@lambo-design/wang-editor 2.0.0-beta.6 → 2.0.0-beta.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +6 -4
- package/src/index.vue +15 -3
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lambo-design/wang-editor",
|
|
3
|
-
"version": "2.0.0-beta.
|
|
3
|
+
"version": "2.0.0-beta.8",
|
|
4
4
|
"description": "",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"author": "lambo",
|
|
@@ -10,12 +10,14 @@
|
|
|
10
10
|
"registry": "https://registry.npmjs.org/"
|
|
11
11
|
},
|
|
12
12
|
"devDependencies": {
|
|
13
|
-
"
|
|
14
|
-
"@lambo-design/
|
|
13
|
+
"dompurify": "3.4.17",
|
|
14
|
+
"@lambo-design/shared": "^1.0.0-beta.396",
|
|
15
|
+
"@lambo-design/core": "^4.7.1-beta.184"
|
|
15
16
|
},
|
|
16
17
|
"dependencies": {
|
|
17
18
|
"@wangeditor/editor": "5.1.23",
|
|
18
|
-
"@wangeditor/editor-for-vue": "^1.0.2"
|
|
19
|
+
"@wangeditor/editor-for-vue": "^1.0.2",
|
|
20
|
+
"xss": "^1.0.15"
|
|
19
21
|
},
|
|
20
22
|
"scripts": {
|
|
21
23
|
"release": "pnpm release-beta && git push --follow-tags && pnpm re-publish",
|
package/src/index.vue
CHANGED
|
@@ -23,7 +23,10 @@ import axios from 'axios';
|
|
|
23
23
|
import {oneOf} from '@lambo-design/shared/utils/platform';
|
|
24
24
|
import { Editor, Toolbar } from '@wangeditor/editor-for-vue'
|
|
25
25
|
import '@wangeditor/editor/dist/css/style.css'
|
|
26
|
+
import DOMPurify from 'dompurify'
|
|
26
27
|
|
|
28
|
+
|
|
29
|
+
import xss from 'xss';
|
|
27
30
|
export default {
|
|
28
31
|
name: 'LamboWangEditor',
|
|
29
32
|
components: { Editor, Toolbar },
|
|
@@ -153,13 +156,14 @@ export default {
|
|
|
153
156
|
},
|
|
154
157
|
methods: {
|
|
155
158
|
setHtml(val) {
|
|
159
|
+
let htmlVal = xss(val)
|
|
156
160
|
if (this.editor) {
|
|
157
|
-
this.editor.setHtml(
|
|
161
|
+
this.editor.setHtml(htmlVal)
|
|
158
162
|
} else {
|
|
159
163
|
// 编辑器尚未初始化时的处理
|
|
160
164
|
console.warn('Editor not initialized yet, queuing the content update...');
|
|
161
165
|
// 可以考虑缓存内容，等待编辑器初始化后设置
|
|
162
|
-
this.pendingContent =
|
|
166
|
+
this.pendingContent = htmlVal;
|
|
163
167
|
}
|
|
164
168
|
},
|
|
165
169
|
handleChange(editor) {
|
|
@@ -209,7 +213,15 @@ export default {
|
|
|
209
213
|
}
|
|
210
214
|
if (html) {
|
|
211
215
|
// 插入带格式的HTML
|
|
212
|
-
|
|
216
|
+
// 先净化，再插入
|
|
217
|
+
const cleanHtml = DOMPurify.sanitize(html, {
|
|
218
|
+
ALLOWED_TAGS: ['p', 'span', 'strong', 'em', 'u', 's', 'a', 'img', 'br', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4', 'blockquote', 'pre', 'code'],
|
|
219
|
+
ALLOWED_ATTR: ['href', 'src', 'alt', 'title', 'target'],
|
|
220
|
+
FORBID_TAGS: ['script', 'iframe', 'object', 'embed', 'form', 'input', 'style'],
|
|
221
|
+
FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'style']
|
|
222
|
+
})
|
|
223
|
+
editor.dangerouslyInsertHtml(cleanHtml)
|
|
224
|
+
// editor.dangerouslyInsertHtml(html)
|
|
213
225
|
} else {
|
|
214
226
|
// 没有HTML内容时回退到纯文本
|
|
215
227
|
editor.insertText(event.clipboardData.getData('text/plain'))
|