@lingxiteam/lcdp-ueditor-react 1.0.0-alpha.12 → 1.0.0-alpha.14

package/es/LcdpUeditor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LcdpUeditor.d.ts","sourceRoot":"","sources":["LcdpUeditor.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAOhD,cAAM,WAAY,SAAQ,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC9D;;OAEG;IACH,WAAW,EAAE,MAAM,CAAwB;IAE3C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAwD;IAExE;;OAEG;IACH,OAAO,CAAC,YAAY,CAAwD;IAE5E;;OAEG;IACH,OAAO,CAAC,WAAW,CAAS;IAE5B;;OAEG;IACH,OAAO,CAAC,WAAW,CAAa;IAEhC;;OAEG;IACH,OAAO,CAAC,YAAY,CAAiB;IAErC;;OAEG;IACH,OAAO,CAAC,qBAAqB,CAAW;IAExC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAc;IAEpC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAM;IAE5B;;OAEG;IACH,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACH,KAAK,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC,CAEnC;IAEF;;OAEG;IACH,YAAY,EAAE,GAAG,CAAM;gBAEX,KAAK,EAAE,iBAAiB;IA0CpC,iBAAiB,IAAI,IAAI;IAIzB,yBAAyB,CAAC,SAAS,EAAE,iBAAiB;IAiBtD,oBAAoB,IAAI,IAAI;IAM5B,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,YAAY;IAOpB;;;;OAIG;YACW,UAAU;IAqCxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAMhB;;OAEG;IACH,OAAO,CAAC,SAAS;IAcjB;;OAEG;IACG,WAAW;IAiCjB,MAAM,IAAI,KAAK,CAAC,SAAS;CAY1B;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"LcdpUeditor.d.ts","sourceRoot":"","sources":["LcdpUeditor.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAQhD,cAAM,WAAY,SAAQ,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC9D;;OAEG;IACH,WAAW,EAAE,MAAM,CAAwB;IAE3C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAwD;IAExE;;OAEG;IACH,OAAO,CAAC,YAAY,CAAwD;IAE5E;;OAEG;IACH,OAAO,CAAC,WAAW,CAAS;IAE5B;;OAEG;IACH,OAAO,CAAC,WAAW,CAAa;IAEhC;;OAEG;IACH,OAAO,CAAC,YAAY,CAAiB;IAErC;;OAEG;IACH,OAAO,CAAC,qBAAqB,CAAW;IAExC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAc;IAEpC;;OAEG;IACH,OAAO,CAAC,cAAc,CAAM;IAE5B;;OAEG;IACH,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACH,KAAK,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC,CAEnC;IAEF;;OAEG;IACH,YAAY,EAAE,GAAG,CAAM;gBAEX,KAAK,EAAE,iBAAiB;IA2CpC,iBAAiB,IAAI,IAAI;IAIzB,yBAAyB,CAAC,SAAS,EAAE,iBAAiB;IAiBtD,oBAAoB,IAAI,IAAI;IAM5B,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,YAAY;IAOpB;;;;OAIG;YACW,UAAU;IAqCxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAMhB;;OAEG;IACH,OAAO,CAAC,SAAS;IAcjB;;OAEG;IACG,WAAW;IAiCjB,MAAM,IAAI,KAAK,CAAC,SAAS;CAY1B;AAED,eAAe,WAAW,CAAC"}

