@ezuikit/player-theme 3.1.7-beta.4 → 3.1.8-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/constant.js CHANGED
@@ -1,6 +1,6 @@
1
1
  /*
2
- * @ezuikit/player-theme v3.1.7-beta.4
3
- * Copyright (c) 2026-09-28 08:24:45 Ezviz-OpenBiz
2
+ * @ezuikit/player-theme v3.1.8-beta.2
3
+ * Copyright (c) 2026-10-10 15:37:05 Ezviz-OpenBiz
4
4
  * Released under the MIT License.
5
5
  */
6
6
  function _extends() {
package/dist/index.cjs CHANGED
@@ -1,6 +1,6 @@
1
1
  /*
2
- * @ezuikit/player-theme v3.1.7-beta.4
3
- * Copyright (c) 2026-09-28 08:24:45 Ezviz-OpenBiz
2
+ * @ezuikit/player-theme v3.1.8-beta.2
3
+ * Copyright (c) 2026-10-10 15:37:05 Ezviz-OpenBiz
4
4
  * Released under the MIT License.
5
5
  */
6
6
  'use strict';
@@ -445,20 +445,22 @@ function _set_prototype_of$z(o, p) {
445
445
  /**
446
446
  * 销毁控件
447
447
  */ _proto.destroy = function destroy() {
448
- var _this___options, _this_$container_remove, _this_$container;
448
+ var _this___options, _this_$container, _this_$container_remove, _this_$container1;
449
449
  if (this._camelCaseName) {
450
450
  this.emit("Control." + this._camelCaseName + "Destroy");
451
451
  }
452
- if (((_this___options = this.__options) == null ? void 0 : _this___options.controlType) !== 'block') this.$container.removeEventListener('dblclick', this._onDBlClick);
452
+ // 用可选链与下面的 click 解绑保持一致:destroy() 之后 $container 会被置空,
453
+ // 重复 destroy(例如主题卸载控件后调用方又手动销毁一次)不应抛错
454
+ if (((_this___options = this.__options) == null ? void 0 : _this___options.controlType) !== 'block') (_this_$container = this.$container) == null ? void 0 : _this_$container.removeEventListener('dblclick', this._onDBlClick);
453
455
  // 移除 click 监听
454
456
  if (this._onClickHandler) {
455
- var _this_$container1;
456
- (_this_$container1 = this.$container) == null ? void 0 : _this_$container1.removeEventListener('click', this._onClickHandler);
457
+ var _this_$container2;
458
+ (_this_$container2 = this.$container) == null ? void 0 : _this_$container2.removeEventListener('click', this._onClickHandler);
457
459
  this._onClickHandler = null;
458
460
  }
459
461
  this._active = false;
460
462
  this.removeAllListeners();
461
- (_this_$container = this.$container) == null ? void 0 : (_this_$container_remove = _this_$container.remove) == null ? void 0 : _this_$container_remove.call(_this_$container);
463
+ (_this_$container1 = this.$container) == null ? void 0 : (_this_$container_remove = _this_$container1.remove) == null ? void 0 : _this_$container_remove.call(_this_$container1);
462
464
  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
463
465
  this.$container = null;
464
466
  };
@@ -568,6 +570,45 @@ function _set_prototype_of$z(o, p) {
568
570
  * ```
569
571
  */ Control.supportedPlayTypes = [].concat(PLAY_TYPES);
570
572
 
573
+ /**
574
+ * HTML 转义
575
+ *
576
+ * 控件大量使用「模板字符串拼 HTML + innerHTML」的写法,只要拼进去的值来自
577
+ * 播放地址、接口返回或多语言配置,就存在注入风险。能改用 `textContent` /
578
+ * `createElement` 的地方应优先改用 DOM API;确实需要拼字符串时,所有外部
579
+ * 数据都必须先过这个函数。
580
+ *
581
+ * 同时覆盖两种语境:
582
+ * - 文本内容:`<span>${escapeHtml(v)}</span>`
583
+ * - 属性值:`<span title="${escapeHtml(v)}">`
584
+ *
585
+ * @remarks 用一次 `replace` 扫描完成,不存在「先转 `&` 再转其他」导致的二次转义。
586
+ */ /** 需要转义的字符与对应实体 */ var HTML_ESCAPE_MAP = {
587
+ '&': '&amp;',
588
+ '<': '&lt;',
589
+ '>': '&gt;',
590
+ '"': '&quot;',
591
+ "'": '&#39;'
592
+ };
593
+ /**
594
+ * 转义 HTML 中有特殊含义的字符
595
+ *
596
+ * @param value - 任意值,`null` / `undefined` 归一成空字符串
597
+ * @returns 可安全拼进 HTML 文本或双引号属性值的字符串
598
+ * @since 3.1.8
599
+ * @example
600
+ * ```ts
601
+ * escapeHtml('x" onerror="alert(1)'); // 'x&quot; onerror=&quot;alert(1)'
602
+ * escapeHtml('<img src=x>'); // '&lt;img src=x&gt;'
603
+ * escapeHtml(undefined); // ''
604
+ * ```
605
+ */ function escapeHtml(value) {
606
+ if (value === null || value === undefined) return '';
607
+ return String(value).replace(/[&<>"']/g, function(char) {
608
+ return HTML_ESCAPE_MAP[char];
609
+ });
610
+ }
611
+
571
612
  function _extends$y() {
572
613
  _extends$y = Object.assign || function assign(target) {
573
614
  for(var i = 1; i < arguments.length; i++){
@@ -623,11 +664,13 @@ var LOADING_DEFAULT_OPTIONS = {};
623
664
  this.$container.innerHTML = this._options.render();
624
665
  } else {
625
666
  var _this_locale;
626
- this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + "-loading-dot " + PREFIX_CLASS + '-loading-dot-load">\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n </span>\n <div class="' + PREFIX_CLASS + '-loading-text">' + (((_this_locale = this.locale) == null ? void 0 : _this_locale.LOADING) || 'loading...') + "</div>\n ";
667
+ this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + "-loading-dot " + PREFIX_CLASS + '-loading-dot-load">\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n </span>\n <div class="' + PREFIX_CLASS + '-loading-text">' + escapeHtml(((_this_locale = this.locale) == null ? void 0 : _this_locale.LOADING) || 'loading...') + "</div>\n ";
627
668
  }
628
669
  };
629
670
  /**
630
671
  * 动画展示
672
+ *
673
+ * @remarks `html` 会原样写入 `innerHTML`,**不做转义**,仅接受可信内容。
631
674
  * @param html 自定义动画内容, 如果不存在则使用默认动画
632
675
  */ _proto.show = function show(html) {
633
676
  if (html) this.$container.innerHTML = html;
@@ -716,16 +759,21 @@ var POSTER_OPTIONS = {
716
759
  * 设置封面 这里不对 poster 进行缓存,如果有值优先使用,如果没有值优先使用 初始化传入的值
717
760
  * @param {string} poster 封面地址或 base64 数据
718
761
  */ _proto.setPoster = function setPoster(poster) {
719
- var // eslint-disable-next-line @typescript-eslint/unbound-method
720
- // prettier-ignore
721
- _this_$container_querySelector;
722
762
  poster = poster != null ? poster : this._options.poster;
723
- if (poster === '') {
724
- this.$container.innerHTML = '';
763
+ // 空值一律清空。原先只判 `=== ''`,poster 为 undefined 时会渲染出
764
+ // `<img src="undefined">`,浏览器会去请求 ./undefined 再触发 error 回调
765
+ if (!poster) {
766
+ this.$container.replaceChildren();
725
767
  return;
726
768
  }
727
