@ezuikit/player-theme 3.1.7-beta.4 → 3.1.8-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.esm.js CHANGED
@@ -1,6 +1,6 @@
1
1
  /*
2
- * @ezuikit/player-theme v3.1.7-beta.4
3
- * Copyright (c) 2026-09-28 08:24:45 Ezviz-OpenBiz
2
+ * @ezuikit/player-theme v3.1.8-beta.2
3
+ * Copyright (c) 2026-10-10 15:37:05 Ezviz-OpenBiz
4
4
  * Released under the MIT License.
5
5
  */
6
6
  import EventEmitter from 'eventemitter3';
@@ -443,20 +443,22 @@ function _set_prototype_of$z(o, p) {
443
443
  /**
444
444
  * 销毁控件
445
445
  */ _proto.destroy = function destroy() {
446
- var _this___options, _this_$container_remove, _this_$container;
446
+ var _this___options, _this_$container, _this_$container_remove, _this_$container1;
447
447
  if (this._camelCaseName) {
448
448
  this.emit("Control." + this._camelCaseName + "Destroy");
449
449
  }
450
- if (((_this___options = this.__options) == null ? void 0 : _this___options.controlType) !== 'block') this.$container.removeEventListener('dblclick', this._onDBlClick);
450
+ // 用可选链与下面的 click 解绑保持一致:destroy() 之后 $container 会被置空,
451
+ // 重复 destroy(例如主题卸载控件后调用方又手动销毁一次)不应抛错
452
+ if (((_this___options = this.__options) == null ? void 0 : _this___options.controlType) !== 'block') (_this_$container = this.$container) == null ? void 0 : _this_$container.removeEventListener('dblclick', this._onDBlClick);
451
453
  // 移除 click 监听
452
454
  if (this._onClickHandler) {
453
- var _this_$container1;
454
- (_this_$container1 = this.$container) == null ? void 0 : _this_$container1.removeEventListener('click', this._onClickHandler);
455
+ var _this_$container2;
456
+ (_this_$container2 = this.$container) == null ? void 0 : _this_$container2.removeEventListener('click', this._onClickHandler);
455
457
  this._onClickHandler = null;
456
458
  }
457
459
  this._active = false;
458
460
  this.removeAllListeners();
459
- (_this_$container = this.$container) == null ? void 0 : (_this_$container_remove = _this_$container.remove) == null ? void 0 : _this_$container_remove.call(_this_$container);
461
+ (_this_$container1 = this.$container) == null ? void 0 : (_this_$container_remove = _this_$container1.remove) == null ? void 0 : _this_$container_remove.call(_this_$container1);
460
462
  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
461
463
  this.$container = null;
462
464
  };
@@ -566,6 +568,45 @@ function _set_prototype_of$z(o, p) {
566
568
  * ```
567
569
  */ Control.supportedPlayTypes = [].concat(PLAY_TYPES);
568
570
 
571
+ /**
572
+ * HTML 转义
573
+ *
574
+ * 控件大量使用「模板字符串拼 HTML + innerHTML」的写法,只要拼进去的值来自
575
+ * 播放地址、接口返回或多语言配置,就存在注入风险。能改用 `textContent` /
576
+ * `createElement` 的地方应优先改用 DOM API;确实需要拼字符串时,所有外部
577
+ * 数据都必须先过这个函数。
578
+ *
579
+ * 同时覆盖两种语境:
580
+ * - 文本内容:`<span>${escapeHtml(v)}</span>`
581
+ * - 属性值:`<span title="${escapeHtml(v)}">`
582
+ *
583
+ * @remarks 用一次 `replace` 扫描完成,不存在「先转 `&` 再转其他」导致的二次转义。
584
+ */ /** 需要转义的字符与对应实体 */ var HTML_ESCAPE_MAP = {
585
+ '&': '&amp;',
586
+ '<': '&lt;',
587
+ '>': '&gt;',
588
+ '"': '&quot;',
589
+ "'": '&#39;'
590
+ };
591
+ /**
592
+ * 转义 HTML 中有特殊含义的字符
593
+ *
594
+ * @param value - 任意值,`null` / `undefined` 归一成空字符串
595
+ * @returns 可安全拼进 HTML 文本或双引号属性值的字符串
596
+ * @since 3.1.8
597
+ * @example
598
+ * ```ts
599
+ * escapeHtml('x" onerror="alert(1)'); // 'x&quot; onerror=&quot;alert(1)'
600
+ * escapeHtml('<img src=x>'); // '&lt;img src=x&gt;'
601
+ * escapeHtml(undefined); // ''
602
+ * ```
603
+ */ function escapeHtml(value) {
604
+ if (value === null || value === undefined) return '';
605
+ return String(value).replace(/[&<>"']/g, function(char) {
606
+ return HTML_ESCAPE_MAP[char];
607
+ });
608
+ }
609
+
569
610
  function _extends$y() {
570
611
  _extends$y = Object.assign || function assign(target) {
571
612
  for(var i = 1; i < arguments.length; i++){
@@ -621,11 +662,13 @@ var LOADING_DEFAULT_OPTIONS = {};
621
662
  this.$container.innerHTML = this._options.render();
622
663
  } else {
623
664
  var _this_locale;
624
- this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + "-loading-dot " + PREFIX_CLASS + '-loading-dot-load">\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n </span>\n <div class="' + PREFIX_CLASS + '-loading-text">' + (((_this_locale = this.locale) == null ? void 0 : _this_locale.LOADING) || 'loading...') + "</div>\n ";
665
+ this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + "-loading-dot " + PREFIX_CLASS + '-loading-dot-load">\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n <i class="' + PREFIX_CLASS + '-loading-dot-item"></i>\n </span>\n <div class="' + PREFIX_CLASS + '-loading-text">' + escapeHtml(((_this_locale = this.locale) == null ? void 0 : _this_locale.LOADING) || 'loading...') + "</div>\n ";
625
666
  }
626
667
  };
627
668
  /**
628
669
  * 动画展示
670
+ *
671
+ * @remarks `html` 会原样写入 `innerHTML`,**不做转义**,仅接受可信内容。
629
672
  * @param html 自定义动画内容, 如果不存在则使用默认动画
630
673
  */ _proto.show = function show(html) {
631
674
  if (html) this.$container.innerHTML = html;
@@ -714,16 +757,21 @@ var POSTER_OPTIONS = {
714
757
  * 设置封面 这里不对 poster 进行缓存,如果有值优先使用,如果没有值优先使用 初始化传入的值
715
758
  * @param {string} poster 封面地址或 base64 数据
716
759
  */ _proto.setPoster = function setPoster(poster) {
717
- var // eslint-disable-next-line @typescript-eslint/unbound-method
718
- // prettier-ignore
719
- _this_$container_querySelector;
720
760
  poster = poster != null ? poster : this._options.poster;
721
- if (poster === '') {
722
- this.$container.innerHTML = '';
761
+ // 空值一律清空。原先只判 `=== ''`,poster 为 undefined 时会渲染出
762
+ // `<img src="undefined">`,浏览器会去请求 ./undefined 再触发 error 回调
763
+ if (!poster) {
764
+ this.$container.replaceChildren();
723
765
  return;
724
766
  }
725
- this.$container.innerHTML = '<img class="' + PREFIX_CLASS + '-poster-img" src="' + poster + '" />';
726
- (_this_$container_querySelector = this.$container.querySelector("." + PREFIX_CLASS + "-poster-img")) == null ? void 0 : _this_$container_querySelector.addEventListener("error", this._imgLoadErrorEvent);
