@lambo-design/wang-editor 2.0.0-beta.7 → 2.0.0-beta.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +4 -3
- package/src/index.vue +11 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lambo-design/wang-editor",
|
|
3
|
-
"version": "2.0.0-beta.
|
|
3
|
+
"version": "2.0.0-beta.8",
|
|
4
4
|
"description": "",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"author": "lambo",
|
|
@@ -10,8 +10,9 @@
|
|
|
10
10
|
"registry": "https://registry.npmjs.org/"
|
|
11
11
|
},
|
|
12
12
|
"devDependencies": {
|
|
13
|
-
"
|
|
14
|
-
"@lambo-design/shared": "^1.0.0-beta.
|
|
13
|
+
"dompurify": "3.4.17",
|
|
14
|
+
"@lambo-design/shared": "^1.0.0-beta.396",
|
|
15
|
+
"@lambo-design/core": "^4.7.1-beta.184"
|
|
15
16
|
},
|
|
16
17
|
"dependencies": {
|
|
17
18
|
"@wangeditor/editor": "5.1.23",
|
package/src/index.vue
CHANGED
|
@@ -23,6 +23,8 @@ import axios from 'axios';
|
|
|
23
23
|
import {oneOf} from '@lambo-design/shared/utils/platform';
|
|
24
24
|
import { Editor, Toolbar } from '@wangeditor/editor-for-vue'
|
|
25
25
|
import '@wangeditor/editor/dist/css/style.css'
|
|
26
|
+
import DOMPurify from 'dompurify'
|
|
27
|
+
|
|
26
28
|
|
|
27
29
|
import xss from 'xss';
|
|
28
30
|
export default {
|
|
@@ -211,7 +213,15 @@ export default {
|
|
|
211
213
|
}
|
|
212
214
|
if (html) {
|
|
213
215
|
// 插入带格式的HTML
|
|
214
|
-
|
|
216
|
+
// 先净化，再插入
|
|
217
|
+
const cleanHtml = DOMPurify.sanitize(html, {
|
|
218
|
+
ALLOWED_TAGS: ['p', 'span', 'strong', 'em', 'u', 's', 'a', 'img', 'br', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4', 'blockquote', 'pre', 'code'],
|
|
219
|
+
ALLOWED_ATTR: ['href', 'src', 'alt', 'title', 'target'],
|
|
220
|
+
FORBID_TAGS: ['script', 'iframe', 'object', 'embed', 'form', 'input', 'style'],
|
|
221
|
+
FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'style']
|
|
222
|
+
})
|
|
223
|
+
editor.dangerouslyInsertHtml(cleanHtml)
|
|
224
|
+
// editor.dangerouslyInsertHtml(html)
|
|
215
225
|
} else {
|
|
216
226
|
// 没有HTML内容时回退到纯文本
|
|
217
227
|
editor.insertText(event.clipboardData.getData('text/plain'))
|