@evolvere/sgp-ui 1.6.7 → 1.6.9

package/lib/scrollbar.js

@@ -82,12 +82,12 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 138);
+/******/ 	return __webpack_require__(__webpack_require__.s = 139);
 /******/ })
 /************************************************************************/
 /******/ ({
 
-/***/ 138:
+/***/ 139:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/select.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 67);
+/******/ 	return __webpack_require__(__webpack_require__.s = 68);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -531,7 +531,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/locale");
 
 /***/ }),
 
-/***/ 67:
+/***/ 68:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/skeleton-item.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 73);
+/******/ 	return __webpack_require__(__webpack_require__.s = 74);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 73:
+/***/ 74:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/skeleton.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 133);
+/******/ 	return __webpack_require__(__webpack_require__.s = 134);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 133:
+/***/ 134:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/slider.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 69);
+/******/ 	return __webpack_require__(__webpack_require__.s = 70);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -213,7 +213,7 @@ module.exports = require("@evolvere/sgp-ui/lib/input-number");
 
 /***/ }),
 
-/***/ 69:
+/***/ 70:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/spinner.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 110);
+/******/ 	return __webpack_require__(__webpack_require__.s = 111);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 110:
+/***/ 111:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/step.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 115);
+/******/ 	return __webpack_require__(__webpack_require__.s = 116);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 115:
+/***/ 116:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/steps.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 114);
+/******/ 	return __webpack_require__(__webpack_require__.s = 115);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -199,7 +199,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/migrating");
 
 /***/ }),
 
-/***/ 114:
+/***/ 115:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/submenu.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 136);
+/******/ 	return __webpack_require__(__webpack_require__.s = 137);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 136:
+/***/ 137:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/switch.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 99);
+/******/ 	return __webpack_require__(__webpack_require__.s = 100);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,28 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 11:
-/***/ (function(module, exports) {
-
-module.exports = require("@evolvere/sgp-ui/lib/mixins/migrating");
-
-/***/ }),
-
-/***/ 23:
-/***/ (function(module, exports) {
-
-module.exports = require("@evolvere/sgp-ui/lib/mixins/focus");
-
-/***/ }),
-
-/***/ 4:
-/***/ (function(module, exports) {
-
-module.exports = require("@evolvere/sgp-ui/lib/mixins/emitter");
-
-/***/ }),
-
-/***/ 99:
+/***/ 100:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -547,6 +526,27 @@ src_component.install = function (Vue) {
 
 /* harmony default export */ var packages_switch = __webpack_exports__["default"] = (src_component);
 
+/***/ }),
+
+/***/ 11:
+/***/ (function(module, exports) {
+
+module.exports = require("@evolvere/sgp-ui/lib/mixins/migrating");
+
+/***/ }),
+
+/***/ 23:
+/***/ (function(module, exports) {
+
+module.exports = require("@evolvere/sgp-ui/lib/mixins/focus");
+
+/***/ }),
+
+/***/ 4:
+/***/ (function(module, exports) {
+
+module.exports = require("@evolvere/sgp-ui/lib/mixins/emitter");
+
 /***/ })
 
 /******/ });

package/lib/tab-pane.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 106);
+/******/ 	return __webpack_require__(__webpack_require__.s = 107);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 106:
+/***/ 107:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/table-column.js

@@ -82,12 +82,12 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 142);
+/******/ 	return __webpack_require__(__webpack_require__.s = 143);
 /******/ })
 /************************************************************************/
 /******/ ({
 
-/***/ 142:
+/***/ 143:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/table.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 63);
+/******/ 	return __webpack_require__(__webpack_require__.s = 64);
 /******/ })
 /************************************************************************/
 /******/ ([
@@ -637,7 +637,8 @@ module.exports = require("normalize-wheel");
 /* 60 */,
 /* 61 */,
 /* 62 */,
-/* 63 */
+/* 63 */,
+/* 64 */
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/tabs.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 68);
+/******/ 	return __webpack_require__(__webpack_require__.s = 69);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -206,7 +206,7 @@ module.exports = require("@evolvere/sgp-ui/lib/utils/util");
 
 /***/ }),
 
-/***/ 68:
+/***/ 69:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/tag.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 137);
+/******/ 	return __webpack_require__(__webpack_require__.s = 138);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 137:
+/***/ 138:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/time-picker.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 82);
+/******/ 	return __webpack_require__(__webpack_require__.s = 83);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -2444,7 +2444,7 @@ module.exports = require("vue");
 
 /***/ }),
 
-/***/ 82:
+/***/ 83:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/time-select.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 81);
+/******/ 	return __webpack_require__(__webpack_require__.s = 82);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -1379,7 +1379,7 @@ module.exports = require("vue");
 
 /***/ }),
 
-/***/ 81:
+/***/ 82:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/timeline-item.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 126);
+/******/ 	return __webpack_require__(__webpack_require__.s = 127);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 126:
+/***/ 127:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/timeline.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 139);
+/******/ 	return __webpack_require__(__webpack_require__.s = 140);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 139:
+/***/ 140:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/tooltip.js

@@ -82,12 +82,12 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 144);
+/******/ 	return __webpack_require__(__webpack_require__.s = 145);
 /******/ })
 /************************************************************************/
 /******/ ({
 
-/***/ 144:
+/***/ 145:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/transfer.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 71);
+/******/ 	return __webpack_require__(__webpack_require__.s = 72);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -241,7 +241,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/locale");
 
 /***/ }),
 
-/***/ 71:
+/***/ 72:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/tree.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 65);
+/******/ 	return __webpack_require__(__webpack_require__.s = 66);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -234,7 +234,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/emitter");
 