767
+ // 用 DOM API 而不是拼 innerHTML:封面地址可能来自远程模板接口或业务动态传入,
768
+ // 拼进 src="${poster}" 时 `x" onerror="...` 能闭合属性挂上事件处理器
769
+ var $img = document.createElement('img');
770
+ $img.className = "" + PREFIX_CLASS + "-poster-img";
771
+ $img.src = poster;
772
+ // eslint-disable-next-line @typescript-eslint/unbound-method
773
+ $img.addEventListener('error', this._imgLoadErrorEvent);
774
+ this.$container.replaceChildren($img);
727
775
  };
728
776
  /**
729
777
  * 展示封面 这里不对 poster 进行缓存, 如果有值优先使用, 如果没有值优先使用 初始化传入的值
@@ -783,7 +831,9 @@ var Icons = {
783
831
  return '<svg width="1em" height="1em" viewBox="0 0 24 24" focusable="false" aria-hidden="true" data-icon="talk-growth">\n <g fill="currentColor" stroke="currentColor">\n <path stroke="none" d="M9.22313 18.9543C9.6588 18.9543 10.0189 19.2133 10.0759 19.5494L10.0837 19.6428L10.0837 21.7847C10.0837 22.1649 9.69841 22.4732 9.22313 22.4732C8.78745 22.4732 8.42739 22.2142 8.37041 21.8781L8.36255 21.7847L8.36255 19.6428C8.36255 19.2626 8.74784 18.9543 9.22313 18.9543Z" fill-rule="evenodd" />\n <path d="M16.5323 11.3779L16.5323 11.5872C16.5323 15.7472 13.1599 19.1197 8.99981 19.1197C4.83971 19.1197 1.46729 15.7472 1.46729 11.5872L1.46729 11.4335" fill-rule="evenodd" fill="none" stroke-width="1.5" />\n <path stroke="none" d="M4.07861 6.12978C4.07861 3.589 6.30476 1.5293 9.05085 1.5293C11.7969 1.5293 14.0231 3.589 14.0231 6.12978L14.0231 12.075C14.0231 14.6158 11.7969 16.6755 9.05085 16.6755C6.30476 16.6755 4.07861 14.6158 4.07861 12.075L4.07861 6.12978ZM5.57861 12.075L5.57861 6.12978C5.57861 5.94083 5.597 5.75561 5.63376 5.57412C5.67605 5.36539 5.74265 5.16158 5.83357 4.9627C5.86625 4.8912 5.90164 4.82121 5.93974 4.75272C6.09781 4.4685 6.30245 4.21019 6.55365 3.97777C6.64206 3.89597 6.73424 3.81921 6.83019 3.7475C7.0816 3.55959 7.3589 3.40632 7.66207 3.28767C7.79552 3.23545 7.93107 3.19114 8.06871 3.15475C8.38503 3.07111 8.71241 3.0293 9.05085 3.0293C9.38929 3.0293 9.71668 3.07112 10.033 3.15475C10.1706 3.19114 10.3062 3.23545 10.4396 3.28767C10.7428 3.40632 11.0201 3.55959 11.2715 3.74749C11.3675 3.81921 11.4596 3.89596 11.548 3.97777C11.7993 4.2102 12.0039 4.46853 12.162 4.75276C12.2001 4.82124 12.2354 4.89122 12.2681 4.9627C12.359 5.16157 12.4256 5.36536 12.4679 5.57407C12.5047 5.75558 12.5231 5.94082 12.5231 6.12978L12.5231 12.075C12.5231 12.264 12.5047 12.4492 12.4679 12.6307C12.4256 12.8394 12.359 13.0432 12.2681 13.2421C12.2355 13.3136 12.2001 13.3835 12.162 13.452C12.0039 13.7362 11.7993 13.9946 11.548 14.227C11.4596 14.3088 11.3675 14.3856 11.2715 14.4573C11.0201 14.6452 10.7428 14.7985 10.4396 14.9171C10.3062 14.9693 10.1706 15.0136 10.033 15.05C9.71667 15.1337 9.38929 15.1755 9.05085 15.1755C8.71241 15.1755 8.38503 15.1337 8.06871 15.05C7.93107 15.0136 7.79552 14.9693 7.66207 14.9171C7.3589 14.7985 7.0816 14.6452 6.83019 14.4573C6.73424 14.3856 6.64206 14.3088 6.55365 14.227C6.30244 13.9946 6.09779 13.7363 5.93972 13.452C5.90163 13.3836 5.86625 13.3136 5.83357 13.2421C5.74265 13.0432 5.67605 12.8394 5.63377 12.6307C5.597 12.4492 5.57861 12.264 5.57861 12.075Z" fill-rule="evenodd" />\n </g>\n <g class="' + prefix + '-icon-talk-growth-dot">\n <path class="' + prefix + '-icon-talk-growth-dot1" d="M19.1333 6.40039L22.8667 6.40039" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n <path class="' + prefix + '-icon-talk-growth-dot2" d="M19.1333 10.1338L21.9331 10.1338" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n <path class="' + prefix + '-icon-talk-growth-dot3" d="M19.1333 13.8672L20.9995 13.8672" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n <path class="' + prefix + '-icon-talk-growth-dot4" d="M19.1333 17.6001L20.0669 17.6001" stroke="currentColor" stroke-linecap="round" stroke-width="1.86666667" />\n </g>\n </svg>';
784
832
  },
785
833
  /** 语音广播 */ broadcast: '\n <svg width="1em" height="1em" viewBox="0 0 24 24" fill="currentColor" stroke="none" focusable="false" aria-hidden="true" data-icon="broadcast">\n <g>\n <path id="矢量 1" d="m8.52109,6.76609l6.17823,-2.91335c0.2485,-0.11718 0.5027,-0.19531 0.7627,-0.2351c0.2034,-0.03077 0.4104,-0.03809 0.6211,-0.02173c0.2092,0.01636 0.4116,0.05493 0.6069,0.11621c0.2278,0.07129 0.4461,0.1731 0.6548,0.30542c0.2087,0.13232 0.394,0.28638 0.5557,0.46216l0.0002,0l0,0c0.1384,0.15064 0.2598,0.31714 0.3638,0.49951c0.1047,0.18335 0.1865,0.37354 0.2451,0.57081c0.0752,0.25219 0.1128,0.51562 0.1128,0.79004l0,10.64651c0,0.2744 -0.0376,0.5379 -0.1128,0.7901l0,0c-0.0586,0.197 -0.1404,0.3874 -0.2451,0.5708c-0.104,0.1823 -0.2254,0.3488 -0.364,0.4995c-0.1617,0.1758 -0.347,0.3298 -0.5557,0.4621c-0.2087,0.1324 -0.427,0.2342 -0.6548,0.3054c-0.1953,0.0611 -0.3977,0.0999 -0.6069,0.1163c-0.2107,0.0163 -0.4175,0.009 -0.6209,-0.0218c-0.2602,-0.0398 -0.5144,-0.1181 -0.7629,-0.2351l-5.45044,-2.5703l0,2.759c0,0.1036 -0.01831,0.1995 -0.05494,0.2879c-0.03662,0.0886 -0.09155,0.1692 -0.16479,0.2424c-0.14624,0.1465 -0.32324,0.2197 -0.53027,0.2197l-2,0c-0.14209,0 -0.27344,-0.0373 -0.39429,-0.112c-0.12085,-0.0745 -0.21289,-0.1756 -0.27661,-0.3025l-1.99268,-3.9856c-0.06225,-0.0234 -0.12402,-0.0481 -0.18555,-0.074c-0.26953,-0.114 -0.52417,-0.2502 -0.7644,-0.4084c-0.26636,-0.1758 -0.51489,-0.3789 -0.74512,-0.6094c-0.23047,-0.2302 -0.43359,-0.4788 -0.60937,-0.7451c-0.1582,-0.2403 -0.29444,-0.4949 -0.40845,-0.7644c-0.11328,-0.2679 -0.20068,-0.5413 -0.26245,-0.8206l0,0c-0.07398,-0.3347 -0.11108,-0.6775 -0.11108,-1.0286c0,-0.351 0.0371,-0.6938 0.11108,-1.0285c0.06177,-0.2793 0.14917,-0.5528 0.26245,-0.8206c0.11401,-0.26953 0.25025,-0.52417 0.40845,-0.7644c0.17578,-0.26636 0.3789,-0.5149 0.60937,-0.74512c0.23023,-0.23047 0.47876,-0.4336 0.74512,-0.60938l0,0c0.24023,-0.1582 0.49487,-0.29444 0.7644,-0.40845c0.26783,-0.11328 0.54126,-0.20068 0.82056,-0.26245l0,0l0,0l0,0c0.33472,-0.07398 0.67749,-0.11109 1.02857,-0.11109l2.93872,0c0.02636,-0.0166 0.05444,-0.03198 0.08349,-0.04589zm0.72876,8.47948l6.08937,2.8716c0.1287,0.0606 