@lingxiteam/lcdp-ueditor-react 1.0.0-alpha.12 → 1.0.0-alpha.13

package/es/LcdpUeditor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LcdpUeditor.d.ts","sourceRoot":"","sources":["LcdpUeditor.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAOhD,cAAM,WAAY,SAAQ,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC9D;;OAEG;IACH,WAAW,EAAE,MAAM,CAAwB;IAE3C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAwD;IAExE;;OAEG;IACH,OAAO,CAAC,YAAY,CAAwD;IAE5E;;OAEG;IACH,OAAO,CAAC,WAAW,CAAS;IAE5B;;OAEG;IACH,OAAO,CAAC,WAAW,CAAa;IAEhC;;OAEG;IACH,OAAO,CAAC,YAAY,CAAiB;IAErC;;OAEG;IACH,OAAO,CAAC,qBAAqB,CAAW;IAExC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAc;IAEpC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAM;IAE5B;;OAEG;IACH,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACH,KAAK,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC,CAEnC;IAEF;;OAEG;IACH,YAAY,EAAE,GAAG,CAAM;gBAEX,KAAK,EAAE,iBAAiB;IA0CpC,iBAAiB,IAAI,IAAI;IAIzB,yBAAyB,CAAC,SAAS,EAAE,iBAAiB;IAiBtD,oBAAoB,IAAI,IAAI;IAM5B,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,YAAY;IAOpB;;;;OAIG;YACW,UAAU;IAqCxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAMhB;;OAEG;IACH,OAAO,CAAC,SAAS;IAcjB;;OAEG;IACG,WAAW;IAiCjB,MAAM,IAAI,KAAK,CAAC,SAAS;CAY1B;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"LcdpUeditor.d.ts","sourceRoot":"","sources":["LcdpUeditor.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAQhD,cAAM,WAAY,SAAQ,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC9D;;OAEG;IACH,WAAW,EAAE,MAAM,CAAwB;IAE3C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAwD;IAExE;;OAEG;IACH,OAAO,CAAC,YAAY,CAAwD;IAE5E;;OAEG;IACH,OAAO,CAAC,WAAW,CAAS;IAE5B;;OAEG;IACH,OAAO,CAAC,WAAW,CAAa;IAEhC;;OAEG;IACH,OAAO,CAAC,YAAY,CAAiB;IAErC;;OAEG;IACH,OAAO,CAAC,qBAAqB,CAAW;IAExC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAc;IAEpC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAM;IAE5B;;OAEG;IACH,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACH,KAAK,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC,CAEnC;IAEF;;OAEG;IACH,YAAY,EAAE,GAAG,CAAM;gBAEX,KAAK,EAAE,iBAAiB;IA0CpC,iBAAiB,IAAI,IAAI;IAIzB,yBAAyB,CAAC,SAAS,EAAE,iBAAiB;IAiBtD,oBAAoB,IAAI,IAAI;IAM5B,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,YAAY;IAOpB;;;;OAIG;YACW,UAAU;IAqCxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAMhB;;OAEG;IACH,OAAO,CAAC,SAAS;IAcjB;;OAEG;IACG,WAAW;IAiCjB,MAAM,IAAI,KAAK,CAAC,SAAS;CAY1B;AAED,eAAe,WAAW,CAAC"}

package/es/LcdpUeditor.js

@@ -22,6 +22,7 @@ import { DEFAULT_UEDITOR_CONFIG, DEFAULT_UEDITOR_PATH } from "./const";
 import DefaultConfig from "./defaultConfig.json";
 import UeditorResourceLoader from "./tools/UeditorResourceLoader";
 import { debounce } from 'lodash';
+import { filterHtmlNode } from "./tools/filterHtmlNode";
 var LcdpUeditor = /*#__PURE__*/function (_React$Component) {
   _inherits(LcdpUeditor, _React$Component);
   var _super = _createSuper(LcdpUeditor);
@@ -158,7 +159,7 @@ var LcdpUeditor = /*#__PURE__*/function (_React$Component) {
         this.isReportFlag = true;
       } else if (this.props.onChange) {
         this.currentContent = this.ueditorInst.getContent();
-        this.props.onChange(this.currentContent);
+        this.props.onChange(filterHtmlNode(this.currentContent));
       }
     }
   }, {

package/es/tools/filterHtmlNode.d.ts

@@ -0,0 +1 @@
+export declare const filterHtmlNode: (str: string) => string;

