@evolvere/sgp-ui 1.6.7 → 1.6.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolvere/sgp-ui",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "description": "A Component Library for Vue.js.",
   "main": "lib/rdc-sgp-ui.common.js",
   "files": [
@@ -28,7 +28,7 @@
     "pub1": "npm run bootstrap && sh build/git-release.sh && sh build/release.sh && node build/bin/gen-indices.js && sh build/deploy-faas.sh",
     "test": "npm run lint && npm run build:theme && cross-env CI_ENV=/dev/ BABEL_ENV=test karma start test/unit/karma.conf.js --single-run",
     "test:watch": "npm run build:theme && cross-env BABEL_ENV=test karma start test/unit/karma.conf.js",
-    "pub": "npm run bootstrap && sh build/git-release.sh && sh build/release.sh && sh build/deploy-faas.sh"
+    "pub": "sh build/release.sh && sh build/deploy-faas.sh"
   },
   "faas": [
     {
@@ -67,7 +67,7 @@
     "normalize-wheel": "^1.0.1",
     "resize-observer-polyfill": "^1.5.0",
     "throttle-debounce": "^1.0.1",
-    "wangeditor": "~4.7.5",
+    "wangeditor": "4.7.15",
     "yakuza1": "^2.6.21"
   },
   "peerDependencies": {

package/packages/editor/src/index.vue

@@ -3,6 +3,8 @@
 </template>
 
 <script>
+import { validateOnlineVideo } from './video-security';
+
 let signIsEditorChange = true;
 export default {
   name: 'ElEditor',
@@ -81,6 +83,17 @@ export default {
       ...this.options
     };
 
+    // wangEditor 4 inserts online-video markup with insertHTML. Always run the
+    // built-in security check before an optional consumer-provided validator.
+    const customOnlineVideoCheck = editor.config.onlineVideoCheck;
+    editor.config.onlineVideoCheck = video => {
+      const securityCheck = validateOnlineVideo(video);
+      if (securityCheck !== true) return securityCheck;
+      return typeof customOnlineVideoCheck === 'function'
+        ? customOnlineVideoCheck(video)
+        : true;
+    };
+
     editor.config.onchange = newHtml => {
       // this.editorData = newHtml;
       signIsEditorChange = false;

package/packages/editor/src/video-security.js

@@ -0,0 +1,56 @@
+const ALLOWED_IFRAME_ATTRIBUTES = [
+  'allow',
+  'allowfullscreen',
+  'frameborder',
+  'height',
+  'loading',
+  'mozallowfullscreen',
+  'referrerpolicy',
+  'src',
+  'title',
+  'webkitallowfullscreen',
+  'width'
+];
+
+const INVALID_VIDEO_MESSAGE = '视频代码不安全，仅支持使用 http/https 地址的 iframe';
+
+function hasSafeSource(element) {
+  const source = (element.getAttribute('src') || '').trim();
+  if (!source) return false;
+
+  const parser = document.createElement('a');
+  parser.href = source;
+  return parser.protocol === 'http:' || parser.protocol === 'https:';
+}
+
+/**
+ * wangEditor 4 treats the online-video input as HTML rather than as a URL.
+ * Accept one tightly constrained iframe so attributes such as srcdoc/onload
+ * and sibling script elements cannot reach insertHTML.
+ */
+export function validateOnlineVideo(video) {
+  if (typeof video !== 'string') return INVALID_VIDEO_MESSAGE;
+
+  const container = document.createElement('div');
+  container.innerHTML = video.trim();
+
+  if (container.children.length !== 1 || container.childNodes.length !== 1) {
+    return INVALID_VIDEO_MESSAGE;
+  }
+
+  const iframe = container.firstElementChild;
+  if (!iframe || iframe.tagName !== 'IFRAME' || !hasSafeSource(iframe)) {
+    return INVALID_VIDEO_MESSAGE;
+  }
+
+  const attributes = Array.prototype.slice.call(iframe.attributes);
+  const hasUnsafeAttribute = attributes.some(attribute => (
+    ALLOWED_IFRAME_ATTRIBUTES.indexOf(attribute.name.toLowerCase()) === -1
+  ));
+
+  if (hasUnsafeAttribute || iframe.children.length > 0) {
+    return INVALID_VIDEO_MESSAGE;
+  }
+
+  return true;
+}

package/packages/theme-chalk/gulpfile.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const { series, src, dest } = require('gulp');
+const sass = require('gulp-sass');
+const autoprefixer = require('gulp-autoprefixer');
+const cssmin = require('gulp-cssmin');
+
+function compile() {
+  return src('./src/*.scss')
+    .pipe(sass.sync())
+    .pipe(autoprefixer({
+      browsers: ['ie > 9', 'last 2 versions'],
+      cascade: false
+    }))
+    .pipe(cssmin())
+    .pipe(dest('./lib'));
+}
+
+function copyfont() {
+  return src('./src/fonts/**')
+    .pipe(cssmin())
+    .pipe(dest('./lib/fonts'));
+}
+
+exports.build = series(compile, copyfont);

package/packages/theme-chalk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolvere/element-theme-chalk",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "description": "Element component chalk theme.",
   "main": "lib/index.css",
   "style": "lib/index.css",

package/src/index.js

@@ -212,7 +212,7 @@ if (typeof window !== 'undefined' && window.Vue) {
 }
 
 export default {
-  version: '1.6.7',
+  version: '1.6.8',
   locale: locale.use,
   i18n: locale.i18n,
   install,