0.2598,0.0987 0.3935,0.114c0.0772,0.0088 0.1551,0.0103 0.2337,0.0042c0.0857,-0.0068 0.1687,-0.0217 0.2495,-0.0452c0.1133,-0.0329 0.2219,-0.0822 0.3257,-0.1479c0.104,-0.0659 0.1948,-0.1431 0.2729,-0.2317c0.0554,-0.063 0.1045,-0.1318 0.147,-0.2063c0.0393,-0.0686 0.0713,-0.1397 0.0962,-0.2131c0.043,-0.1277 0.0647,-0.2625 0.0647,-0.4046l0,-10.64651c0,-0.14209 -0.0217,-0.2771 -0.0647,-0.40454c-0.0249,-0.07349 -0.0569,-0.14454 -0.0962,-0.21314c-0.0425,-0.07471 -0.0916,-0.14331 -0.147,-0.2063c-0.0781,-0.08862 -0.1689,-0.16577 -0.2729,-0.23169c-0.1038,-0.06567 -0.2124,-0.11523 -0.3257,-0.14795c-0.0808,-0.02344 -0.1638,-0.03833 -0.2495,-0.04517c-0.0786,-0.0061 -0.1565,-0.00463 -0.2337,0.00415c-0.1337,0.01539 -0.2648,0.05347 -0.3935,0.11402l-6.09034,2.87208l0.00097,7.16405zm13.58447,-7.9121l-2,1c-0.3757,0.18775 -0.8184,0.04029 -1.0063,-0.33545c-0.0552,-0.11035 -0.0813,-0.22656 -0.0813,-0.34033c0,-0.27344 0.1516,-0.53321 0.4167,-0.66602l2,-1c0.3757,-0.18775 0.8186,-0.04004 1.0064,0.33545c0.0551,0.11035 0.0813,0.22656 0.0813,0.34033c0,0.27368 -0.1514,0.53345 -0.4168,0.66602zm-15.08544,8.9785l-2.08667,0l1.30029,2.6006l0.78638,0l0,-2.6006zm0,-7.99998l-2.25,0c-0.24976,0 -0.49317,0.02734 -0.73023,0.08179c-0.18188,0.04174 -0.36011,0.09961 -0.53467,0.17334c-0.17944,0.07593 -0.34961,0.1665 -0.51049,0.27124c-0.18702,0.12231 -0.36133,0.26416 -0.52271,0.42554c-0.16138,0.16137 -0.30322,0.33569 -0.42554,0.52267c-0.10473,0.1609 -0.19531,0.3311 -0.27124,0.5105c-0.07373,0.1746 -0.13159,0.3528 -0.17334,0.5347c-0.05444,0.2371 -0.08178,0.4805 -0.08178,0.7302c0,0.2498 0.02734,0.4932 0.08178,0.7303c0.04175,0.1818 0.09961,0.3601 0.17334,0.5346c0.07593,0.1795 0.16651,0.3496 0.27124,0.5105c0.12232,0.187 0.26416,0.3614 0.42554,0.5227c0.16138,0.1614 0.33569,0.3033 0.52271,0.4256c0.16088,0.1047 0.33105,0.1953 0.51049,0.2712c0.17456,0.0737 0.35279,0.1316 0.53467,0.1734c0.23706,0.0544 0.48047,0.0817 0.73023,0.0817l2.25097,0l-0.00097,-6.49998zm12.75004,2.60058l2,0c0.4199,0 0.75,0.3301 0.75,0.75c0,0.4199 -0.3301,0.75 -0.75,0.75l-2,0c-0.42,0 -0.75,-0.3301 -0.75,-0.75c0,-0.4199 0.33,-0.75 0.75,-0.75zm0.3354,4.0791l2,1c0.2654,0.1326 0.4168,0.3924 0.4168,0.6661c0,0.1137 -0.0262,0.2299 -0.0813,0.3403c-0.1878,0.3755 -0.6307,0.5232 -1.0064,0.3354l-2,-1c-0.2651,-0.1328 -0.4167,-0.3925 -0.4167,-0.666c0,-0.1138 0.0261,-0.23 0.0813,-0.3403c0.1879,-0.3758 0.6306,-0.5232 1.0063,-0.3355z" fill-rule="evenodd"/>\n </g>\n</svg>',
786
- /** AI对话 */ aiChat: '\n <svg width="24" height="24" viewBox="0 0 24 24" fill="none">\n <defs>\n <linearGradient id="gradient0" x1="10.667" x2="10.667" y1="0.667" y2="20.667">\n <stop stop-color="#33D9FF" offset="0.354"/>\n <stop stop-color="#CE77FF" offset="1"/>\n </linearGradient>\n <linearGradient id="gradient1" x1="8.318" x2="8.318" y1="0" y2="18.001">\n <stop stop-color="#33D9FF" offset="0.354"/>\n <stop stop-color="#CE77FF" offset="1"/>\n </linearGradient>\n </defs>\n \n <g transform="scale(1.2) translate(-3, -0.5)">\n <path d="M6.917 0C8.776 0 10.52 0.738 11.808 2.026C12.45 2.668 12.961 3.43 13.309 4.269C13.442 4.588 13.29 4.954 12.971 5.086C12.653 5.218 12.287 5.067 12.155 4.748C11.87 4.061 11.451 3.436 10.925 2.91C9.868 1.854 8.441 1.25 6.917 1.25C3.787 1.25 1.25 3.787 1.25 6.917C1.25 10.047 3.787 12.584 6.917 12.584C8.441 12.584 9.868 11.981 10.925 10.925C11.169 10.681 11.564 10.681 11.808 10.925C12.052 11.169 12.052 11.565 11.808 11.809C10.666 12.951 9.164 13.661 7.542 13.807L7.542 17.376C7.542 17.721 7.262 18.001 6.917 18.001C6.572 18.001 6.292 17.721 6.292 17.376L6.292 13.807C2.765 13.49 0 10.527 0 6.917C0 3.097 3.097 0 6.917 0ZM11.051 6.495C11.295 6.739 11.295 7.135 11.051 7.379L7.547 10.882C7.303 11.126 6.908 11.126 6.664 10.882C6.42 10.638 6.42 10.242 6.664 9.998L10.167 6.495C10.411 6.251 10.807 6.251 11.051 6.495ZM8.566 4.559L6.501 9.5C6.368 9.818 6.002 9.969 5.684 9.836C5.365 9.703 5.215 9.336 5.348 9.018L5.712 8.147L4.094 6.529L3.198 6.884C2.904 7.001 2.575 6.878 2.424 6.61C2.297 6.289 2.418 5.849 2.739 5.722L7.76 3.736C8.274 3.533 8.779 4.049 8.566 4.559ZM16.614 6.171C16.642 6.236 16.642 6.309 16.614 6.373L15.964 7.848C15.936 7.912 15.936 7.986 15.964 8.05L16.614 9.525C16.67 9.651 16.613 9.799 16.486 9.855C16.422 9.883 16.349 9.883 16.285 9.855L14.809 9.205C14.745 9.176 14.672 9.176 14.608 9.205L13.133 9.855C13.006 9.911 12.859 9.853 12.803 9.727C12.775 9.662 12.775 9.589 12.803 9.525L13.453 8.05C13.482 7.986 13.482 7.912 13.453 7.848L12.803 6.373C12.747 6.247 12.805 6.099 12.931 6.043C12.995 6.015 13.068 6.015 13.133 6.043L14.608 6.694C14.672 6.722 14.745 6.722 14.809 6.694L16.285 6.043C16.411 5.988 16.558 6.045 16.614 6.171ZM6.841 5.443L5.361 6.028L6.233 6.9L6.841 5.443Z" fill="url(#gradient1)" transform="matrix(0.707 -0.707 0.707 0.707 0.085 9.868)"/>\n </g>\n </svg>\n ',
834
+ /** AI对话 */ aiChat: function aiChat(line_id) {
835
+ return '<svg width="1em" height="1em" viewBox="2 2 18 18" fill="none">\n <defs>\n <linearGradient id="' + line_id + '" x1="8.31767559" x2="8.31767559" y1="0" y2="18.0010872" gradientUnits="userSpaceOnUse">\n <stop stop-color="rgb(51,217,255)" offset="0.354430377" stop-opacity="1" />\n <stop stop-color="rgb(206,119,255)" offset="1" stop-opacity="1" />\n </linearGradient>\n </defs>\n <path d="M6.91721 0C8.77619 0 10.52 0.737553 11.8084 2.026C12.4502 2.6678 12.9613 3.42996 13.3093 4.26934C13.4416 4.58819 13.2903 4.95385 12.9714 5.08607C12.6526 5.21828 12.2869 5.06698 12.1547 4.74813C11.8697 4.06081 11.4508 3.43616 10.9245 2.90989C9.86818 1.85353 8.44127 1.25 6.91721 1.25C3.7873 1.25 1.25 3.7873 1.25 6.91721C1.25 10.0471 3.7873 12.5844 6.91721 12.5844C8.44127 12.5844 9.86818 11.9809 10.9245 10.9245C11.1686 10.6805 11.5643 10.6805 11.8084 10.9245C12.0525 11.1686 12.0525 11.5643 11.8084 11.8084C10.6655 12.9513 9.16441 13.6607 7.5424 13.8064L7.54221 17.3761C7.54221 17.7213 7.26239 18.0011 6.91721 18.0011C6.57203 18.0011 6.29221 17.7213 6.29221 17.3761L6.29175 13.8065C2.76456 13.4904 0 10.5267 0 6.91721C0 