@jx3box/jx3box-editor 2.2.41 → 2.2.43

package/assets/js/a.js

@@ -1,43 +1,141 @@
-// 链接标签
-import url from 'url'
-import { resolveImagePath } from "@jx3box/jx3box-common/js/utils";
-function formatLink(str){
-    if(!str) return
-    
-    const REG = /<a(.*?)href=[\'"]([^\'"]+)[\'"](.*?)>(.*?)<\/a>/gi
-    let item;
-    while ((item = REG.exec(str))) {
-        let origin = item[0]
-        let prefix = item[1]
-
-        let href = item[2]
-        let to = url.parse(href)
-        const whiteHost = /https?:\/\/.*\.jx3box\.com/
-
-        if(to.host == 'oss.jx3box.com'){
-            href = resolveImagePath(href)
-        }
-
-
-        let skip = ''
-        if(!whiteHost.test(to.hostname)){
-            skip = 'target="_blank"'
-        }
-
-        // markdown中的锚点跳转
-        let isHashAnchor = href.startsWith('#')
-        if(isHashAnchor){
-            skip = 'target="_self"'
-        }
-
-        let suffix = item[3]
-        let text = item[4]
-
-        let output = `<a ${skip} ${prefix} href="${href}" ${suffix}>${text}</a>`
-        str = str.replace(origin,output)
-        // console.log(origin,output)
-    }
-    // console.log(str)
-    return str
+// formatLink.js
+import { load } from "cheerio";
+
+/** 规范化 whitelist：统一小写、去空格、允许传入带协议的域名 */
+function normalizeWhitelist(list = []) {
+  return (Array.isArray(list) ? list : [])
+    .map((x) => String(x || "").trim().toLowerCase())
+    .filter(Boolean)
+    .map((x) => {
+      // 允许用户写 https://xxx.com
+      try {
+        if (/^https?:\/\//i.test(x)) return new URL(x).hostname.toLowerCase();
+      } catch {
+        console.warn(`formatLink: 无法解析 whitelist 域名 "${x}"，已忽略该项`);
+      }
+      return x;
+    });
+}
+
+/** 是否相对链接（默认认为站内，视为白名单） */
+function isRelativeHref(href = "") {
+  const s = href.trim();
+  if (!s) return true;
+  if (s.startsWith("#") || s.startsWith("?") || s.startsWith("/")) return true;
+  if (s.startsWith("./") || s.startsWith("../")) return true;
+  // 没有 scheme 且不是 //xxx，通常是相对路径（如 a/b）
+  return !/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(s) && !s.startsWith("//");
+}
+
+/** 从 href 里提取 hostname（只处理 http/https/协议相对 //） */
+function getHostnameFromHref(href = "") {
+  const s = href.trim();
+  if (!s) return "";
+
+  if (s.startsWith("//")) {
+    try {
+      return new URL("https:" + s).hostname.toLowerCase();
+    } catch {
+      return "";
+    }
+  }
+
+  if (/^https?:\/\//i.test(s)) {
+    try {
+      return new URL(s).hostname.toLowerCase();
+    } catch {
+      return "";
+    }
+  }
+
+  return "";
+}
+
+/**
+ * whitelist 规则：
+ * - "xxx.com" 只匹配根域
+ * - "*.xxx.com" 只匹配子域（a.xxx.com），不匹配根域（xxx.com）
+ */
+function matchHost(hostname, whitelist) {
+  const host = (hostname || "").toLowerCase();
+  if (!host) return false;
+
+  for (const rule of whitelist) {
+    if (!rule) continue;
+
+    if (rule.startsWith("*.")) {
+      const root = rule.slice(2);
+      if (root && host.endsWith("." + root)) return true;
+      continue;
+    }
+
+    if (host === rule) return true;
+  }
+  return false;
+}
+
+/**
+ * @param {string} html - HTML 字符串（可为片段）
+ * @param {string[]} whitelist - 例如 ["xxx.com", "*.xxx.com"]
+ * @param {boolean} strict - true 时，非白名单链接 href 强制置空
+ */
+export default function formatLink(html, whitelist = ["*.jx3box.com"], strict = false) {
+  if (!html) return html;
+
+  const wl = normalizeWhitelist(whitelist);
+  const hasWhitelist = wl.length > 0;
+
+  // cheerio 用 root 包一下，保证片段也能正常选取
+  const $ = load(`<root>${html}</root>`, { decodeEntities: false });
+
+  $("a[href]").each((_, el) => {
+    const a = $(el);
+    const hrefRaw = a.attr("href") ?? "";
+    const href = String(hrefRaw).trim();
+    if (!href) return;
+
+    // markdown 锚点：强制 _self
+    if (href.startsWith("#")) {
+      a.attr("target", "_self");
+      return;
+    }
+
+    // 安全兜底：javascript: 一律干掉
+    if (/^javascript:/i.test(href)) {
+      a.attr("href", "");
+      return;
+    }
+
+    // mailto/tel 等不参与白名单判断（你也可以按 strict 强行置空，这里先按常见做法放行）
+    if (/^(mailto:|tel:|sms:)/i.test(href)) {
+      return;
+    }
+
+    // 相对链接默认视为站内
+    let isWhite = true;
+
+    if (!isRelativeHref(href)) {
+      const host = getHostnameFromHref(href);
+      isWhite = matchHost(host, wl);
+    } else {
+      isWhite = true;
+    }
+
+    // 只有设置了 whitelist 才触发“非白名单处理”
+    if (hasWhitelist && !isWhite) {
+      if (strict) {
+        a.attr("href", "");
+        return;
+      }
+
+      // 如果本身就是 _blank，就不管；否则强制 _blank
+      const target = String(a.attr("target") || "").toLowerCase();
+      if (target !== "_blank") {
+        a.attr("target", "_blank");
+      }
+    }
+  });
+
+  // 取出 root 里原始内容
+  return $("root").html() || "";
 }
-export default formatLink