package/es/tools/filterHtmlNode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterHtmlNode.d.ts","sourceRoot":"","sources":["filterHtmlNode.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,QAAS,MAAM,WAkCzC,CAAC"}

package/es/tools/filterHtmlNode.js

@@ -0,0 +1,35 @@
+export var filterHtmlNode = function filterHtmlNode(str) {
+  if (typeof str !== 'string') return str || '';
+  var blacklist = ['script', 'style', 'iframe'];
+
+  // 创建一个新的 DOM 解析器对象
+  var parser = new DOMParser();
+
+  // 使用 parseFromString 方法将 HTML 片段转换为 DOM 对象
+  var doc = parser.parseFromString(str, 'text/html');
+
+  // 遍历 DOM 树并删除恶意节点
+  function cleanNode(node) {
+    if (node.nodeType === 1) {
+      // 元素节点
+      if (blacklist.indexOf(node.nodeName.toLowerCase()) !== -1) {
+        var _node$parentNode;
+        (_node$parentNode = node.parentNode) === null || _node$parentNode === void 0 || _node$parentNode.removeChild(node);
+        return;
+      }
+
+      // 移除元素节点上所有事件属性
+      for (var i = node.attributes.length - 1; i >= 0; i -= 1) {
+        var attr = node.attributes[i];
+        if (attr.name.startsWith('on') || String(node.getAttribute(attr.name)).toLowerCase().indexOf('javascript:') !== -1) {
+          node.removeAttribute(attr.name);
+        }
+      }
+    }
+    for (var _i = 0; _i < node.childNodes.length; _i += 1) {
+      cleanNode(node.childNodes[_i]);
+    }
+  }
+  cleanNode(doc.body);
+  return doc.body.innerHTML;
+};

package/lib/LcdpUeditor.js

@@ -37,6 +37,7 @@ var import_const = require("./const");
 var import_defaultConfig = __toESM(require("./defaultConfig.json"));
 var import_UeditorResourceLoader = __toESM(require("./tools/UeditorResourceLoader"));
 var import_lodash = require("lodash");
+var import_filterHtmlNode = require("./tools/filterHtmlNode");
 var LcdpUeditor = class extends import_react.default.Component {
   constructor(props) {
     super(props);
@@ -144,7 +145,7 @@ var LcdpUeditor = class extends import_react.default.Component {
       this.isReportFlag = true;
     } else if (this.props.onChange) {
       this.currentContent = this.ueditorInst.getContent();
-      this.props.onChange(this.currentContent);
+      this.props.onChange((0, import_filterHtmlNode.filterHtmlNode)(this.currentContent));
     }
   }
   getExtString(str) {

package/lib/tools/filterHtmlNode.d.ts

@@ -0,0 +1 @@
+export declare const filterHtmlNode: (str: string) => string;

package/lib/tools/filterHtmlNode.js

@@ -0,0 +1,55 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/tools/filterHtmlNode.ts
+var filterHtmlNode_exports = {};
+__export(filterHtmlNode_exports, {
+  filterHtmlNode: () => filterHtmlNode
+});
+module.exports = __toCommonJS(filterHtmlNode_exports);
+var filterHtmlNode = (str) => {
+  if (typeof str !== "string")
+    return str || "";
+  const blacklist = ["script", "style", "iframe"];
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(str, "text/html");
+  function cleanNode(node) {
+    var _a;
+    if (node.nodeType === 1) {
+      if (blacklist.indexOf(node.nodeName.toLowerCase()) !== -1) {
+        (_a = node.parentNode) == null ? void 0 : _a.removeChild(node);
+        return;
+      }
+      for (let i = node.attributes.length - 1; i >= 0; i -= 1) {
+        const attr = node.attributes[i];
+        if (attr.name.startsWith("on") || String(node.getAttribute(attr.name)).toLowerCase().indexOf("javascript:") !== -1) {
+          node.removeAttribute(attr.name);
+        }
+      }
+    }
+    for (let i = 0; i < node.childNodes.length; i += 1) {
+      cleanNode(node.childNodes[i]);
+    }
+  }
+  cleanNode(doc.body);
+  return doc.body.innerHTML;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  filterHtmlNode
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lingxiteam/lcdp-ueditor-react",
-  "version": "1.0.0-alpha.12",
+  "version": "1.0.0-alpha.13",
   "module": "es/index.js",
   "main": "lib/index.js",
   "license": "MIT",