3.09694 3.09694 0 6.91721 0ZM11.0506 6.49482C11.2947 6.7389 11.2947 7.13463 11.0506 7.37871L7.54746 10.8819C7.30339 11.126 6.90766 11.126 6.66358 10.8819C6.4195 10.6378 6.4195 10.2421 6.66358 9.998L10.1668 6.49482C10.4108 6.25075 10.8066 6.25075 11.0506 6.49482ZM8.56622 4.55861L6.50122 9.49996C6.36812 9.81845 6.00204 9.96873 5.68355 9.83564C5.36507 9.70254 5.21478 9.33646 5.34788 9.01798L5.71248 8.14735L4.09417 6.52917L3.19846 6.88426C2.90422 7.00062 2.57458 6.87812 2.42392 6.60965C2.29698 6.28866 2.41781 5.84878 2.7388 5.72184L7.75973 3.73641C8.27389 3.53309 8.77942 4.04845 8.56622 4.55861ZM16.614 6.1714C16.6424 6.23564 16.6424 6.30883 16.614 6.37307L15.9639 7.84813C15.9356 7.91237 15.9356 7.98556 15.9639 8.0498L16.614 9.52486C16.6697 9.6512 16.6125 9.79877 16.4861 9.85446C16.4219 9.88277 16.3487 9.88277 16.2845 9.85446L14.8094 9.20428C14.7452 9.17597 14.672 9.17597 14.6077 9.20428L13.1327 9.85446C13.0063 9.91015 12.8588 9.85287 12.8031 9.72653C12.7747 9.66229 12.7747 9.5891 12.8031 9.52486L13.4532 8.0498C13.4816 7.98556 13.4816 7.91237 13.4532 7.84813L12.8031 6.37307C12.7474 6.24673 12.8047 6.09916 12.931 6.04347C12.9952 6.01516 13.0684 6.01516 13.1327 6.04347L14.6077 6.69365C14.672 6.72196 14.7452 6.72196 14.8094 6.69365L16.2845 6.04347C16.4108 5.98778 16.5584 6.04506 16.614 6.1714ZM6.84128 5.44268L5.36083 6.02833L6.2325 6.9L6.84128 5.44268Z" fill="url(#' + line_id + ')" fill-rule="nonzero" transform="matrix(0.707107,-0.707107,0.707107,0.707107,0.0854492,9.86798)" />\n </svg>\n ';
836
+ },
787
837
  /** 相机/截图 */ capturePicture: '<svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" stroke="currentColor" focusable="false" aria-hidden="true" data-icon="capture-picture">\n <path d="M6.94 7.51C7.34 7.51 7.7 7.28 7.86 6.91L8.43 5.6C8.59 5.23 8.95 5 9.35 5L14.69 5C15.04 5 15.37 5.18 15.55 5.49L16.45 7.02C16.63 7.33 16.96 7.51 17.31 7.51L18.5 7.51C19.6 7.51 20.5 8.41 20.5 9.51L20.5 17C20.5 18.1 19.6 19 18.5 19L5.5 19C4.39 19 3.5 18.1 3.5 17L3.5 9.51C3.5 8.41 4.39 7.51 5.5 7.51L6.94 7.51Z" stroke-width="1.5"/>\n <circle cx="12" cy="12.525146" r="3.068097" stroke-width="1.5"/>\n </svg>',
788
838
  /** 电子放大 */ zoom: '<svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" stroke="currentColor" focusable="false" aria-hidden="true" data-icon="zoom">\n <ellipse cx="10.914795" cy="11.25" rx="8.004043" ry="8.25" stroke-width="1.5"/>\n <path d="M14.31 11.04L8.05 11.14" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M11.13 14.22L11.23 7.95" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M16.45 17.83L19.36 20.83" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n </svg>',
789
839
  /** 隐私遮蔽 */ privacyMasking: '<svg width="1em" height="1em" viewBox="0 0 24 24" fill="none" stroke="currentColor" focusable="false" aria-hidden="true" data-icon="privacy-masking">\n <path d="M12 19C11.15 19 10.31 18.82 9.49 18.5" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M20.88 12.46C18.98 15.96 15.49 19 11.99 19" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M19.07 8.92C19.76 9.72 20.38 10.61 20.88 11.53C21.03 11.82 21.03 12.17 20.88 12.46" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M5 19L19 5" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M9.77 14.22C8.54 12.99 8.54 11 9.77 9.77C11 8.54 12.99 8.54 14.22 9.77" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n <path d="M17.04 6.95C15.49 5.75 13.74 5 12 5C8.5 5 5.01 8.03 3.11 11.53C2.96 11.82 2.96 12.17 3.11 12.46C4.06 14.21 5.41 15.84 6.95 17.04" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round"/>\n </svg>',
@@ -815,7 +865,9 @@ var Icons = {
815
865
  var attrStr = '';
816
866
  if (attr) {
817
867
  Object.keys(attr).forEach(function(key) {
818
- if (!(attr[key] === undefined || attr[key] === null)) attrStr += key + '="' + attr[key] + '"';
868
+ // 属性值必须转义:所有控件的 title 都来自 options.locales,
869
+ // 不转义时 `x" onmouseover="alert(1)` 这样的文案可以闭合属性并挂上事件
870
+ if (!(attr[key] === undefined || attr[key] === null)) attrStr += key + '="' + escapeHtml(attr[key]) + '"';
819
871
  });
820
872
  }
821
873
  return '<span class="' + PREFIX_CLASS + "-icon " + PREFIX_CLASS + "-icon-" + type + '" ' + attrStr + ">" + svg + "</span>";
@@ -879,7 +931,7 @@ var IconComponents = {
879
931
  },
880
932
  aiChat: function aiChat(attr) {
881
933
  if (attr === void 0) attr = {};
882
- return createIcon(Icons.aiChat, 'aiChat', attr);
934
+ return createIcon(Icons.aiChat(attr.line_id), 'aiChat', attr);
883
935
  },
884
936
  talkGrowth: function talkGrowth(attr) {
885
937
  if (attr === void 0) attr = {};
@@ -1070,7 +1122,8 @@ var MESSAGE_DEFAULT_OPTIONS = {};
1070
1122
  this._$toast = document.createElement('div');
1071
1123
  this._$toast.classList.add("" + PREFIX_CLASS + "-toast");
1072
1124
  }
1073
- this._$toast.innerHTML = '<div class="' + PREFIX_CLASS + '-toast-content">' + this._getIcon(type) + '<span class="' + PREFIX_CLASS + "-toast-msg " + PREFIX_CLASS + "-toast-" + type + '">' + (msg || '') + "</span></div>";
1125
+ // msg 是 EVENTS.message 的载荷,内核与接口的错误信息都走这个通道,必须转义
1126
+ this._$toast.innerHTML = '<div class="' + PREFIX_CLASS + '-toast-content">' + this._getIcon(type) + '<span class="' + PREFIX_CLASS + "-toast-msg " + PREFIX_CLASS + "-toast-" + type + '">' + escapeHtml(msg) + "</span></div>";
1074
1127
  this.options.rootContainer.appendChild(this._$toast);
1075
1128
  if (duration > 0) {
1076
1129
  this._toastTimer = setTimeout(function() {
@@ -1102,7 +1155,7 @@ var MESSAGE_DEFAULT_OPTIONS = {};
1102
1155
  //
1103
1156
  this.$container.innerHTML = this.options.render(msg, duration, type);
1104
1157
  } else {
1105
- this.$container.innerHTML = '<div class="' + PREFIX_CLASS + "-message-content " + PREFIX_CLASS + "-message-" + type + '">' + (msg || '') + "</div>";
1158
+ this.$container.innerHTML = '<div class="' + PREFIX_CLASS + "-message-content " + PREFIX_CLASS + "-message-" + type + '">' + escapeHtml(msg) + "</div>";
1106
1159
  }
1107
1160
  //
1108
1161