package/assets/js/iframe.js

@@ -1,38 +1,120 @@
-// iframe白名单
-import url from 'url'
-function iframeFilter(str){
-    if(!str) return
-
-    const REG = /<iframe(.*?)src=[\'"]([^\'"]+)[\'"](.*?)>.*?<\/iframe>/gi
-    const white_list = ['player.bilibili.com','docs.qq.com',"open.douyu.com"]
-    
-    let item;
-    while ((item = REG.exec(str))) {
-        let origin = item[0]
-        let prefix = item[1]
-
-        // bilibili路径处理
-        let src = ''
-        if(item[2].startsWith('//')){
-            src = item[2].replace('//','https://')
-        }else{
-            src = item[2]
-        }
+// iframeFilter.js
+import { load } from "cheerio";
+
+function normalizeWhitelist(list = []) {
+    return (Array.isArray(list) ? list : [])
+        .map((x) => String(x || "").trim().toLowerCase())
+        .filter(Boolean)
+        .map((x) => {
+            // 允许传入带协议的，如 https://docs.qq.com
+            try {
+                if (/^https?:\/\//i.test(x)) return new URL(x).hostname.toLowerCase();
+            } catch {
+                console.warn(`iframeFilter: 无法解析 whitelist 域名 "${x}"，已忽略该项`);
+            }
+            return x;
+        });
+}
+
+/**
+ * 规则：
+ * - "docs.qq.com" 精确匹配
+ * - "*.qq.com" 只匹配子域（a.qq.com），不匹配根域（qq.com）
+ */
+function matchHost(hostname, whitelist) {
+    const host = (hostname || "").toLowerCase();
+    if (!host) return false;
 
-        // 白名单过滤
-        let src_parsed = url.parse(src)
-        if(white_list.includes(src_parsed.hostname)){
-            src = item[2]
-        }else{
-            src = ''
+    for (const rule of whitelist) {
+        if (!rule) continue;
+
+        if (rule.startsWith("*.")) {
+            const root = rule.slice(2);
+            if (root && host.endsWith("." + root)) return true;
+            continue;
         }
 