- this.$container.innerHTML = '<img class="' + PREFIX_CLASS + '-poster-img" src="' + poster + '" />';
728
- (_this_$container_querySelector = this.$container.querySelector("." + PREFIX_CLASS + "-poster-img")) == null ? void 0 : _this_$container_querySelector.addEventListener("error", this._imgLoadErrorEvent);
769
+ // 用 DOM API 而不是拼 innerHTML:封面地址可能来自远程模板接口或业务动态传入,
770
+ // 拼进 src="${poster}" 时 `x" onerror="...` 能闭合属性挂上事件处理器
771
+ var $img = document.createElement('img');
772
+ $img.className = "" + PREFIX_CLASS + "-poster-img";
773
+ $img.src = poster;
774
+ // eslint-disable-next-line @typescript-eslint/unbound-method
775
+ $img.addEventListener('error', this._imgLoadErrorEvent);
776
+ this.$container.replaceChildren($img);
729
777
  };
730
778
  /**
731
779
  * 展示封面 这里不对 poster 进行缓存, 如果有值优先使用, 如果没有值优先使用 初始化传入的值
@@ -785,7 +833,9 @@ var Icons = {
785
833
  return '<svg width="1em" height="1em" viewBox="0 0 24 24" focusable="false" aria-hidden="true" data-icon="talk-growth">\n <g fill="currentColor" stroke="currentColor">\n <path stroke="none" d="M9.22313 18.9543C9.6588 18.9543 10.0189 19.2133 10.0759 19.5494L10.0837 19.6428L10.0837 21.7847C10.0837 22.1649 9.69841 22.4732 9.22313 22.4732C8.78745 22.4732 8.42739 22.2142 8.37041 21.8781L8.36255 21.7847L8.36255 19.6428C8.36255 19.2626 8.74784 18.9543 9.22313 18.9543Z" fill-rule="evenodd" />\n <path d="M16.5323 11.3779L16.5323 11.5872C16.5323 15.7472 13.1599 19.1197 8.99981 19.1197C4.83971 19.1197 1.46729 15.7472 1.46729 11.5872L1.46729 11.4335" fill-rule="evenodd" fill="none" stroke-width="1.5" />\n <path stroke="none" d="M4.07861 6.12978C4.07861 3.589 6.30476 1.5293 9.05085 1.5293C11.7969 1.5293 14.0231 3.589 14.0231 6.12978L14.0231 12.075C14.0231 14.6158 11.7969 16.6755 9.05085 16.6755C6.30476 16.6755 4.07861 14.6158 4.07861 12.075L4.07861 6.12978ZM5.57861 12.075L5.57861 6.12978C5.57861 5.94083 5.597 5.75561 5.63376 5.57412C5.67605 5.36539 5.74265 5.16158 5.83357 4.9627C5.86625 4.8912 5.90164 4.82121 5.93974 4.75272C6.09781 4.4685 6.30245 4.21019 6.55365 3.97777C6.64206 3.89597 6.73424 3.81921 6.83019 3.7475C7.0816 3.55959 7.3589 3.40632 7.66207 3.28767C7.79552 3.23545 7.93107 3.19114 8.06871 3.15475C8.38503 3.07111 8.71241 3.0293 9.05085 3.0293C9.38929 3.0293 9.71668 3.07112 10.033 3.15475C10.1706 3.19114 10.3062 3.23545 10.4396 3.28767C10.7428 3.40632 11.0201 3.55959 11.2715 3.74749C11.3675 3.81921 11.4596 3.89596 11.548 3.97777C11.7993 4.2102 12.0039 4.46853 12.162 4.75276C12.2001 4.82124 12.2354 4.89122 12.2681 4.9627C12.359 5.16157 12.4256 5.36536 12.4679 5.57407C12.5047 5.75558 12.5231 5.94082 12.5231 6.12978L12.5231 12.075C12.5231 12.264 12.5047 12.4492 12.4679 12.6307C12.4256 12.8394 12.359 13.0432 12.2681 13.2421C12.2355 13.3136 12.2001 13.3835 12.162 13.452C12.0039 13.7362 11.7993 13.9946 11.548 14.227C11.4596 14.3088 11.3675 14.3856 11.2715 14.4573C11.0201 14.6452 10.7428 14.7985 10.4396 14.9171C10.3062 14.9693 10.1706 15.0136 10.033 15.05C9.71667 15.1337 9.38929 15.1755 9.05085 15.1755C8.71241 15.1755 8.38503 15.1337 8.06871 15.05C7.93107 15.0136 7.79552 14.9693 7.66207 14.9171C7.3589 14.7985 7.0816 14.6452 6.83019 14.4573C6.73424 14.3856 6.64206 14.3088 6.55365 14.227C6.30244 13.9946 6.09779 13.7363 5.93972 13.452C5.90163 13.3836 5.86625 13.3136 5.83357 13.2421C5.74265 13.0432 5.67605 12.8394 5.63377 12.6307C5.597 12.4492 5.57861 12.264 5.57861 12.075Z" fill-rule="evenodd" />\n </g>\n <g class="' + prefix + '-icon-talk-growth-dot">\n <path class="' + prefix + '-icon-talk-growth-dot1" d="M19.1333 6.40039L22.8667 6.40039" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n <path class="' + prefix + '-icon-talk-growth-dot2" d="M19.1333 10.1338L21.9331 10.1338" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n <path class="' + prefix + '-icon-talk-growth-dot3" d="M19.1333 13.8672L20.9995 13.8672" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n <path class="' + prefix + '-icon-talk-growth-dot4" d="M19.1333 17.6001L20.0669 17.6001" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n </g>\n </svg>';
786
834
  },
787
835
  /** 语音广播 */ broadcast: '\n <svg width="1em" height="1em" viewBox="0 0 24 24" fill="currentColor" stroke="none" focusable="false" aria-hidden="true" data-icon="broadcast">\n <g>\n <path id="矢量 1" d="m8.52109,6.76609l6.17823,-2.91335c0.2485,-0.11718 0.5027,-0.19531 0.7627,-0.2351c0.2034,-0.03077 0.4104,-0.03809 0.6211,-0.02173c0.2092,0.01636 0.4116,0.05493 0.6069,0.11621c0.2278,0.07129 0.4461,0.1731 0.6548,0.30542c0.2087,0.13232 0.394,0.28638 0.5557,0.46216l0.0002,0l0,0c0.1384,0.15064 0.2598,0.31714 0.3638,0.49951c0.1047,0.18335 0.1865,0.37354 0.2451,0.57081c0.0752,0.25219 0.1128,0.51562 0.1128,0.79004l0,10.64651c0,0.2744 -0.0376,0.5379 -0.1128,0.7901l0,0c-0.0586,0.197 -0.1404,0.3874 -0.2451,0.5708c-0.104,0.1823 -0.2254,0.3488 -0.364,0.4995c-0.1617,0.1758 -0.347,0.3298 -0.5557,0.4621c-0.2087,0.1324 -0.427,0.2342 -0.6548,0.3054c-0.1953,0.0611 -0.3977,0.0999 -0.6069,0.1163c-0.2107,0.0163 -0.4175,0.009 -0.6209,-0.0218c-0.2602,-0.0398 -0.5144,-0.1181 -0.7629,-0.2351l-5.45044,-2.5703l0,2.759c0,0.1036 -0.01831,0.1995 -0.05494,0.2879c-0.03662,0.0886 -0.09155,0.1692 -0.16479,0.2424c-0.14624,0.1465 -0.32324,0.2197 -0.53027,0.2197l-2,0c-0.14209,0 -0.27344,-0.0373 -0.39429,-0.112c-0.12085,-0.0745 -0.21289,-0.1756 -0.27661,-0.3025l-1.99268,-3.9856c-0.06225,-0.0234 -0.12402,-0.0481 -0.18555,-0.074c-0.26953,-0.114 -0.52417,-0.2502 -0.7644,-0.4084c-0.26636,-0.1758 -0.51489,-0.3789 -0.74512,-0.6094c-0.23047,-0.2302 -0.43359,-0.4788 -0.60937,-0.7451c-0.1582,-0.2403 -0.29444,-0.4949 -0.40845,-0.7644c-0.11328,-0.2679 -0.20068,-0.5413 -0.26245,-0.8206l0,0c-0.07398,-0.3347 -0.11108,-0.6775 -0.11108,-1.0286c0,-0.351 0.0371,-0.6938 0.11108,-1.0285c0.06177,-0.2793 0.14917,-0.5528 0.26245,-0.8206c0.11401,-0.26953 0.25025,-0.52417 0.40845,-0.7644c0.17578,-0.26636 0.3789,-0.5149 0.60937,-0.74512c0.23023,-0.23047 0.47876,-0.4336 0.74512,-0.60938l0,0c0.24023,-0.1582 0.49487,-0.29444 