  this.$container.style.display = 'flex';
@@ -2009,9 +2062,9 @@ var VOLUME_DEFAULT_OPTIONS = {
2009
2062
  // 这里不要用 click 事件,因为拖动音量大小时鼠标移动到图标上会触发 click
2010
2063
  // prettier-ignore
2011
2064
  delegate(this.$container, "." + PREFIX_CLASS + "-control-volume", "mousedown", function() {
2012
- if (!_this.$container.classList.contains("" + PREFIX_CLASS + "-disabled")) {
2013
- _this._toggleMute();
2014
- }
2065
+ // 禁用判断交给 _toggleMute 里的 this.disabled(状态是权威来源,
2066
+ // class 只是它的呈现),避免两处各判一遍
2067
+ _this._toggleMute();
2015
2068
  });
2016
2069
  };
2017
2070
  _create_class$6(Volume, [
@@ -5383,11 +5436,14 @@ function _ts_generator$6(thisArg, body) {
5383
5436
  */ function getThemeDataByTemplate(theme, id) {
5384
5437
  return _async_to_generator$6(function() {
5385
5438
  var _theme_options_token_httpToken, _theme_options_token, // 中止上一个在途请求,并为本次请求创建可中止的信号(destroy 时会 abort)
5386
- _theme__templateAbortController, url, controller;
5439
+ _theme__templateAbortController, accessToken, url, controller;
5387
5440
  return _ts_generator$6(this, function(_state) {
5388
5441
  switch(_state.label){
5389
5442
  case 0:
5390
- url = theme.options.env.domain + "/api/service/media/template/getDetail?accessToken=" + (theme.options.accessToken || ((_theme_options_token = theme.options.token) == null ? void 0 : (_theme_options_token_httpToken = _theme_options_token.httpToken) == null ? void 0 : _theme_options_token_httpToken.url)) + "&id=" + id;
5443
+ accessToken = theme.options.accessToken || ((_theme_options_token = theme.options.token) == null ? void 0 : (_theme_options_token_httpToken = _theme_options_token.httpToken) == null ? void 0 : _theme_options_token_httpToken.url);
5444
+ // 查询参数逐个 encodeURIComponent,防止 `&` `#` `=` 等字符注入额外参数或截断 URL(SECURITY_AUDIT M1)
5445
+ // 不用 `new URL()`:env.domain 允许为空(同源相对路径)或带路径前缀,URL 构造会抛错或丢掉前缀
5446
+ url = theme.options.env.domain + "/api/service/media/template/getDetail?accessToken=" + encodeURIComponent(String(accessToken)) + "&id=" + encodeURIComponent(String(id));
5391
5447
  (_theme__templateAbortController = theme._templateAbortController) == null ? void 0 : _theme__templateAbortController.abort();
5392
5448
  controller = new AbortController();
5393
5449
  theme._templateAbortController = controller;
@@ -5715,7 +5771,9 @@ function _filterLeftRightControls(btnList) {
5715
5771
  ];
5716
5772
  // 渲染主题模板
5717
5773
  themeData = TEMPLATES[data];
5718
- if (!data) {
5774
+ // 修复:此前判的是 `!data`,而这个分支里 data 必然是非空字符串,告警永远不会发出,
5775
+ // 传了不存在的模板名只会静默返回 undefined。应当判查表结果。
5776
+ if (!themeData) {
5719
5777
  (_theme_logger = theme.logger) == null ? void 0 : _theme_logger.warn("Theme template " + data + " is not exist!");
5720
5778
  themeData = null;
5721
5779
  }
@@ -6406,7 +6464,9 @@ function _set_prototype_of$k(o, p) {
6406
6464
  this._ptzControl.updateOptions(options);
6407
6465
  }
6408
6466
  if (this._ptzControl1) {
6409
- this._ptzControl.updateOptions(options);
6467
+ // 修复:此前误写成 this._ptzControl,移动端扩展区域的云台拿不到新凭据,
6468
+ // 换 accessToken 或切设备后移动端云台会继续用旧值请求
6469
+ this._ptzControl1.updateOptions(options);
6410
6470
  }
6411
6471
  };
6412
6472
  _proto._onSpeedChange = function _onSpeedChange(speed) {
@@ -7172,6 +7232,83 @@ function _ts_generator$3(thisArg, body) {
7172
7232
  'live'
7173
7233
  ];
7174
7234
 
7235
+ /**
7236
+ * UUID 生成(RFC 4122 v4)
7237
+ *
7238
+ * 按可用性三级降级:
7239
+ *
7240
+ * | 顺序 | 实现 | 说明 |
7241
+ * | ---- | ------------------------ | ------------------------------------------------------------- |
7242
+ * | 1 | `crypto.randomUUID()` | 原生实现,最快;**仅在安全上下文(HTTPS / localhost)可用** |
7243
+ * | 2 | `crypto.getRandomValues` | 密码学强度随机数手工组装;HTTP 页面下也可用 |
7244
+ * | 3 | `Math.random()` | 兜底,**不具密码学强度**,只适合做 DOM id 这类无安全要求的标识 |
7245
+ *
7246
+ * 之所以不能只用 `crypto.randomUUID()`:播放器会被嵌到 HTTP 页面里,
7247
+ * 那种场景下它是 `undefined`,必须有降级路径。
7248
+ *
7249
+ * @remarks 用 `crypto` 而非 `window.crypto`,以便在 worker 中也能工作(worker 里没有 `window`)。
7250
+ */ /** 0~255 对应的两位十六进制查表,避免每个字节都做一次 toString + 手工补零 */ var HEX_BY_BYTE = [];
7251
+ for(var i = 0; i < 256; i++){
7252
+ // + 0x100 保证结果是三位,再切掉首位,等价于补零到两位(不用 padStart,es5 目标下它需要 polyfill)
7253
+ HEX_BY_BYTE.push((i + 0x100).toString(16).slice(1));
7254
+ }
7255
+ /**
7256
+ * 取 16 个随机字节
7257
+ *
7258
+ * @returns 长度为 16 的字节数组,每项 0~255
7259
+ */ function randomBytes() {
7260
+ var bytes = [];
7261
+ if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {
7262
+ var buffer = new Uint8Array(16);
7263
+ crypto.getRandomValues(buffer);
7264
+ for(var i = 0; i < 16; i++){
7265
+ bytes.push(buffer[i]);
7266
+ }
7267
+ return bytes;
7268
+ }
7269
+ // 兜底:不具密码学强度,不要用于 token / 密钥一类场景
7270
+ for(var i1 = 0; i1 < 16; i1++){
7271
+ bytes.push(Math.floor(Math.random() * 256));
7272
+ }
7273
+ return bytes;
7274
+ }
7275
+ /**
7276
+ * 把 16 个字节按 v4 规范格式化成 `8-4-4-4-12`
7277
+ *
7278
+ * 会就地改写第 6、8 个字节以写入版本号与变体位。
7279
+ *
7280
+ * @param bytes - 长度为 16 的字节数组
7281
+ * @returns 形如 `xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx` 的字符串,`y` 为 8/9/a/b
7282
+ */ function bytesToUuid(bytes) {
7283
+ // 版本号固定为 4(高 4 位置为 0100)
7284
+ bytes[6] = bytes[6] & 0x0f | 0x40;
7285
+ // 变体固定为 RFC 4122(高 2 位置为 10)
7286
+ bytes[8] = bytes[8] & 0x3f | 0x80;
7287
+ var out = '';
7288
+ for(var i = 0; i < 16; i++){
7289
+ // 8-4-4-4-12 的分组位置
7290
+ if (i === 4 || i === 6 || i === 8 || i === 10) out += '-';
7291
+ out += HEX_BY_BYTE[bytes[i]];
7292
+ }
7293
+ return out;
7294
+ }
7295
+ /**
7296
+ * 生成一个 v4 UUID
7297
+ *
7298
+ * @returns 36 位小写 UUID,形如 `f47ac10b-58cc-4372-a567-0e02b2c3d479`
7299
+ * @example
7300
+ * ```ts
7301
+ * import uuid from '@/utils/uuid';
7302
+ *
7303
+ * uuid(); // '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'
7304
+ * ```
7305
+ */ function uuid() {
7306
+ if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
7307
+ return crypto.randomUUID();
7308
+ }
7309
+ return bytesToUuid(randomBytes());
7310
+ }
7311
+
7175
7312
  function asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, key, arg) {