-        let suffix = item[3]
-        let output = `<iframe ${prefix} src="${item[2]}" ${suffix}></iframe>`
-        str = str.replace(origin,output)
-        // console.log(origin,output)
+        if (host === rule) return true;
     }
-    // console.log(str)
-    return str
+    return false;
+}
+
+function normalizeSrcForParse(src = "") {
+    const s = src.trim();
+    if (!s) return "";
+    // 协议相对：//xxx.com/...
+    if (s.startsWith("//")) return "https:" + s;
+    return s;
+}
+
+function getHostnameFromSrc(src = "") {
+    const s = normalizeSrcForParse(src);
+    if (!s) return "";
+
+    // 只对白名单校验 http/https 或 // 这种
+    if (/^https?:\/\//i.test(s)) {
+        try {
+            return new URL(s).hostname.toLowerCase();
+        } catch {
+            return "";
+        }
+    }
+    return "";
+}
+
+/**
+ * @param {string} html - 含 iframe 的 HTML 字符串（片段也行）
+ * @param {string[]} whitelist - 域名白名单，支持 "*.qq.com"
+ * @param {object} [options]
+ * @param {boolean} [options.keepNonHttpSrc=false] - src 不是 http/https（如 about:blank、data:）是否保留
+ */
+export default function iframeFilter(html, whitelist, options = {}) {
+    if (!html) return html;
+
+    const { keepNonHttpSrc = false } = options;
+
+    // 没传 whitelist 或传空数组，都视为“不启用白名单过滤”
+    const wl = normalizeWhitelist(whitelist || []);
+    const enableWhitelist = wl.length > 0;
+
+    const $ = load(`<root>${html}</root>`, { decodeEntities: false });
+
+    $("iframe").each((_, el) => {
+        const iframe = $(el);
+        const srcRaw = iframe.attr("src") ?? "";
+        const src = String(srcRaw).trim();
+        if (!src) return;
+
+        // 不启用过滤：直接放行（可选：仍然处理非 http src）
+        if (!enableWhitelist) {
+            if (!keepNonHttpSrc) {
+                const isHttpLike = src.startsWith("//") || /^https?:\/\//i.test(src);
+                if (!isHttpLike) iframe.attr("src", "");
+            }
+            return;
+        }
+
+        // ======= 启用白名单过滤的逻辑（和之前一样） =======
+        const isHttpLike = src.startsWith("//") || /^https?:\/\//i.test(src);
+        if (!isHttpLike) {
+            if (!keepNonHttpSrc) iframe.attr("src", "");
+            return;
+        }
+
+        const host = getHostnameFromSrc(src);
+        const ok = matchHost(host, wl);
+
+        if (!ok) {
+            iframe.attr("src", "");
+        } else {
+            // 安全处理：将协议相对 URL 转换为 https://
+            let finalSrc = src;
+            if (src.startsWith("//")) {
+                finalSrc = "https:" + src;
+            }
+            iframe.attr("src", finalSrc);
+        }
+    });
+
+    return $("root").html() || "";
 }
-export default iframeFilter

package/assets/js/img.js

@@ -1,22 +1,67 @@
-// 图片地址&懒加载
-import { resolveImagePath } from "@jx3box/jx3box-common/js/utils";
-import JX3BOX from "@jx3box/jx3box-common/data/jx3box.json";
-function lazyLoad(str) {
-    if (!str) return;
-
-    const REG = /<img(.*?)src=[\'"]([^\'"]+)[\'"](.*?)>/gi;
-    let item;
-    while ((item = REG.exec(str))) {
-        let origin = item[0];
-        let prefix = item[1];
-        let src = resolveImagePath(item[2]);
-        if (src.includes('https://console.cnyixun.com/')) {
-            src = src.replace('https://console.cnyixun.com/', JX3BOX.__cdn)
+import { load } from "cheerio";
+
+function joinDomain(domain, path) {
+    const d = String(domain || "").replace(/\/+$/, "");
+    const p = String(path || "").replace(/^\/+/, "/");
+    return d ? d + p : path;
+}
+
+function isAbsoluteLike(src) {
+    // 不需要拼 domain 的情况
+    return (
+        /^(https?:)?\/\//i.test(src) ||
+        /^(data:|blob:|mailto:|tel:|javascript:)/i.test(src)
+    );
+}
+
+function normalizeImgSrc(src, domain) {
+    const s = String(src || "").trim();
+    if (!s || !domain) return s;
+    if (isAbsoluteLike(s)) return s;
+
+    // 最常见：/uploads/xxx
+    if (s.startsWith("/")) return joinDomain(domain, s);
+
+    // 其它相对路径：uploads/a.png、./a.png
+    // 用 URL 做更准确的拼接（domain 需要是带协议的，如 https://cdn.xxx.com）
+    try {
+        if (/^https?:\/\//i.test(domain)) {
+            const base = domain.endsWith("/") ? domain : domain + "/";
+            return new URL(s, base).toString();
         }
-        let suffix = item[3];
-        let output = `<img ${prefix} loading="lazy" src="${src}" ${suffix}>`;
-        str = str.replace(origin, output);
+    } catch {
+        console.warn("URL 拼接图片路径失败：", domain, s);
     }
-    return str;
+
+    // 兜底：简单拼到根路径
+    return joinDomain(domain, "/" + s.replace(/^\.\/+/, ""));
+}
+
+/**
+ * @param {string} html 富文本HTML
+ * @param {string} domain 可选：CDN/站点域名（如 https://cdn.xxx.com）
+ */
+export default function lazyLoad(html, domain = "") {
+    if (!html) return html;
+
+    const $ = load(`<root>${html}</root>`, { decodeEntities: false });
+
+    $("img").each((_, el) => {
+        const img = $(el);
+
+        // 固定懒加载：无论如何都加/覆盖
+        img.attr("loading", "lazy");
+
+        // 只有传了 domain 才处理 src 拼接
+        if (domain) {
+            const src = img.attr("src");
+            if (src) img.attr("src", normalizeImgSrc(src, domain));
+
+            // 如果你有用 data-src 之类，也可以一起处理（可删）
+            const dataSrc = img.attr("data-src");
+            if (dataSrc) img.attr("data-src", normalizeImgSrc(dataSrc, domain));
+        }
+    });
+
+    return $("root").html() || "";
 }
-export default lazyLoad;