0.7644,-0.40845c0.26783,-0.11328 0.54126,-0.20068 0.82056,-0.26245l0,0l0,0l0,0c0.33472,-0.07398 0.67749,-0.11109 1.02857,-0.11109l2.93872,0c0.02636,-0.0166 0.05444,-0.03198 0.08349,-0.04589zm0.72876,8.47948l6.08937,2.8716c0.1287,0.0606 0.2598,0.0987 0.3935,0.114c0.0772,0.0088 0.1551,0.0103 0.2337,0.0042c0.0857,-0.0068 0.1687,-0.0217 0.2495,-0.0452c0.1133,-0.0329 0.2219,-0.0822 0.3257,-0.1479c0.104,-0.0659 0.1948,-0.1431 0.2729,-0.2317c0.0554,-0.063 0.1045,-0.1318 0.147,-0.2063c0.0393,-0.0686 0.0713,-0.1397 0.0962,-0.2131c0.043,-0.1277 0.0647,-0.2625 0.0647,-0.4046l0,-10.64651c0,-0.14209 -0.0217,-0.2771 -0.0647,-0.40454c-0.0249,-0.07349 -0.0569,-0.14454 -0.0962,-0.21314c-0.0425,-0.07471 -0.0916,-0.14331 -0.147,-0.2063c-0.0781,-0.08862 -0.1689,-0.16577 -0.2729,-0.23169c-0.1038,-0.06567 -0.2124,-0.11523 -0.3257,-0.14795c-0.0808,-0.02344 -0.1638,-0.03833 -0.2495,-0.04517c-0.0786,-0.0061 -0.1565,-0.00463 -0.2337,0.00415c-0.1337,0.01539 -0.2648,0.05347 -0.3935,0.11402l-6.09034,2.87208l0.00097,7.16405zm13.58447,-7.9121l-2,1c-0.3757,0.18775 -0.8184,0.04029 -1.0063,-0.33545c-0.0552,-0.11035 -0.0813,-0.22656 -0.0813,-0.34033c0,-0.27344 0.1516,-0.53321 0.4167,-0.66602l2,-1c0.3757,-0.18775 0.8186,-0.04004 1.0064,0.33545c0.0551,0.11035 0.0813,0.22656 0.0813,0.34033c0,0.27368 -0.1514,0.53345 -0.4168,0.66602zm-15.08544,8.9785l-2.08667,0l1.30029,2.6006l0.78638,0l0,-2.6006zm0,-7.99998l-2.25,0c-0.24976,0 -0.49317,0.02734 -0.73023,0.08179c-0.18188,0.04174 -0.36011,0.09961 -0.53467,0.17334c-0.17944,0.07593 -0.34961,0.1665 -0.51049,0.27124c-0.18702,0.12231 -0.36133,0.26416 -0.52271,0.42554c-0.16138,0.16137 -0.30322,0.33569 -0.42554,0.52267c-0.10473,0.1609 -0.19531,0.3311 -0.27124,0.5105c-0.07373,0.1746 -0.13159,0.3528 -0.17334,0.5347c-0.05444,0.2371 -0.08178,0.4805 -0.08178,0.7302c0,0.2498 0.02734,0.4932 0.08178,0.7303c0.04175,0.1818 0.09961,0.3601 0.17334,0.5346c0.07593,0.1795 0.16651,0.3496 0.27124,0.5105c0.12232,0.187 0.26416,0.3614 0.42554,0.5227c0.16138,0.1614 0.33569,0.3033 0.52271,0.4256c0.16088,0.1047 0.33105,0.1953 0.51049,0.2712c0.17456,0.0737 0.35279,0.1316 0.53467,0.1734c0.23706,0.0544 0.48047,0.0817 0.73023,0.0817l2.25097,0l-0.00097,-6.49998zm12.75004,2.60058l2,0c0.4199,0 0.75,0.3301 0.75,0.75c0,0.4199 -0.3301,0.75 -0.75,0.75l-2,0c-0.42,0 -0.75,-0.3301 -0.75,-0.75c0,-0.4199 0.33,-0.75 0.75,-0.75zm0.3354,4.0791l2,1c0.2654,0.1326 0.4168,0.3924 0.4168,0.6661c0,0.1137 -0.0262,0.2299 -0.0813,0.3403c-0.1878,0.3755 -0.6307,0.5232 -1.0064,0.3354l-2,-1c-0.2651,-0.1328 -0.4167,-0.3925 -0.4167,-0.666c0,-0.1138 0.0261,-0.23 0.0813,-0.3403c0.1879,-0.3758 0.6306,-0.5232 1.0063,-0.3355z" fill-rule="evenodd"/>\n </g>\n</svg>',
788
- /** AI对话 */ aiChat: '\n <svg width="24" height="24" viewBox="0 0 24 24" fill="none">\n <defs>\n <linearGradient id="gradient0" x1="10.667" x2="10.667" y1="0.667" y2="20.667">\n <stop stop-color="#33D9FF" offset="0.354"/>\n <stop stop-color="#CE77FF" offset="1"/>\n </linearGradient>\n <linearGradient id="gradient1" x1="8.318" x2="8.318" y1="0" y2="18.001">\n <stop stop-color="#33D9FF" offset="0.354"/>\n <stop stop-color="#CE77FF" offset="1"/>\n </linearGradient>\n </defs>\n \n <g transform="scale(1.2) translate(-3, -0.5)">\n <path d="M6.917 0C8.776 0 10.52 0.738 11.808 2.026C12.45 2.668 12.961 3.43 13.309 4.269C13.442 4.588 13.29 4.954 12.971 5.086C12.653 5.218 12.287 5.067 12.155 4.748C11.87 4.061 11.451 3.436 10.925 2.91C9.868 1.854 8.441 1.25 6.917 1.25C3.787 1.25 1.25 3.787 1.25 6.917C1.25 10.047 3.787 12.584 6.917 12.584C8.441 12.584 9.868 11.981 10.925 10.925C11.169 10.681 11.564 10.681 11.808 10.925C12.052 11.169 12.052 11.565 11.808 11.809C10.666 12.951 9.164 13.661 7.542 13.807L7.542 17.376C7.542 17.721 7.262 18.001 6.917 18.001C6.572 18.001 6.292 17.721 6.292 17.376L6.292 13.807C2.765 13.49 0 10.527 0 6.917C0 3.097 3.097 0 6.917 0ZM11.051 6.495C11.295 6.739 11.295 7.135 11.051 7.379L7.547 10.882C7.303 11.126 6.908 11.126 6.664 10.882C6.42 10.638 6.42 10.242 6.664 9.998L10.167 6.495C10.411 6.251 10.807 6.251 11.051 6.495ZM8.566 4.559L6.501 9.5C6.368 9.818 6.002 9.969 5.684 9.836C5.365 9.703 5.215 9.336 5.348 9.018L5.712 8.147L4.094 6.529L3.198 6.884C2.904 7.001 2.575 6.878 2.424 6.61C2.297 6.289 2.418 5.849 2.739 5.722L7.76 3.736C8.274 3.533 8.779 4.049 8.566 4.559ZM16.614 6.171C16.642 6.236 16.642 6.309 16.614 6.373L15.964 7.848C15.936 7.912 15.936 7.986 15.964 8.05L16.614 9.525C16.67 9.651 16.613 9.799 16.486 9.855C16.422 9.883 16.349 9.883 16.285 9.855L14.809 9.205C14.745 9.176 14.672 9.176 14.608 9.205L13.133 9.855C13.006 9.911 12.859 9.853 12.803 9.727C12.775 9.662 12.775 9.589 12.803 9.525L13.453 8.05C13.482 7.986 13.482 7.912 13.453 7.848L12.803 6.373C12.747 6.247 12.805 6.099 12.931 6.043C12.995 6.015 13.068 6.015 13.133 6.043L14.608 6.694C14.672 6.722 14.745 6.722 14.809 6.694L16.285 6.043C16.411 5.988 16.558 6.045 16.614 6.171ZM6.841 5.443L5.361 6.028L6.233 6.9L6.841 5.443Z" fill="url(#gradient1)" transform="matrix(0.707 -0.707 0.707 0.707 0.085 9.868)"/>\n </g>\n </svg>\n ',
836
+ /** AI对话 */ aiChat: function aiChat(line_id) {
837
+ return '<svg width="1em" height="1em" viewBox="2 2 18 18" fill="none">\n <defs>\n <linearGradient id="' + line_id + '" x1="8.31767559" x2="8.31767559" y1="0" y2="18.0010872" gradientUnits="userSpaceOnUse">\n <stop stop-color="rgb(51,217,255)" offset="0.354430377" stop-opacity="1" />\n <stop stop-color="rgb(206,119,255)" offset="1" stop-opacity="1" />\n </linearGradient>\n </defs>\n <path d="M6.91721 0C8.77619 0 10.52 0.737553 11.8084 2.026C12.4502 2.6678 12.9613 3.42996 13.3093 4.26934C13.4416 4.58819 13.2903 4.95385 12.9714 5.08607C12.6526 5.21828 12.2869 5.06698 12.1547 4.74813C11.8697 4.06081 11.4508 3.43616 10.9245 2.90989C9.86818 1.85353 8.44127 1.25 6.91721 1.25C3.7873 1.25 1.25 3.7873 1.25 6.91721C1.25 10.0471 3.7873 12.5844 6.91721 12.5844C8.44127 12.5844 9.86818 11.9809 10.9245 10.9245C11.1686 10.6805 11.5643 10.6805 11.8084 10.9245C12.0525 11.1686 12.0525 11.5643 11.8084 11.8084C10.6655 