7176
7313
  try {
7177
7314
  var info = gen[key](arg);
@@ -7362,7 +7499,8 @@ function _ts_generator$2(thisArg, body) {
7362
7499
  _proto._render = function _render() {
7363
7500
  var _this_locale;
7364
7501
  this.$container.innerHTML = IconComponents.aiChat({
7365
- title: (_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_AICHAT
7502
+ title: (_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_AICHAT,
7503
+ line_id: 'ezpleyer___AI_CHAT_LINEAR_GRADIENT___' + '' + uuid()
7366
7504
  });
7367
7505
  };
7368
7506
  _proto.reset = function reset(hide) {
@@ -7550,7 +7688,13 @@ function _set_prototype_of$e(o, p) {
7550
7688
  controlType: 'button',
7551
7689
  classNameSuffix: 'rec-dropdown'
7552
7690
  })) || this;
7553
- _this._options = options;
7691
+ _this._options = Object.assign({
7692
+ list: [
7693
+ 'rec',
7694
+ 'cloudRec',
7695
+ 'cloudRecord'
7696
+ ]
7697
+ }, options || {});
7554
7698
  // H5 端不展示直播/回放切换按钮
7555
7699
  if (Utils.isMobile) {
7556
7700
  _this.$container.style.display = 'none';
@@ -7583,7 +7727,8 @@ function _set_prototype_of$e(o, p) {
7583
7727
  }
7584
7728
  };
7585
7729
  _proto._render = function _render() {
7586
- var _this_locale;
7730
+ var _this__options_list, _this_locale;
7731
+ if (((_this__options_list = this._options.list) == null ? void 0 : _this__options_list.length) === 0) ;
7587
7732
  this.$container.innerHTML = IconComponents.recDropdown({
7588
7733
  title: ((_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_REC_DROPDOWN) || '回放'
7589
7734
  });
@@ -7606,8 +7751,8 @@ function _set_prototype_of$e(o, p) {
7606
7751
  // 打开时按控件在视口中的位置决定对齐方式。
7607
7752
  // 此时 picker 已把 $wrapperContent 设为 inline-flex(可测量宽度),
7608
7753
  // 而它内部的定位计算还在 requestAnimationFrame 里,改 placement 来得及生效。
7609
- // 移动端 placement 不生效(弹窗固定在窗口底部)
7610
- if (open && !Utils.isMobile) _this._adjustPlacement();
7754
+ // 移动端不适用的判断放在 _adjustPlacement 内部,避免两处各管一半
7755
+ if (open) _this._adjustPlacement();
7611
7756
  }
7612
7757
  });
7613
7758
  this._picker.innerHTML(this._getPanelHTML());
@@ -7653,7 +7798,7 @@ function _set_prototype_of$e(o, p) {
7653
7798
  var cloudRecLabel = ((_this_locale = this.locale) == null ? void 0 : _this_locale.REC_DROPDOWN_CLOUD_REC) || '云存储';
7654
7799
  var cloudRecordLabel = ((_this_locale1 = this.locale) == null ? void 0 : _this_locale1.REC_DROPDOWN_CLOUD_RECORD) || '云录制';
7655
7800
  var localRecLabel = ((_this_locale2 = this.locale) == null ? void 0 : _this_locale2.REC_DROPDOWN_LOCAL_REC) || '本地回放';
7656
- return '<div class="' + PREFIX_CLASS + '-rec-dropdown-panel">\n <ul class="' + PREFIX_CLASS + '-rec-dropdown-list">\n <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRec">\n <span>' + cloudRecLabel + '</span>\n </li>\n <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRecord">\n <span>' + cloudRecordLabel + '</span>\n </li>\n <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="rec">\n <span>' + localRecLabel + "</span>\n </li>\n </ul>\n </div>";
7801
+ return '<div class="' + PREFIX_CLASS + '-rec-dropdown-panel">\n <ul class="' + PREFIX_CLASS + '-rec-dropdown-list">\n ' + (this._options.list.includes('cloudRec') ? '<li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRec">\n <span>' + cloudRecLabel + "</span>\n </li>" : '') + "\n " + (this._options.list.includes('cloudRecord') ? '<li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="cloudRecord">\n <span>' + cloudRecordLabel + "</span>\n </li>" : '') + "\n " + (this._options.list.includes('rec') ? ' <li class="' + PREFIX_CLASS + '-rec-dropdown-item" data-type="rec">\n <span>' + localRecLabel + "</span>\n </li>" : '') + "\n </ul>\n </div>";
7657
7802
  };
7658
7803
  _proto._bindPanelEvents = function _bindPanelEvents() {
7659
7804
  var _this = this;
@@ -7674,6 +7819,9 @@ function _set_prototype_of$e(o, p) {
7674
7819
  };
7675
7820
  _proto._activeOption = function _activeOption(type) {
7676
7821
  var _this__picker;
7822
+ if (!this._options.list.includes(type)) {
7823
+ return;
7824
+ }
7677
7825
  if ((_this__picker = this._picker) == null ? void 0 : _this__picker.$body) {
7678
7826
  var items = this._picker.$body.querySelectorAll("." + PREFIX_CLASS + "-rec-dropdown-item");
7679
7827
  items.forEach(function(item) {
@@ -7998,8 +8146,9 @@ var SELECT_DEFAULT_OPTIONS = {
7998
8146
  label: 'label',
7999
8147
  value: 'value'
8000
8148
  },
8149
+ // label 可能来自内核下发的列表,内置实现必须转义
8001
8150
  renderLabel: function renderLabel(label) {
8002
- return "<span>" + (label || '') + "</span>";
8151
+ return "<span>" + escapeHtml(label) + "</span>";
8003
8152
  },
8004
8153
  onChange: function onChange() {},
8005
8154
  onOpenChange: function onOpenChange() {}
@@ -8114,9 +8263,11 @@ var SELECT_DEFAULT_OPTIONS = {
8114
8263
  var _this__options_fieldNames, _this__options_fieldNames1, _this_locale, _this__picker;
8115
8264
  var labelKey = (_ref = (_this__options_fieldNames = this._options.fieldNames) == null ? void 0 : _this__options_fieldNames.label) != null ? _ref : 'label';
8116
8265
  var valueKey = (_ref1 = (_this__options_fieldNames1 = this._options.fieldNames) == null ? void 0 : _this__options_fieldNames1.value) != null ? _ref1 : 'value';
8117
- (_this__picker = this._picker) == null ? void 0 : _this__picker.innerHTML('<div class="' + PREFIX_CLASS + '-select-panel">\n <ul class="' + PREFIX_CLASS + '-select-list">\n ' + list.map(function(item) {
8118
- return '\n <li class="' + PREFIX_CLASS + "-select-option " + (+item[valueKey] === _this.value ? "" + PREFIX_CLASS + "-active" : '') + '" data-value="' + item[valueKey] + '">\n <span>' + item[labelKey] + "</span>\n </li>\n ";
8119
- }).join('') + "\n </ul>\n " + (Utils.isMobile ? '<div class="' + PREFIX_CLASS + '-select-cancel">\n <span>' + (((_this_locale = this.locale) == null ? void 0 : _this_locale.cancel) || '取消') + "</span>\n </div>" : '') + "\n " + (Utils.isMobile ? '<span class="' + PREFIX_CLASS + '-select-close">' + IconComponents.close() + "</span>" : '') + "\n <div>");