package/assets/js/xss.js

@@ -0,0 +1,72 @@
+import sanitizeHtml from "sanitize-html";
+
+const FORBID = new Set(["script", "object", "embed", "applet", "base", "meta", "link"]);
+
+const EXTRA_TAGS = [
+    "img",
+    "h1", "h2", "h3", "h4", "h5", "h6",
+    "table", "thead", "tbody", "tr", "th", "td",
+    "blockquote", "pre", "code", "hr",
+    "video", "source",
+    "iframe",
+];
+
+export default function sanitizeRichText(html) {
+    if (!html) return html;
+
+    const allowedTags = sanitizeHtml.defaults.allowedTags
+        .concat(EXTRA_TAGS)
+        .filter((t, i, arr) => arr.indexOf(t) === i) // 去重
+        .filter(t => !FORBID.has(t));
+
+    return sanitizeHtml(html, {
+        disallowedTagsMode: "discard",
+        allowedTags,
+
+        allowedAttributes: {
+            "*": ["class", "style", "title", "id", "data-*"],
+            a: ["href", "target", "rel", "title", "class", "style"],
+            img: ["src", "alt", "title", "width", "height", "class", "style", "loading", "decoding"],
+            video: ["controls", "width", "height", "class", "style"],
+            source: ["src", "type"],
+            iframe: ["src","width","height","frameborder","scrolling","allowfullscreen","sandbox","referrerpolicy","class","style"],
+        },
+
+        allowedSchemes: ["http", "https", "mailto", "tel"],
+        allowProtocolRelative: true,
+        allowedSchemesByTag: { img: ["http", "https", "data"],iframe: ["http", "https"], },
+
+        transformTags: {
+            "*": (tagName, attribs) => {
+                const out = { ...attribs };
+
+                // 移除 on*
+                for (const k of Object.keys(out)) if (/^on/i.test(k)) delete out[k];
+
+                // style 禁 @import / url(
+                if (typeof out.style === "string" && out.style) {
+                    let s = out.style;
+                    s = s.replace(/@import\s+[^;]+;?/gi, "");
+                    s = s.replace(/url\s*\(\s*[^)]+\s*\)/gi, "");
+                    s = s.replace(/;;+/g, ";").trim();
+                    if (!s) delete out.style;
+                    else out.style = s;
+                }
+
+                // 兜底禁 javascript:
+                for (const key of ["href", "src"]) {
+                    if (out[key] && /^\s*javascript:/i.test(out[key])) out[key] = "";
+                }
+
+                // 仅允许 data:image/*
+                if (tagName === "img" && typeof out.src === "string" && out.src.startsWith("data:")) {
+                    if (!/^data:image\/(png|jpe?g|gif|webp|avif|bmp|svg\+xml);/i.test(out.src)) {
+                        out.src = "";
+                    }
+                }
+
+                return { tagName, attribs: out };
+            },
+        },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@jx3box/jx3box-editor",
-    "version": "2.2.41",
+    "version": "2.2.43",
     "description": "JX3BOX Article & Editor",
     "main": "index.js",
     "scripts": {
@@ -36,10 +36,11 @@
         "@jx3box/jx3box-data": "^3.8.9",
         "@jx3box/jx3box-emotion": "^1.2.14",
         "@jx3box/jx3box-macro": "^1.0.1",
-        "@jx3box/jx3box-talent": "^1.3.10",
+        "@jx3box/jx3box-talent": "^1.3.11",
         "@jx3box/markdown": "^0.1.5",
         "@tinymce/tinymce-vue": "^3.2.2",
         "axios": "^0.19.2",
+        "cheerio": "^1.1.2",
         "core-js": "^3.6.5",
         "csslab": "^4.0.3",
         "dayjs": "^1.10.7",
@@ -52,6 +53,7 @@
         "lodash": "^4.17.15",
         "photoswipe": "^4.1.2",
         "prismjs": "^1.20.0",
+        "sanitize-html": "^2.17.0",
         "sortablejs": "^1.15.0",
         "vue": "^2.6.11",
         "vue-contextmenujs": "^1.4.9",