12.9513 9.16441 13.6607 7.5424 13.8064L7.54221 17.3761C7.54221 17.7213 7.26239 18.0011 6.91721 18.0011C6.57203 18.0011 6.29221 17.7213 6.29221 17.3761L6.29175 13.8065C2.76456 13.4904 0 10.5267 0 6.91721C0 3.09694 3.09694 0 6.91721 0ZM11.0506 6.49482C11.2947 6.7389 11.2947 7.13463 11.0506 7.37871L7.54746 10.8819C7.30339 11.126 6.90766 11.126 6.66358 10.8819C6.4195 10.6378 6.4195 10.2421 6.66358 9.998L10.1668 6.49482C10.4108 6.25075 10.8066 6.25075 11.0506 6.49482ZM8.56622 4.55861L6.50122 9.49996C6.36812 9.81845 6.00204 9.96873 5.68355 9.83564C5.36507 9.70254 5.21478 9.33646 5.34788 9.01798L5.71248 8.14735L4.09417 6.52917L3.19846 6.88426C2.90422 7.00062 2.57458 6.87812 2.42392 6.60965C2.29698 6.28866 2.41781 5.84878 2.7388 5.72184L7.75973 3.73641C8.27389 3.53309 8.77942 4.04845 8.56622 4.55861ZM16.614 6.1714C16.6424 6.23564 16.6424 6.30883 16.614 6.37307L15.9639 7.84813C15.9356 7.91237 15.9356 7.98556 15.9639 8.0498L16.614 9.52486C16.6697 9.6512 16.6125 9.79877 16.4861 9.85446C16.4219 9.88277 16.3487 9.88277 16.2845 9.85446L14.8094 9.20428C14.7452 9.17597 14.672 9.17597 14.6077 9.20428L13.1327 9.85446C13.0063 9.91015 12.8588 9.85287 12.8031 9.72653C12.7747 9.66229 12.7747 9.5891 12.8031 9.52486L13.4532 8.0498C13.4816 7.98556 13.4816 7.91237 13.4532 7.84813L12.8031 6.37307C12.7474 6.24673 12.8047 6.09916 12.931 6.04347C12.9952 6.01516 13.0684 6.01516 13.1327 6.04347L14.6077 6.69365C14.672 6.72196 14.7452 6.72196 14.8094 6.69365L16.2845 6.04347C16.4108 5.98778 16.5584 6.04506 16.614 6.1714ZM6.84128 5.44268L5.36083 6.02833L6.2325 6.9L6.84128 5.44268Z" fill="url(#' + line_id + ')" fill-rule="nonzero" transform="matrix(0.707107,-0.707107,0.707107,0.707107,0.0854492,9.86798)" />\n </svg>\n ';
838
+ },
789
839
  /** 相机/截图 */ capturePicture: '<svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" stroke="currentColor" focusable="false" aria-hidden="true" data-icon="capture-picture">\n <path d="M6.94 7.51C7.34 7.51 7.7 7.28 7.86 6.91L8.43 5.6C8.59 5.23 8.95 5 9.35 5L14.69 5C15.04 5 15.37 5.18 15.55 5.49L16.45 7.02C16.63 7.33 16.96 7.51 17.31 7.51L18.5 7.51C19.6 7.51 20.5 8.41 20.5 9.51L20.5 17C20.5 18.1 19.6 19 18.5 19L5.5 19C4.39 19 3.5 18.1 3.5 17L3.5 9.51C3.5 8.41 4.39 7.51 5.5 7.51L6.94 7.51Z" stroke-width="1.5"/>\n <circle cx="12" cy="12.525146" r="3.068097" stroke-width="1.5"/>\n </svg>',
790
840
  /** 电子放大 */ zoom: '<svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" stroke="currentColor" focusable="false" aria-hidden="true" data-icon="zoom">\n <ellipse cx="10.914795" cy="11.25" rx="8.004043" ry="8.25" stroke-width="1.5"/>\n <path d="M14.31 11.04L8.05 11.14" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M11.13 14.22L11.23 7.95" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M16.45 17.83L19.36 20.83" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n </svg>',
791
841
  /** 隐私遮蔽 */ privacyMasking: '<svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" stroke="currentColor" focusable="false" aria-hidden="true" data-icon="privacy-masking">\n <path d="M12 19C11.15 19 10.31 18.82 9.49 18.5" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M20.88 12.46C18.98 15.96 15.49 19 11.99 19" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M19.07 8.92C19.76 9.72 20.38 10.61 20.88 11.53C21.03 11.82 21.03 12.17 20.88 12.46" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M5 19L19 5" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M9.77 14.22C8.54 12.99 8.54 11 9.77 9.77C11 8.54 12.99 8.54 14.22 9.77" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M17.04 6.95C15.49 5.75 13.74 5 12 5C8.5 5 5.01 8.03 3.11 11.53C2.96 11.82 2.96 12.17 3.11 12.46C4.06 14.21 5.41 15.84 6.95 17.04" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n </svg>',
@@ -817,7 +867,9 @@ var Icons = {
817
867
  var attrStr = '';
818
868
  if (attr) {
819
869
  Object.keys(attr).forEach(function(key) {
820
- if (!(attr[key] === undefined || attr[key] === null)) attrStr += key + '="' + attr[key] + '"';
870
+ // 属性值必须转义:所有控件的 title 都来自 options.locales,
871
+ // 不转义时 `x" onmouseover="alert(1)` 这样的文案可以闭合属性并挂上事件
872
+ if (!(attr[key] === undefined || attr[key] === null)) attrStr += key + '="' + escapeHtml(attr[key]) + '"';
821
873
  });
822
874
  }
823
875
  return '<span class="' + PREFIX_CLASS + "-icon " + PREFIX_CLASS + "-icon-" + type + '" ' + attrStr + ">" + svg + "</span>";
@@ -881,7 +933,7 @@ var IconComponents = {
881
933
  },
882
934
  aiChat: function aiChat(attr) {
883
935
  if (attr === void 0) attr = {};
884
- return createIcon(Icons.aiChat, 'aiChat', attr);
936
+ return createIcon(Icons.aiChat(attr.line_id), 'aiChat', attr);
885
937
  },
886
938
  talkGrowth: function talkGrowth(attr) {
887
939
  if (attr === void 0) attr = {};
@@ -1072,7 +1124,8 @@ var MESSAGE_DEFAULT_OPTIONS = {};
1072
1124
  this._$toast = document.createElement('div');
1073
1125
  this._$toast.classList.add("" + PREFIX_CLASS + "-toast");
1074
1126
  }
1075
- this._$toast.innerHTML = '<div class="' + PREFIX_CLASS + '-toast-content">' + this._getIcon(type) + '<span class="' + PREFIX_CLASS + "-toast-msg " + PREFIX_CLASS + "-toast-" + type + '">' + (msg || '') + "</span></div>";
1127
+ // msg 是 EVENTS.message 的载荷,内核与接口的错误信息都走这个通道,必须转义
1128
+ this._$toast.innerHTML = '<div class="' + PREFIX_CLASS + '-toast-content">' + this._getIcon(type) + '<span class="' + PREFIX_CLASS + "-toast-msg " + PREFIX_CLASS + "-toast-" + type + '">' + escapeHtml(msg) + "</span></div>";
1076
1129
  this.options.rootContainer.appendChild(this._$toast);
1077
1130
  if (duration > 0) {
1078
1131
  this._toastTimer = setTimeout(function() {
@@ -1104,7 +1157,7 @@ var MESSAGE_DEFAULT_OPTIONS = {};
1104
1157
  //
1105
1158
  this.$container.innerHTML = this.options.render(msg, duration, type);
1106
1159
  } else {
1107
- this.$container.innerHTML = '<div class="' + PREFIX_CLASS + "-message-content " + PREFIX_CLASS + "-message-" + type + '">' + (msg || '') + "</div>";
1160