 /***/ }),
 
-/***/ 65:
+/***/ 66:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/upload.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 64);
+/******/ 	return __webpack_require__(__webpack_require__.s = 65);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -241,7 +241,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/locale");
 
 /***/ }),
 
-/***/ 64:
+/***/ 65:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolvere/sgp-ui",
-  "version": "1.6.7",
+  "version": "1.6.9",
   "description": "A Component Library for Vue.js.",
   "main": "lib/rdc-sgp-ui.common.js",
   "files": [
@@ -28,7 +28,7 @@
     "pub1": "npm run bootstrap && sh build/git-release.sh && sh build/release.sh && node build/bin/gen-indices.js && sh build/deploy-faas.sh",
     "test": "npm run lint && npm run build:theme && cross-env CI_ENV=/dev/ BABEL_ENV=test karma start test/unit/karma.conf.js --single-run",
     "test:watch": "npm run build:theme && cross-env BABEL_ENV=test karma start test/unit/karma.conf.js",
-    "pub": "npm run bootstrap && sh build/git-release.sh && sh build/release.sh && sh build/deploy-faas.sh"
+    "pub": "sh build/release.sh"
   },
   "faas": [
     {
@@ -67,7 +67,7 @@
     "normalize-wheel": "^1.0.1",
     "resize-observer-polyfill": "^1.5.0",
     "throttle-debounce": "^1.0.1",
-    "wangeditor": "~4.7.5",
+    "wangeditor": "4.7.15",
     "yakuza1": "^2.6.21"
   },
   "peerDependencies": {

package/packages/editor/src/index.vue

@@ -3,6 +3,8 @@
 </template>
 
 <script>
+import { validateOnlineVideo } from './video-security';
+
 let signIsEditorChange = true;
 export default {
   name: 'ElEditor',
@@ -81,6 +83,17 @@ export default {
       ...this.options
     };
 
+    // wangEditor 4 inserts online-video markup with insertHTML. Always run the
+    // built-in security check before an optional consumer-provided validator.
+    const customOnlineVideoCheck = editor.config.onlineVideoCheck;
+    editor.config.onlineVideoCheck = video => {
+      const securityCheck = validateOnlineVideo(video);
+      if (securityCheck !== true) return securityCheck;
+      return typeof customOnlineVideoCheck === 'function'
+        ? customOnlineVideoCheck(video)
+        : true;
+    };
+
     editor.config.onchange = newHtml => {
       // this.editorData = newHtml;
       signIsEditorChange = false;

package/packages/editor/src/video-security.js

@@ -0,0 +1,56 @@
+const ALLOWED_IFRAME_ATTRIBUTES = [
+  'allow',
+  'allowfullscreen',
+  'frameborder',
+  'height',
+  'loading',
+  'mozallowfullscreen',
+  'referrerpolicy',
+  'src',
+  'title',
+  'webkitallowfullscreen',
+  'width'
+];
+
+const INVALID_VIDEO_MESSAGE = '视频代码不安全，仅支持使用 http/https 地址的 iframe';
+
+function hasSafeSource(element) {
+  const source = (element.getAttribute('src') || '').trim();
+  if (!source) return false;
+
+  const parser = document.createElement('a');
+  parser.href = source;
+  return parser.protocol === 'http:' || parser.protocol === 'https:';
+}
+
+/**
+ * wangEditor 4 treats the online-video input as HTML rather than as a URL.
+ * Accept one tightly constrained iframe so attributes such as srcdoc/onload
+ * and sibling script elements cannot reach insertHTML.
+ */
+export function validateOnlineVideo(video) {
+  if (typeof video !== 'string') return INVALID_VIDEO_MESSAGE;
+
+  const container = document.createElement('div');
+  container.innerHTML = video.trim();
+
+  if (container.children.length !== 1 || container.childNodes.length !== 1) {
+    return INVALID_VIDEO_MESSAGE;
+  }
+
+  const iframe = container.firstElementChild;
+  if (!iframe || iframe.tagName !== 'IFRAME' || !hasSafeSource(iframe)) {
+    return INVALID_VIDEO_MESSAGE;
+  }
+
+  const attributes = Array.prototype.slice.call(iframe.attributes);
+  const hasUnsafeAttribute = attributes.some(attribute => (
+    ALLOWED_IFRAME_ATTRIBUTES.indexOf(attribute.name.toLowerCase()) === -1
+  ));
+
+  if (hasUnsafeAttribute || iframe.children.length > 0) {
+    return INVALID_VIDEO_MESSAGE;
+  }
+
+  return true;
+}

package/packages/theme-chalk/gulpfile.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const { series, src, dest } = require('gulp');
+const sass = require('gulp-sass');
+const autoprefixer = require('gulp-autoprefixer');
+const cssmin = require('gulp-cssmin');
+
+function compile() {
+  return src('./src/*.scss')
+    .pipe(sass.sync())
+    .pipe(autoprefixer({
+      browsers: ['ie > 9', 'last 2 versions'],
+      cascade: false
+    }))
+    .pipe(cssmin())
+    .pipe(dest('./lib'));
+}
+
+function copyfont() {
+  return src('./src/fonts/**')
+    .pipe(cssmin())
+    .pipe(dest('./lib/fonts'));
+}
+
+exports.build = series(compile, copyfont);

package/packages/theme-chalk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolvere/element-theme-chalk",
-  "version": "1.6.7",
+  "version": "1.6.9",
   "description": "Element component chalk theme.",
   "main": "lib/index.css",
   "style": "lib/index.css",

package/src/index.js

@@ -212,7 +212,7 @@ if (typeof window !== 'undefined' && window.Vue) {
 }
 
 export default {
-  version: '1.6.7',
+  version: '1.6.9',
   locale: locale.use,
   i18n: locale.i18n,
   install,