package/public/tinymce.html

@@ -7,7 +7,10 @@
         <meta name="renderer" content="webkit" />
         <title><%= htmlWebpackPlugin.options.title %></title>
         <link rel="icon" href="<%= BASE_URL %>favicon.ico" />
-        <script src="https://cdn.jx3box.com/static/tinymce/tinymce.min.js?v=1.8.9"></script>
+        <script>
+            window.RX_TINYMCE_ROOT = "https://cdn.jx3box.com/static/tinymce";
+        </script>
+        <script src="https://cdn.jx3box.com/static/tinymce/tinymce.min.js?v=1.9.0"></script>
         <!-- TODO: -->
         <!-- <script src="http://localhost:3000/tinymce.min.js"></script> -->
     </head>

package/src/Article.vue

@@ -43,11 +43,11 @@ import hevueImgPreview from "hevue-img-preview";
 Vue.use(hevueImgPreview);
 
 // XSS
-import execFilterXSS from "../assets/js/script";
+import execFilterXSS from "../assets/js/xss";
 // const execFilterXSS = require("xss");
-const xss_options = {
-    allowCommentTag: true,
-};
+// const xss_options = {
+//     allowCommentTag: true,
+// };
 
 // 基本文本
 import execLazyload from "../assets/js/img";
@@ -61,7 +61,7 @@ import renderDirectory from "../assets/js/directory";
 import renderMacro from "../assets/js/macro";
 import renderTalent from "../assets/js/qixue";
 import renderTalent2 from "../assets/js/talent2";
-import {renderKatexAll} from "../assets/js/katex";
+import { renderKatexAll } from "../assets/js/katex";
 import renderCode from "../assets/js/code";
 import renderImgPreview from "../assets/js/renderImgPreview";
 import renderPzIframe from "../assets/js/pz_iframe";
@@ -80,6 +80,30 @@ export default {
     name: "Article",
     props: {
         content: String,
+        // 拼接相对路径地址的图片，需要自带协议
+        cdnDomain: {
+            type: String,
+            default: "https://cdn.jx3box.com",
+        },
+        // 链接白名单检查，不在白名单，使用新窗跳转
+        linkWhitelist: {
+            type: Array,
+            default: function () {
+                return [];
+            },
+        },
+        // 链接白名单强制模式，开启后不在白名单的链接一律置空，不允许跳转
+        linkStrict: {
+            type: Boolean,
+            default: false,
+        },
+        // iframe白名单检查，不在白名单，移除iframe
+        iframeWhitelist: {
+            type: Array,
+            default: function () {
+                return [];
+            },
+        },
         directorybox: String,
         pageable: {
             type: Boolean,
@@ -154,11 +178,18 @@ export default {
     methods: {
         doReg: function (data) {
             if (data) {
-                // 过滤内容
-                data = execLazyload(data);
-                data = execFilterIframe(data);
-                data = execFilterXSS(data, xss_options);
-                data = execFilterLink(data);
+                // 1. 先执行 XSS 过滤（xss.js 已包含所有配置）
+                data = execFilterXSS(data);
+
+                // 2. 然后执行 iframe 白名单过滤
+                data = execFilterIframe(data, ["player.bilibili.com", "docs.qq.com", "open.douyu.com", ...this.iframeWhitelist]);
+
+                // 3. 处理图片懒加载
+                data = execLazyload(data, this.cdnDomain);
+
+                // 4. 最后处理链接
+                data = execFilterLink(data, this.linkWhitelist, this.linkStrict);
+
                 return data;
             } else {
                 return "";
@@ -199,10 +230,10 @@ export default {
             let dir = renderDirectory(target, this.directorybox);
             this.$emit("directoryRendered", dir);
 
-            if(window.location.hash?.includes('directory')){
-                let id = window.location.hash
+            if (window.location.hash?.includes("directory")) {
+                let id = window.location.hash;
                 let target = $(`${id}`).offset().top;
-                console.log(target)
+                console.log(target);
                 $(document).scrollTop(target - HEADER_HEIGHT);
             }
 

package/vue.config.js

@@ -84,6 +84,19 @@ module.exports = {
         }
     },
 
+    //❤️ 配置需要被 Babel 转译的 node_modules 依赖 ~
+    transpileDependencies: [
+        'htmlparser2',
+        'cheerio',
+        'dom-serializer',
+        'domelementtype',
+        'domhandler',
+        'domutils',
+        'entities',
+        'parse5',
+        'parse5-htmlparser2-tree-adapter'
+    ],
+
     chainWebpack: config => {
 
         //💘 html-webpack-plugin ~