+ this.$container.innerHTML = '<div class="' + PREFIX_CLASS + "-message-content " + PREFIX_CLASS + "-message-" + type + '">' + escapeHtml(msg) + "</div>";
1108
1161
  }
1109
1162
  //
1110
1163
  this.$container.style.display = 'flex';
@@ -2011,9 +2064,9 @@ var VOLUME_DEFAULT_OPTIONS = {
2011
2064
  // 这里不要用 click 事件,因为拖动音量大小时鼠标移动到图标上会触发 click
2012
2065
  // prettier-ignore
2013
2066
  delegate(this.$container, "." + PREFIX_CLASS + "-control-volume", "mousedown", function() {
2014
- if (!_this.$container.classList.contains("" + PREFIX_CLASS + "-disabled")) {
2015
- _this._toggleMute();
2016
- }
2067
+ // 禁用判断交给 _toggleMute 里的 this.disabled(状态是权威来源,
2068
+ // class 只是它的呈现),避免两处各判一遍
2069
+ _this._toggleMute();
2017
2070
  });
2018
2071
  };
2019
2072
  _create_class$6(Volume, [
@@ -5385,11 +5438,14 @@ function _ts_generator$6(thisArg, body) {
5385
5438
  */ function getThemeDataByTemplate(theme, id) {
5386
5439
  return _async_to_generator$6(function() {
5387
5440
  var _theme_options_token_httpToken, _theme_options_token, // 中止上一个在途请求,并为本次请求创建可中止的信号(destroy 时会 abort)
5388
- _theme__templateAbortController, url, controller;
5441
+ _theme__templateAbortController, accessToken, url, controller;
5389
5442
  return _ts_generator$6(this, function(_state) {
5390
5443
  switch(_state.label){
5391
5444
  case 0:
5392
- url = theme.options.env.domain + "/api/service/media/template/getDetail?accessToken=" + (theme.options.accessToken || ((_theme_options_token = theme.options.token) == null ? void 0 : (_theme_options_token_httpToken = _theme_options_token.httpToken) == null ? void 0 : _theme_options_token_httpToken.url)) + "&id=" + id;
5445
+ accessToken = theme.options.accessToken || ((_theme_options_token = theme.options.token) == null ? void 0 : (_theme_options_token_httpToken = _theme_options_token.httpToken) == null ? void 0 : _theme_options_token_httpToken.url);
5446
+ // 查询参数逐个 encodeURIComponent,防止 `&` `#` `=` 等字符注入额外参数或截断 URL(SECURITY_AUDIT M1)
5447
+ // 不用 `new URL()`:env.domain 允许为空(同源相对路径)或带路径前缀,URL 构造会抛错或丢掉前缀
5448
+ url = theme.options.env.domain + "/api/service/media/template/getDetail?accessToken=" + encodeURIComponent(String(accessToken)) + "&id=" + encodeURIComponent(String(id));
5393
5449
  (_theme__templateAbortController = theme._templateAbortController) == null ? void 0 : _theme__templateAbortController.abort();
5394
5450
  controller = new AbortController();
5395
5451
  theme._templateAbortController = controller;
@@ -5717,7 +5773,9 @@ function _filterLeftRightControls(btnList) {
5717
5773
  ];
5718
5774
  // 渲染主题模板
5719
5775
  themeData = TEMPLATES[data];
5720
- if (!data) {
5776
+ // 修复:此前判的是 `!data`,而这个分支里 data 必然是非空字符串,告警永远不会发出,
5777
+ // 传了不存在的模板名只会静默返回 undefined。应当判查表结果。
5778
+ if (!themeData) {
5721
5779
  (_theme_logger = theme.logger) == null ? void 0 : _theme_logger.warn("Theme template " + data + " is not exist!");
5722
5780
  themeData = null;
5723
5781
  }
@@ -6408,7 +6466,9 @@ function _set_prototype_of$k(o, p) {
6408
6466
  this._ptzControl.updateOptions(options);
6409
6467
  }
6410
6468
  if (this._ptzControl1) {
6411
- this._ptzControl.updateOptions(options);
6469
+ // 修复:此前误写成 this._ptzControl,移动端扩展区域的云台拿不到新凭据,
6470
+ // 换 accessToken 或切设备后移动端云台会继续用旧值请求
6471
+ this._ptzControl1.updateOptions(options);
6412
6472
  }
6413
6473
  };
6414
6474
  _proto._onSpeedChange = function _onSpeedChange(speed) {
@@ -7174,6 +7234,83 @@ function _ts_generator$3(thisArg, body) {
7174
7234
  'live'
7175
7235
  ];
7176
7236
 
7237
+ /**
7238
+ * UUID 生成(RFC 4122 v4)
7239
+ *
7240
+ * 按可用性三级降级:
7241
+ *
7242
+ * | 顺序 | 实现 | 说明 |
7243
+ * | ---- | ------------------------ | ------------------------------------------------------------- |
7244
+ * | 1 | `crypto.randomUUID()` | 原生实现,最快;**仅在安全上下文(HTTPS / localhost)可用** |
7245
+ * | 2 | `crypto.getRandomValues` | 密码学强度随机数手工组装;HTTP 页面下也可用 |
7246
+ * | 3 | `Math.random()` | 兜底,**不具密码学强度**,只适合做 DOM id 这类无安全要求的标识 |
7247
+ *
7248
+ * 之所以不能只用 `crypto.randomUUID()`:播放器会被嵌到 HTTP 页面里,
7249
+ * 那种场景下它是 `undefined`,必须有降级路径。
7250
+ *
7251
+ * @remarks 用 `crypto` 而非 `window.crypto`,以便在 worker 中也能工作(worker 里没有 `window`)。
7252
+ */ /** 0~255 对应的两位十六进制查表,避免每个字节都做一次 toString + 手工补零 */ var HEX_BY_BYTE = [];
7253
+ for(var i = 0; i < 256; i++){
7254
+ // + 0x100 保证结果是三位,再切掉首位,等价于补零到两位(不用 padStart,es5 目标下它需要 polyfill)
7255
+ HEX_BY_BYTE.push((i + 0x100).toString(16).slice(1));
7256
+ }
7257
+ /**
7258
+ * 取 16 个随机字节
7259
+ *
7260
+ * @returns 长度为 16 的字节数组,每项 0~255
7261
+ */ function randomBytes() {
7262
+ var bytes = [];
7263
+ if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {
7264
+ var buffer = new Uint8Array(16);
7265
+ crypto.getRandomValues(buffer);
7266
+ for(var i = 0; i < 16; i++){
7267
+ bytes.push(buffer[i]);
7268
+ }
7269
+ return bytes;
7270
+ }
7271
+ // 兜底:不具密码学强度,不要用于 token / 密钥一类场景
7272
+ for(var i1 = 0; i1 < 16; i1++){
7273
+ bytes.push(Math.floor(Math.random() * 256));
7274
+ }
7275
+ return bytes;
7276
+ }
7277
+ /**
7278
+ * 把 16 个字节按 v4 规范格式化成 `8-4-4-4-12`
7279
+ *
7280
+ * 会就地改写第 6、8 个字节以写入版本号与变体位。
7281
+ *
7282
+ * @param bytes - 长度为 16 的字节数组
7283
+ * @returns 形如 `xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx` 的字符串,`y` 为 8/9/a/b
7284
+ */ function bytesToUuid(bytes) {
7285
+ // 版本号固定为 4(高 4 位置为 0100)
7286
+ bytes[6] = bytes[6] & 0x0f | 0x40;
7287
+ // 变体固定为 RFC 4122(高 2 位置为 10)
7288
+ bytes[8] = bytes[8] & 0x3f | 0x80;
7289
+ var out = '';
7290
+ for(var i = 0; i < 16; i++){
7291
+ // 8-4-4-4-12 的分组位置
7292
+ if (i === 4 || i === 6 || i === 8 || i === 10) out += '-';
7293
+ out += HEX_BY_BYTE[bytes[i]];
7294
+ }
7295
+ return out;
7296
+ }
7297
+ /**
7298
+ * 生成一个 v4 UUID
7299
+ *
7300
+ * @returns 36 位小写 UUID,形如 `f47ac10b-58cc-4372-a567-0e02b2c3d479`
7301
+ * @example
7302
+ * ```ts
7303
+ * import uuid from '@/utils/uuid';
7304
+ *
7305
+ * uuid(); // '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'
7306
+ * ```
7307
+ */ function uuid() {
7308
+ if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