8266
+ (_this__picker = this._picker) == null ? void 0 : _this__picker.innerHTML('<div class="' + PREFIX_CLASS + '-select-panel">\n <ul class="' + PREFIX_CLASS + '-select-list">\n ' + list.map(// 列表可能来自内核下发(如 setVideoLevelList 的清晰度列表),
8267
+ // data-value 与标签文本都要转义
8268
+ function(item) {
8269
+ return '\n <li class="' + PREFIX_CLASS + "-select-option " + (+item[valueKey] === _this.value ? "" + PREFIX_CLASS + "-active" : '') + '" data-value="' + escapeHtml(item[valueKey]) + '">\n <span>' + escapeHtml(item[labelKey]) + "</span>\n </li>\n ";
8270
+ }).join('') + "\n </ul>\n " + (Utils.isMobile ? '<div class="' + PREFIX_CLASS + '-select-cancel">\n <span>' + escapeHtml(((_this_locale = this.locale) == null ? void 0 : _this_locale.cancel) || '取消') + "</span>\n </div>" : '') + "\n " + (Utils.isMobile ? '<span class="' + PREFIX_CLASS + '-select-close">' + IconComponents.close() + "</span>" : '') + "\n <div>");
8120
8271
  this.list = list;
8121
8272
  this._activeOption();
8122
8273
  } else if ((list == null ? void 0 : list.length) === 0) {
@@ -8348,15 +8499,16 @@ function __filter(list, locale) {
8348
8499
  classNameSuffix: 'definition',
8349
8500
  renderLabel: function renderLabel(label, item, list) {
8350
8501
  var _list_;
8502
+ // 文案来自 options.locales,name / label 来自内核下发的清晰度列表,都要转义
8351
8503
  if ((item == null ? void 0 : item.level) === 'auto') {
8352
8504
  var _options_locales_options_language;
8353
8505
  var realItem = list.find(function(it) {
8354
8506
  return it.level === _assert_this_initialized$1(_this)._level;
8355
8507
  });
8356
- return "<span>" + (options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + ((realItem == null ? void 0 : realItem.name) || '') + ")</span>";
8508
+ return "<span>" + escapeHtml(options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + escapeHtml((realItem == null ? void 0 : realItem.name) || '') + ")</span>";
8357
8509
  }
8358
8510
  // 如果 label 不存在,则不显示label,直接显示list的第一个label, 一般自定义清晰度列表可能会出现
8359
- return "<span>" + (label || ((_list_ = list[0]) == null ? void 0 : _list_.name) || '') + "</span>";
8511
+ return "<span>" + escapeHtml(label || ((_list_ = list[0]) == null ? void 0 : _list_.name) || '') + "</span>";
8360
8512
  },
8361
8513
  onChange: function onChange(value, item) {
8362
8514
  var _options_onChange;
@@ -8386,7 +8538,8 @@ function __filter(list, locale) {
8386
8538
  var realItem = _this.list.find(function(it) {
8387
8539
  return it.level === _this._level;
8388
8540
  });
8389
- _this.$container.querySelector("." + PREFIX_CLASS + "-select-btn").innerHTML = "\n <span>" + (options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + ((realItem == null ? void 0 : realItem.name) || '') + ")</span>\n ";
8541
+ // 文案来自 options.locales,realItem.name 来自内核下发的清晰度列表,两者都要转义
8542
+ _this.$container.querySelector("." + PREFIX_CLASS + "-select-btn").innerHTML = "\n <span>" + escapeHtml(options == null ? void 0 : (_options_locales_options_language = options.locales[options.language]) == null ? void 0 : _options_locales_options_language.VIDEO_LEVEL_AUTO) + "(" + escapeHtml((realItem == null ? void 0 : realItem.name) || '') + ")</span>\n ";
8390
8543
  } else {
8391
8544
  if (_this.value !== _this._level + '') _this.value = _this._level + '';
8392
8545
  }
@@ -8615,7 +8768,8 @@ function _set_prototype_of$8(o, p) {
8615
8768
  var isMobile1 = isMobile();
8616
8769
  if (isMobile1) {
8617
8770
  var _this_locale;
8618
- this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + '-mobile-date-filter" title="' + (((_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_CALENDAR) || '') + '">\n <span class="' + PREFIX_CLASS + '-mobile-date-filter-value">' + this._getDateStr() + "</span>\n " + IconComponents.filter() + "\n <span>";
8771
+ // title 来自 options.locales,必须转义后再拼进属性
8772
+ this.$container.innerHTML = '\n <span class="' + PREFIX_CLASS + '-mobile-date-filter" title="' + escapeHtml(((_this_locale = this.locale) == null ? void 0 : _this_locale.BTN_CALENDAR) || '') + '">\n <span class="' + PREFIX_CLASS + '-mobile-date-filter-value">' + escapeHtml(this._getDateStr()) + "</span>\n " + IconComponents.filter() + "\n <span>";
8619
8773
  } else {
8620
8774
  var _this_locale1;
8621
8775
  this.$container.innerHTML = IconComponents.date({
@@ -8649,7 +8803,8 @@ function _set_prototype_of$8(o, p) {
8649
8803
  _this.options.onOk == null ? void 0 : _this.options.onOk.call(_this.options, date);
8650
8804
  _this.emit(EVENTS.control.dateChange, date);
8651
8805
  if (date && _this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value")) {
8652
- _this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").innerHTML = _this._getDateStr();
8806
+ // 纯文本,用 textContent 避免把日期字符串交给 HTML 解析器
8807
+ _this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").textContent = _this._getDateStr();
8653
8808
  }
8654
8809
  }
8655
8810
  },
@@ -8696,7 +8851,7 @@ function _set_prototype_of$8(o, p) {
8696
8851
  if (date && !change && this._value !== DateTime.format(date, 'YYYY-MM-DD')) {
8697
8852
  this._value = DateTime.format(date, 'YYYY-MM-DD');
8698
8853
  if (date && this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value")) {
8699
- this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").innerHTML = this._getDateStr();
8854
+ this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value").textContent = this._getDateStr();
8700
8855
  }
8701
8856
  }
8702
8857
  };
@@ -8867,7 +9022,8 @@ function _set_prototype_of$7(o, p) {
8867
9022
  this._value = time;
8868
9023
  var valueEl = this.$container.querySelector("." + PREFIX_CLASS + "-mobile-date-filter-value");
8869
9024
  if (valueEl) {
8870
- valueEl.innerHTML = this._getTimeStr();
9025
+ // time 由调用方传入(setTime 是公开方法),只需纯文本,走 textContent
9026
+ valueEl.textContent = this._getTimeStr();
8871
9027
  }
8872
9028
  }
8873
9029
  };
@@ -9298,8 +9454,12 @@ function _set_prototype_of$5(o, p) {
