IACnD,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;IAC1B,OAAO,wBAAW;IAClB,eAAe,UAAS;IACM,SAAS,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAGnF,IAAI;IA4DJ,OAAO,CAAC,YAAY;IAsDpB,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM;CAIrE"}

package/es/markdown-render.js

@@ -11,6 +11,7 @@ function _initializerWarningHelper(descriptor, context) { throw new Error('Decor
 import { ConfigurationService, inject, postConstruct, singleton } from '@difizen/libro-common/app';
 import latexPlugin from '@traptitech/markdown-it-katex';
 import MarkdownIt from 'markdown-it';
+import sanitizeHtml from 'sanitize-html';
 import { libroAnchor, linkInsideHeader, slugify } from "./anchor.js";
 import { LibroMarkdownConfiguration } from "./config.js";
 import { MarkdownParser } from "./markdown-protocol.js";
@@ -75,11 +76,26 @@ export var MarkdownRender = (_dec = singleton({
         //
       });
     }
+
+    // 使用 sanitize-html 清理 HTML
+  }, {
+    key: "sanitizeHTML",
+    value: function sanitizeHTML(html) {
+      return sanitizeHtml(html, {
+        allowedTags: sanitizeHtml.defaults.allowedTags.concat(['a', 'abbr', 'acronym', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'dd', 'del', 'div', 'em', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'q', 's', 'small', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'tr', 'tt', 'u', 'ul', 'kbd', 'var']),
+        // 允许的标签
+        allowedAttributes: {
+          // 允许的属性
+          a: ['href', 'title'],
+          img: ['src', 'alt']
+        }
+      });
+    }
   }, {
     key: "render",
     value: function render(markdownText, options) {
       var unsanitizedRenderedMarkdown = this.mkt.render(markdownText, options);
-      return unsanitizedRenderedMarkdown;
+      return this.sanitizeHTML(unsanitizedRenderedMarkdown);
     }
   }]);
   return MarkdownRender;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@difizen/libro-markdown",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "",
   "keywords": [
     "libro",
@@ -33,12 +33,16 @@
     "src"
   ],
   "dependencies": {
-    "@difizen/libro-common": "^1.0.0",
+    "@difizen/libro-common": "^1.0.1",
     "@traptitech/markdown-it-katex": "^3.6.0",
     "@types/markdown-it": "^12.2.3",
     "katex": "^0.16.10",
     "markdown-it": "^13.0.1",
-    "markdown-it-anchor": "^8.6.5"
+    "markdown-it-anchor": "^8.6.5",
+    "sanitize-html": "^2.14.0"
+  },
+  "devDependencies": {
+    "@types/sanitize-html": "^2.13.0"
   },
   "scripts": {
     "setup": "father build",

package/src/markdown-render.ts

@@ -6,6 +6,7 @@ import {
 } from '@difizen/libro-common/app';
 import latexPlugin from '@traptitech/markdown-it-katex';
 import MarkdownIt from 'markdown-it';
+import sanitizeHtml from 'sanitize-html';
 
 import { libroAnchor, linkInsideHeader, slugify } from './anchor.js';
 import { LibroMarkdownConfiguration } from './config.js';
@@ -32,7 +33,9 @@ export class MarkdownRender implements MarkdownParser {
       permalink: this.enablePermalink ? linkInsideHeader : false,
       slugify: this.slugify,
     });
+
     this.mkt.use(latexPlugin);
+
     this.configurationService
       .get(LibroMarkdownConfiguration.TargetToBlank)
       .then((value) => {
@@ -78,8 +81,63 @@ export class MarkdownRender implements MarkdownParser {
       });
   }
 
+  // 使用 sanitize-html 清理 HTML
+  private sanitizeHTML(html: string): string {
+    return sanitizeHtml(html, {
+      allowedTags: sanitizeHtml.defaults.allowedTags.concat([
+        'a',
+        'abbr',
+        'acronym',
+        'b',
+        'blockquote',
+        'br',
+        'code',
+        'col',
+        'colgroup',
+        'dd',
+        'del',
+        'div',
+        'em',
+        'h1',
+        'h2',
+        'h3',
+        'h4',
+        'h5',
+        'h6',
+        'hr',
+        'i',
+        'img',
+        'li',
+        'ol',
+        'p',
+        'pre',
+        'q',
+        's',
+        'small',
+        'strong',
+        'sub',
+        'sup',
+        'table',
+        'tbody',
+        'td',
+        'th',
+        'tr',
+        'tt',
+        'u',
+        'ul',
+        'kbd',
+        'var',
+      ]), // 允许的标签
+      allowedAttributes: {
+        // 允许的属性
+        a: ['href', 'title'],
+        img: ['src', 'alt'],
+      },
+    });
+  }
+
   render(markdownText: string, options?: MarkdownRenderOption): string {
     const unsanitizedRenderedMarkdown = this.mkt.render(markdownText, options);
-    return unsanitizedRenderedMarkdown;
+    return this.sanitizeHTML(unsanitizedRenderedMarkdown);
   }
 }