7309
+ return crypto.randomUUID();
7310
+ }
7311
+ return bytesToUuid(randomBytes());
7312
+ }
7313
+
7177
7314
  function asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, key, arg) {
7178
7315
  try {
7179
7316
  var info = gen[key](arg);
@@ -7364,7 +7501,8 @@ function _ts_generator$2(thisArg, body) {
7364
7501
  _proto._render = function _render() {
7365
7502
  var _this_locale;
7366
7503
  this.$container.innerHTML = IconComponents.aiChat({
7367
- title: (_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_AICHAT
7504
+ title: (_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_AICHAT,
7505
+ line_id: 'ezpleyer___AI_CHAT_LINEAR_GRADIENT___' + '' + uuid()
7368
7506
  });
7369
7507
  };
7370
7508
  _proto.reset = function reset(hide) {
@@ -7552,7 +7690,13 @@ function _set_prototype_of$e(o, p) {
7552
7690
  controlType: 'button',
7553
7691
  classNameSuffix: 'rec-dropdown'
7554
7692
  })) || this;
7555
- _this._options = options;
7693
+ _this._options = Object.assign({
7694
+ list: [
7695
+ 'rec',
7696
+ 'cloudRec',
7697
+ 'cloudRecord'
7698
+ ]
7699
+ }, options || {});
7556
7700
  // H5 端不展示直播/回放切换按钮
7557
7701
  if (Utils.isMobile) {
7558
7702
  _this.$container.style.display = 'none';
@@ -7585,7 +7729,8 @@ function _set_prototype_of$e(o, p) {
7585
7729
  }
7586
7730
  };
7587
7731
  _proto._render = function _render() {
7588
- var _this_locale;
7732
+ var _this__options_list, _this_locale;
7733
+ if (((_this__options_list = this._options.list) == null ? void 0 : _this__options_list.length) === 0) ;
7589
7734
  this.$container.innerHTML = IconComponents.recDropdown({
7590
7735
  title: ((_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_REC_DROPDOWN) || '回放'
7591
7736
  });
@@ -7608,8 +7753,8 @@ function _set_prototype_of$e(o, p) {
7608
7753
  // 打开时按控件在视口中的位置决定对齐方式。
7609
7754
  // 此时 picker 已把 $wrapperContent 设为 inline-flex(可测量宽度),
7610
7755
  // 而它内部的定位计算还在 requestAnimationFrame 里,改 placement 来得及生效。
7611
- // 移动端 placement 不生效(弹窗固定在窗口底部)
7612
- if (open && !Utils.isMobile) _this._adjustPlacement();
7756
+ // 移动端不适用的判断放在 _adjustPlacement 内部,避免两处各管一半
7757
+ if (open) _this._adjustPlacement();
7613
7758
  }
7614
7759
  });
7615
7760
  this._picker.innerHTML(this._getPanelHTML());
@@ -7655,7 +7800,7 @@ function _set_prototype_of$e(o, p) {
7655
7800
  var cloudRecLabel = ((_this_locale = this.locale) == null ? void 0 : _this_locale.REC_DROPDOWN_CLOUD_REC) || '云存储';
7656
7801
  var cloudRecordLabel = ((_this_locale1 = this.locale) == null ? void 0 : _this_locale1.REC_DROPDOWN_CLOUD_RECORD) || '云录制';
7657
7802
  var localRecLabel = ((_this_locale2 = this.locale) == null ? void 0 : _this_locale2.REC_DROPDOWN_LOCAL_REC) || '本地回放';
7658
- return '<div class="' + PREFIX_CLASS + '-rec-dropdown-panel">\n <ul class="' + PREFIX_CLASS + '-rec-dropdown-list">\n <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRec">\n <span>' + cloudRecLabel + '</span>\n </li>\n <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRecord">\n <span>' + cloudRecordLabel + '</span>\n </li>\n <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="rec">\n <span>' + localRecLabel + "</span>\n </li>\n </ul>\n </div>";
7803
+ return '<div class="' + PREFIX_CLASS + '-rec-dropdown-panel">\n <ul class="' + PREFIX_CLASS + '-rec-dropdown-list">\n ' + (this._options.list.includes('cloudRec') ? '<li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRec">\n <span>' + cloudRecLabel + "</span>\n </li>" : '') + "\n " + (this._options.list.includes('cloudRecord') ? '<li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRecord">\n <span>' + cloudRecordLabel + "</span>\n </li>" : '') + "\n " + (this._options.list.includes('rec') ? ' <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="rec">\n <span>' + localRecLabel + "</span>\n </li>" : '') + "\n </ul>\n </div>";
7659
7804
  };
7660
7805
  _proto._bindPanelEvents = function _bindPanelEvents() {
7661
7806
  var _this = this;
@@ -7676,6 +7821,9 @@ function _set_prototype_of$e(o, p) {
7676
7821
  };
7677
7822
  _proto._activeOption = function _activeOption(type) {
7678
7823
  var _this__picker;
7824
+ if (!this._options.list.includes(type)) {
7825
+ return;
7826
+ }
7679
7827
  if ((_this__picker = this._picker) == null ? void 0 : _this__picker.$body) {
7680
7828
  var items = this._picker.$body.querySelectorAll("." + PREFIX_CLASS + "-rec-dropdown-item");
7681
7829
  items.forEach(function(item) {
@@ -8000,8 +8148,9 @@ var SELECT_DEFAULT_OPTIONS = {
8000
8148
  label: 'label',
8001
8149
  value: 'value'
8002
8150
  },
8151
+ // label 可能来自内核下发的列表,内置实现必须转义
8003
8152
  renderLabel: function renderLabel(label) {
8004
- return "<span>" + (label || '') + "</span>";
8153
+ return "<span>" + escapeHtml(label) + "</span>";
8005
8154
  },
8006
8155
  onChange: function onChange() {},
8007
8156
  onOpenChange: function onOpenChange() {}
@@ -8116,9 +8265,11 @@ var SELECT_DEFAULT_OPTIONS = {
8116
8265
  var _this__options_fieldNames, _this__options_fieldNames1, _this_locale, _this__picker;
8117
8266
  var labelKey = (_ref = (_this__options_fieldNames = this._options.fieldNames) == null ? void 0 : _this__options_fieldNames.label) != null ? _ref : 'label';
8118
8267
  var valueKey = (_ref1 = (_this__options_fieldNames1 = this._options.fieldNames) == null ? void 0 : _this__options_fieldNames1.value) != null ? _ref1 : 'value';
8119
- (_this__picker = this._picker) == null ? void 0 : _this__picker.innerHTML('<div class="' + PREFIX_CLASS + '-select-panel">\n <ul class="' + PREFIX_CLASS + '-select-list">\n ' + list.map(function(item) {
8120
- return '\n <li class="' + PREFIX_CLASS + "-select-option " + (+item[valueKey] === _this.value ? "" + PREFIX_CLASS + "-active" : '') + '" data-value="' + item[valueKey] + '">\n <span>' + item[labelKey] + "</span>\n </li>\n ";
8121