9298
9454
  }
9299
9455
  this._progress.setCurrent(currentMs);
9300
9456
  };
9301
- /** 没有可用片段信息时退化为整个区间,避免进度条空转 */ _proto._fallbackToRange = function _fallbackToRange() {
9302
- if (!this._hasRange()) return;
9457
+ /**
9458
+ * 没有可用片段信息时退化为整个区间,避免进度条空转
9459
+ *
9460
+ * 两个调用方(`_syncCurrent` 开头、`_updateVisible` 的 `visible` 分支)都已经
9461
+ * 判过 `_hasRange()`,这里不再重复判断。
9462
+ */ _proto._fallbackToRange = function _fallbackToRange() {
9303
9463
  this._progress.setSegment(this._rangeBeginMs, this._rangeEndMs);
9304
9464
  };
9305
9465
  _proto._hasRange = function _hasRange() {
@@ -9373,7 +9533,12 @@ function _set_prototype_of$4(o, p) {
9373
9533
  var _proto = Device.prototype;
9374
9534
  _proto._render = function _render() {
9375
9535
  var _this___options_props_urlInfo, _this___options_props;
9376
- this.$container.innerHTML = '<span class="' + PREFIX_CLASS + "-text " + PREFIX_CLASS + '-text-device">' + this._splicingString(this.__options.deviceName, (_this___options_props = this.__options.props) == null ? void 0 : (_this___options_props_urlInfo = _this___options_props.urlInfo) == null ? void 0 : _this___options_props_urlInfo.deviceSerial) + "</span>";
9536
+ // deviceSerial 由播放地址解析而来(parseEzopenUrl 对它不做字符校验),
9537
+ // 这里只需要纯文本,用 textContent 从根上避免注入
9538
+ var $span = document.createElement('span');
9539
+ $span.className = PREFIX_CLASS + "-text " + PREFIX_CLASS + "-text-device";
9540
+ $span.textContent = this._splicingString(this.__options.deviceName, (_this___options_props = this.__options.props) == null ? void 0 : (_this___options_props_urlInfo = _this___options_props.urlInfo) == null ? void 0 : _this___options_props_urlInfo.deviceSerial);
9541
+ this.$container.replaceChildren($span);
9377
9542
  };
9378
9543
  /**
9379
9544
  * 更新设备序列号
@@ -9384,7 +9549,8 @@ function _set_prototype_of$4(o, p) {
9384
9549
  var $span = this.$container.querySelector("." + PREFIX_CLASS + "-text-device");
9385
9550
  var text = this._splicingString(deviceName, deviceSerial);
9386
9551
  $span == null ? void 0 : $span.setAttribute('title', text);
9387
- $span.innerHTML = text;
9552
+ // 设备信息来自 getDeviceInfo 事件(接口/内核数据),同样走 textContent
9553
+ $span.textContent = text;
9388
9554
  }
9389
9555
  };
9390
9556
  _proto._splicingString = function _splicingString(deviceName, deviceSerial) {
@@ -9780,7 +9946,11 @@ var _unmountedControls = function _unmountedControls(theme) {
9780
9946
  theme._footer.destroy();
9781
9947
  theme._footer = null;
9782
9948
  }
9949
+ // 移除 header / footer 动画暂停监听(挂在 theme 上,需显式解绑)
9950
+ // 修复:此前只置空引用没有解绑,changeTheme 每调用一次就漏一个监听器,
9951
+ // 且引用被清掉后 _renderTheme 里的兜底解绑也永远不会执行
9783
9952
  if (theme._onPauseTimingFunc) {
9953
+ theme.removeListener(CLEAR_TIMER_HEADER_FOOTER_ANIMATION, theme._onPauseTimingFunc);
9784
9954
  theme._onPauseTimingFunc = null;
9785
9955
  }
9786
9956
  // 移除首帧同步监听(挂在 theme 上,需显式解绑,避免 changeTheme 累积)
@@ -10194,10 +10364,8 @@ function _renderTheme(theme, data) {
10194
10364
  });
10195
10365
  // 当移动端 picker 控件打开时需要关闭动画(定时器)
10196
10366
  // 暂停 header footer 的动画(定时器)
10197
- if (theme._onPauseTimingFunc) {
10198
- theme.removeListener(CLEAR_TIMER_HEADER_FOOTER_ANIMATION, theme._onPauseTimingFunc);
10199
- theme._onPauseTimingFunc = null;
10200
- }
10367
+ // 旧监听的解绑统一在 _unmountedControls 里做(本函数开头已无条件调用过),
10368
+ // 这里不再重复判断
10201
10369
  theme._onPauseTimingFunc = function(open) {
10202
10370
  if (open) {
10203
10371
  var _theme__interactiveResult_clearTimeout, _theme__interactiveResult;
@@ -10591,6 +10759,17 @@ function _inherits(subClass, superClass) {
10591
10759
  });
10592
10760
  if (superClass) _set_prototype_of(subClass, superClass);
10593
10761
  }
10762
+ function _object_without_properties_loose(source, excluded) {
10763
+ if (source == null) return {};
10764
+ var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
10765
+ for(i = 0; i < sourceKeys.length; i++){
10766
+ key = sourceKeys[i];
10767
+ if (excluded.indexOf(key) >= 0) continue;
10768
+ if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
10769
+ target[key] = source[key];
10770
+ }
10771
+ return target;
10772
+ }
10594
10773
  function _set_prototype_of(o, p) {
10595
10774
  _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
10596
10775
  o.__proto__ = p;
@@ -10723,6 +10902,7 @@ var THEME_DEFAULT_OPTIONS = {
10723
10902
  domain: 'https://open.ys7.com'
10724
10903
  },
10725
10904
  isEzviz: true,
10905
+ sdkType: 'base',
10726
10906
  /** 移动端竖屏, 全屏情况下不展示扩张,放置在 footer 中 */ mobileExtendOptions: {
10727
10907
  controls: MOBILE_EXTENDS
10728
10908
  }
@@ -11184,10 +11364,16 @@ var THEME_DEFAULT_OPTIONS = {
11184
11364
  // JSON 不能序列化dom节点, 不要使用 this.options.container, 请使用 this.container
11185
11365
  delete this.options.container;
11186
11366
  }
11367
+ // 凭据不进日志:这条 log 在生产产物里依然存在(strip 插件只剥离 console.*,
11368
+ // 不处理 logger 实例方法),直接打印 options 等于把 accessToken 暴露在控制台
11369
+ var _this_options = this.options; _this_options.accessToken; _this_options.token; var loggableOptions = _object_without_properties_loose(_this_options, [
11370
+ "accessToken",
11371
+ "token"
11372
+ ]);
11187
11373
  try {
11188
- this.logger.log('[options] \n', JSON.stringify(this.options));
11374
+ this.logger.log('[options] \n', JSON.stringify(loggableOptions));
11189
11375
  } catch (error) {
11190
- this.logger.log('[options] \n', this.options);
11376
+ this.logger.log('[options] \n', loggableOptions);
11191
11377
  }
11192
11378
  var language = this.options.language || 'zh';
11193
11379
  // 深拷贝内置语言包,避免与模块级 zh/en 常量共享引用(I18n 若对其做合并/修改会污染全局)
@@ -12260,6 +12446,6 @@ var THEME_DEFAULT_OPTIONS = {
12260
12446
  zh: zh,
12261
12447
  en: en
12262
12448
  };
12263
- /** 版本号 @since 0.0.1 */ Theme.THEME_VERSION = '3.1.7-beta.4';
12449
+ /** 版本号 @since 0.0.1 */ Theme.THEME_VERSION = '3.1.8-beta.2';
12264
12450
 
12265
12451
  export { CONTROL_INIT_EVENTS, Control, EVENTS, Fullscreen, Loading, Message, Play, Poster, Rec, Theme, Utils, Volume };