- }).join('') + "\n </ul>\n " + (Utils.isMobile ? '<div class="' + PREFIX_CLASS + '-select-cancel">\n <span>' + (((_this_locale = this.locale) == null ? void 0 : _this_locale.cancel) || '取消') + "</span>\n </div>" : '') + "\n " + (Utils.isMobile ? '<span class="' + PREFIX_CLASS + '-select-close">' + IconComponents.close() + "</span>" : '') + "\n <div>");
8268
+ (_this__picker = this._picker) == null ? void 0 : _this__picker.innerHTML('<div class="' + PREFIX_CLASS + '-select-panel">\n <ul class="' + PREFIX_CLASS + '-select-list">\n ' + list.map(// 列表可能来自内核下发(如 setVideoLevelList 的清晰度列表),
8269
+ // data-value 与标签文本都要转义
8270
+ function(item) {
8271
+ return '\n <li class="' + PREFIX_CLASS + "-select-option " + (+item[valueKey] === _this.value ? "" + PREFIX_CLASS + "-active" : '') + '" data-value="' + escapeHtml(item[valueKey]) + '">\n <span>' + escapeHtml(item[labelKey]) + "</span>\n </li>\n ";
8272
+ }).join('') + "\n </ul>\n " + (Utils.isMobile ? '<div class="' + PREFIX_CLASS + '-select-cancel">\n <span>' + escapeHtml(((_this_locale = this.locale) == null ? void 0 : _this_locale.cancel) || '取消') + "</span>\n </div>" : '') + "\n " + (Utils.isMobile ? '<span class="' + PREFIX_CLASS + '-select-close">' + IconComponents.close() + "</span>" : '') + "\n <div>");
8122
8273
  this.list = list;
8123
8274
  this._activeOption();
8124
8275
  } else if ((list == null ? void 0 : list.length) === 0) {
@@ -8350,15 +8501,16 @@ function __filter(list, locale) {
8350
8501
  classNameSuffix: 'definition',
8351
8502
  renderLabel: function renderLabel(label, item, list) {
8352
8503
  var _list_;
8504
+ // 文案来自 options.locales,name / label 来自内核下发的清晰度列表,都要转义
8353
8505
  if ((item == null ? void 0 : item.level) === 'auto') {
8354
8506
  var _options_locales_options_language;
8355
8507
  var realItem = list.find(function(it) {
8356
8508
  return it.level === _assert_this_initialized$1(_this)._level;
8357
8509
  });
8358
- return "<span>" + (options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + ((realItem == null ? void 0 : realItem.name) || '') + ")</span>";
8510
+ return "<span>" + escapeHtml(options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + escapeHtml((realItem == null ? void 0 : realItem.name) || '') + ")</span>";
8359
8511
  }
8360
8512
  // 如果 label 不存在,则不显示label,直接显示list的第一个label, 一般自定义清晰度列表可能会出现
8361
- return "<span>" + (label || ((_list_ = list[0]) == null ? void 0 : _list_.name) || '') + "</span>";
8513
+ return "<span>" + escapeHtml(label || ((_list_ = list[0]) == null ? void 0 : _list_.name) || '') + "</span>";
8362
8514
  },
8363
8515
  onChange: function onChange(value, item) {
8364
8516
  var _options_onChange;
@@ -8388,7 +8540,8 @@ function __filter(list, locale) {
8388
8540
  var realItem = _this.list.find(function(it) {
8389
8541
  return it.level === _this._level;
8390
8542
  });
8391
- _this.$container.querySelector("." + PREFIX_CLASS + "-select-btn").innerHTML = "\n <span>" + (options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + ((realItem == null ? void 0 : realItem.name) || '') + ")</span>\n ";
8543
+ // 文案来自 options.locales,realItem.name 来自内核下发的清晰度列表,两者都要转义
8544
+ _this.$container.querySelector("." + PREFIX_CLASS + "-select-btn").innerHTML = "\n <span>" + escapeHtml(options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + escapeHtml((realItem == null ? void 0 : realItem.name) || '') + ")</span>\n ";
8392
8545
  } else {
8393
8546
  if (_this.value !== _this._level + '') _this.value = _this._level + '';
8394
8547
  }
@@ -8617,7 +8770,8 @@ function _set_prototype_of$8(o, p) {
8617
8770
  var isMobile1 = utilsTools.isMobile();
8618
8771
  if (isMobile1) {
8619
8772
  var _this_locale;
8620
- this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + '-mobile-date-filter" title="' + (((_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_CALENDAR) || '') + '">\n <span class="' + PREFIX_CLASS + '-mobile-date-filter-value">' + this._getDateStr() + "</span>\n " + IconComponents.filter() + "\n <span>";
8773
+ // title 来自 options.locales,必须转义后再拼进属性
8774
+ this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + '-mobile-date-filter" title="' + escapeHtml(((_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_CALENDAR) || '') + '">\n <span class="' + PREFIX_CLASS + '-mobile-date-filter-value">' + escapeHtml(this._getDateStr()) + "</span>\n " + IconComponents.filter() + "\n <span>";
8621
8775
  } else {
8622
8776
  var _this_locale1;
8623
8777
  this.$container.innerHTML = IconComponents.date({
@@ -8651,7 +8805,8 @@ function _set_prototype_of$8(o, p) {
8651
8805
  _this.options.onOk == null ? void 0 : _this.options.onOk.call(_this.options, date);
8652
8806
  _this.emit(EVENTS.control.dateChange, date);
8653
8807
  if (date && _this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value")) {
8654
- _this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").innerHTML = _this._getDateStr();
8808
+ // 纯文本,用 textContent 避免把日期字符串交给 HTML 解析器
8809
+ _this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").textContent = _this._getDateStr();
8655
8810
  }
8656
8811
  }
8657
8812
  },
@@ -8698,7 +8853,7 @@ function _set_prototype_of$8(o, p) {
8698
8853
  if (date && !change && this._value !== utilsTools.DateTime.format(date, 'YYYY-MM-DD')) {
8699
8854
  this._value = utilsTools.DateTime.format(date, 'YYYY-MM-DD');
8700
8855
  if (date && this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value")) {
8701
- this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").innerHTML = this._getDateStr();
8856
+ this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").textContent = this._getDateStr();
8702
8857
  }
8703
8858
  }
8704
8859
  };
@@ -8869,7 +9024,8 @@ function _set_prototype_of$7(o, p) {
8869
9024
  this._value = time;
8870
9025
  var valueEl = this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value");
8871
9026
  if (valueEl) {
8872
- valueEl.innerHTML = this._getTimeStr();
9027
+ // time 由调用方传入(setTime 是公开方法),只需纯文本,走 textContent
9028
+ valueEl.textContent = this._getTimeStr();
8873
9029
  }
8874
9030
  }
8875
9031
  };
@@ -9300,8 +9456,12 @@ function _set_prototype_of$5(o, p) {
9300
9456
  }
9301
9457
  this._progress.setCurrent(currentMs);
9302
9458
  };
9303
- /** 没有可用片段信息时退化为整个区间,避免进度条空转 */ _proto._fallbackToRange = function _fallbackToRange() {
9304
- if (!this._hasRange()) return;
9459
+ /**
9460
+ * 没有可用片段信息时退化为整个区间,避免进度条空转
9461
+ *
9462
+ * 两个调用方(`_syncCurrent` 开头、`_updateVisible` 的 `visible` 分支)都已经
9463
+ * 判过 `_hasRange()`,这里不再重复判断。
9464
+ */ _proto._fallbackToRange = function _fallbackToRange() {
9305
9465
  this._progress.setSegment(this._rangeBeginMs, this._rangeEndMs);
9306
9466
  };
9307
9467
  _proto._hasRange = function _hasRange() {
@@ -9375,7 +9535,12 @@ function _set_prototype_of$4(o, p) {
9375
9535
  var _proto = Device.prototype;
9376
9536
  _proto._render = function _render() {
9377
9537
  var _this___options_props_urlInfo, _this___options_props;
9378
- this.$container.innerHTML = '<span class="' + PREFIX_CLASS + "-text " + PREFIX_CLASS + '-text-device">' + this._splicingString(this.__options.deviceName, (_this___options_props = this.__options.props) == null ? void 0 : (_this___options_props_urlInfo = _this___options_props.urlInfo) == null ? void 0 : _this___options_props_urlInfo.deviceSerial) + "</span>";
9538
+ // deviceSerial 由播放地址解析而来(parseEzopenUrl 对它不做字符校验),
9539
+ // 这里只需要纯文本,用 textContent 从根上避免注入
9540
+ var $span = document.createElement('span');
9541
+ $span.className = PREFIX_CLASS + "-text " + PREFIX_CLASS + "-text-device";
9542
+ $span.textContent = this._splicingString(this.__options.deviceName, (_this___options_props = this.__options.props) == null ? void 0 : (_this___options_props_urlInfo = _this___options_props.urlInfo) == null ? void 0 : _this___options_props_urlInfo.deviceSerial);
9543
+ this.$container.replaceChildren($span);
9379
9544
  };
9380
9545
  /**
9381
9546
  * 更新设备序列号
@@ -9386,7 +9551,8 @@ function _set_prototype_of$4(o, p) {
9386
9551
  var $span = this.$container.querySelector("." + PREFIX_CLASS + "-text-device");
9387
9552
  var text = this._splicingString(deviceName, deviceSerial);
9388
9553
  $span == null ? void 0 : $span.setAttribute('title', text);
9389
- $span.innerHTML = text;
9554
+ // 设备信息来自 getDeviceInfo 事件(接口/内核数据),同样走 textContent
9555
+ $span.textContent = text;
9390
9556
  }
9391
9557
  };
9392
9558
  _proto._splicingString = function _splicingString(deviceName, deviceSerial) {
@@ -9782,7 +9948,11 @@ var _unmountedControls = function _unmountedControls(theme) {
9782
9948
  theme._footer.destroy();
9783
9949
  theme._footer = null;
9784
9950
  }
9951
+ // 移除 header / footer 动画暂停监听(挂在 theme 上,需显式解绑)
9952
+ // 修复:此前只置空引用没有解绑,changeTheme 每调用一次就漏一个监听器,
9953
+ // 且引用被清掉后 _renderTheme 里的兜底解绑也永远不会执行
9785
9954
  if (theme._onPauseTimingFunc) {
9955
+ theme.removeListener(CLEAR_TIMER_HEADER_FOOTER_ANIMATION, theme._onPauseTimingFunc);
9786
9956
  theme._onPauseTimingFunc = null;
9787
9957
  }
9788
9958
  // 移除首帧同步监听(挂在 theme 上,需显式解绑,避免 changeTheme 累积)
@@ -10196,10 +10366,8 @@ function _renderTheme(theme, data) {
10196
10366
  });
10197
10367
  // 当移动端 picker 控件打开时需要关闭动画(定时器)
10198
10368
  // 暂停 header footer 的动画(定时器)
10199
- if (theme._onPauseTimingFunc) {
10200
- theme.removeListener(CLEAR_TIMER_HEADER_FOOTER_ANIMATION, theme._onPauseTimingFunc);
10201
- theme._onPauseTimingFunc = null;
10202
- }
10369
+ // 旧监听的解绑统一在 _unmountedControls 里做(本函数开头已无条件调用过),
10370
+ // 这里不再重复判断
10203
10371
  theme._onPauseTimingFunc = function(open) {
10204
10372
  if (open) {
10205
10373
  var _theme__interactiveResult_clearTimeout, _theme__interactiveResult;
@@ -10593,6 +10761,17 @@ function _inherits(subClass, superClass) {
10593
10761
  });
10594
10762
  if (superClass) _set_prototype_of(subClass, superClass);
10595
10763
  }
10764
+ function _object_without_properties_loose(source, excluded) {
10765
+ if (source == null) return {};
10766
+ var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
10767
+ for(i = 0; i < sourceKeys.length; i++){
10768
+ key = sourceKeys[i];
10769
+ if (excluded.indexOf(key) >= 0) continue;
10770
+ if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
10771
+ target[key] = source[key];
10772
+ }
10773
+ return target;
10774
+ }
10596
10775
  function _set_prototype_of(o, p) {
10597
10776
  _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
10598
10777
  o.__proto__ = p;
@@ -10725,6 +10904,7 @@ var THEME_DEFAULT_OPTIONS = {
10725
10904
  domain: 'https://open.ys7.com'
10726
10905
  },
10727
10906
  isEzviz: true,
10907
+ sdkType: 'base',
10728
10908
  /** 移动端竖屏, 全屏情况下不展示扩张,放置在 footer 中 */ mobileExtendOptions: {
10729
10909
  controls: MOBILE_EXTENDS
10730
10910
  }
@@ -11186,10 +11366,16 @@ var THEME_DEFAULT_OPTIONS = {
11186
11366
  // JSON 不能序列化dom节点, 不要使用 this.options.container, 请使用 this.container
11187
11367
  delete this.options.container;
11188
11368
  }
11369
+ // 凭据不进日志:这条 log 在生产产物里依然存在(strip 插件只剥离 console.*,
11370
+ // 不处理 logger 实例方法),直接打印 options 等于把 accessToken 暴露在控制台
11371
+ var _this_options = this.options; _this_options.accessToken; _this_options.token; var loggableOptions = _object_without_properties_loose(_this_options, [
11372
+ "accessToken",
11373
+ "token"
11374
+ ]);
11189
11375
  try {
11190
- this.logger.log('[options] \n', JSON.stringify(this.options));
11376
+ this.logger.log('[options] \n', JSON.stringify(loggableOptions));
11191
11377
  } catch (error) {
11192
- this.logger.log('[options] \n', this.options);
11378
+ this.logger.log('[options] \n', loggableOptions);
11193
11379
  }
11194
11380
  var language = this.options.language || 'zh';
11195
11381
  // 深拷贝内置语言包,避免与模块级 zh/en 常量共享引用(I18n 若对其做合并/修改会污染全局)
@@ -12262,7 +12448,7 @@ var THEME_DEFAULT_OPTIONS = {
12262
12448
  zh: zh,
12263
12449
  en: en
12264
12450
  };
12265
- /** 版本号 @since 0.0.1 */ Theme.THEME_VERSION = '3.1.7-beta.4';
12451
+ /** 版本号 @since 0.0.1 */ Theme.THEME_VERSION = '3.1.8-beta.2';
12266
12452
 
12267
12453
  exports.CONTROL_INIT_EVENTS = CONTROL_INIT_EVENTS;
12268
12454
  exports.Control = Control;