package/es/LcdpUeditor.js

@@ -22,6 +22,7 @@ import { DEFAULT_UEDITOR_CONFIG, DEFAULT_UEDITOR_PATH } from "./const";
 import DefaultConfig from "./defaultConfig.json";
 import UeditorResourceLoader from "./tools/UeditorResourceLoader";
 import { debounce } from 'lodash';
+import { filterHtmlNode } from "./tools/filterHtmlNode";
 var LcdpUeditor = /*#__PURE__*/function (_React$Component) {
   _inherits(LcdpUeditor, _React$Component);
   var _super = _createSuper(LcdpUeditor);
@@ -84,7 +85,8 @@ var LcdpUeditor = /*#__PURE__*/function (_React$Component) {
     if (_this.props.ueditorPath) {
       _this.ueditorPath = _this.props.ueditorPath;
     }
-    _this.currentContent = _this.props.value;
+    var nextValue = filterHtmlNode(_this.props.value || '');
+    _this.currentContent = nextValue;
     _this.uploadFunction = function (file, type) {
       var _this$props$config;
       // TODO 内置上传 图片base64
@@ -115,7 +117,7 @@ var LcdpUeditor = /*#__PURE__*/function (_React$Component) {
         _this.fileSelect(cb, type);
       },
       uploadFunction: _this.uploadFunction,
-      initialContent: _this.props.value || ''
+      initialContent: nextValue || ''
     });
     _this.debounceContentChange = debounce(_this.onContentChange.bind(_assertThisInitialized(_this)), 300);
     return _this;
@@ -131,7 +133,7 @@ var LcdpUeditor = /*#__PURE__*/function (_React$Component) {
       if (this.isReady) {
         if ('value' in nextProps && this.currentContent !== nextProps.value) {
           this.isReportFlag = false;
-          this.ueditorInst.setContent(nextProps.value || '');
+          this.ueditorInst.setContent(filterHtmlNode(nextProps.value || ''));
         }
         // 禁用操作需要调用指定的api进行操作
         if (nextProps.disabled !== this.props.disabled) {
@@ -157,7 +159,7 @@ var LcdpUeditor = /*#__PURE__*/function (_React$Component) {
       if (!this.isReportFlag) {
         this.isReportFlag = true;
       } else if (this.props.onChange) {
-        this.currentContent = this.ueditorInst.getContent();
+        this.currentContent = filterHtmlNode(this.ueditorInst.getContent() || '');
         this.props.onChange(this.currentContent);
       }
     }

package/es/tools/filterHtmlNode.d.ts

@@ -0,0 +1 @@
+export declare const filterHtmlNode: (str: string) => string;

package/es/tools/filterHtmlNode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterHtmlNode.d.ts","sourceRoot":"","sources":["filterHtmlNode.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,QAAS,MAAM,WAkCzC,CAAC"}

package/es/tools/filterHtmlNode.js

@@ -0,0 +1,35 @@
+export var filterHtmlNode = function filterHtmlNode(str) {
+  if (typeof str !== 'string') return str || '';
+  var blacklist = ['script', 'style', 'iframe'];
+
+  // 创建一个新的 DOM 解析器对象
+  var parser = new DOMParser();
+
+  // 使用 parseFromString 方法将 HTML 片段转换为 DOM 对象
+  var doc = parser.parseFromString(str, 'text/html');
+
+  // 遍历 DOM 树并删除恶意节点
+  function cleanNode(node) {
+    if (node.nodeType === 1) {
+      // 元素节点
+      if (blacklist.indexOf(node.nodeName.toLowerCase()) !== -1) {
+        var _node$parentNode;
+        (_node$parentNode = node.parentNode) === null || _node$parentNode === void 0 || _node$parentNode.removeChild(node);
+        return;
+      }
+
+      // 移除元素节点上所有事件属性
+      for (var i = node.attributes.length - 1; i >= 0; i -= 1) {
+        var attr = node.attributes[i];
+        if (attr.name.startsWith('on') || String(node.getAttribute(attr.name)).toLowerCase().indexOf('javascript:') !== -1) {
+          node.removeAttribute(attr.name);
+        }
+      }
+    }
+    for (var _i = 0; _i < node.childNodes.length; _i += 1) {
+      cleanNode(node.childNodes[_i]);
+    }
+  }
+  cleanNode(doc.body);
+  return doc.body.innerHTML;
+};

package/lib/LcdpUeditor.js

@@ -37,6 +37,7 @@ var import_const = require("./const");
 var import_defaultConfig = __toESM(require("./defaultConfig.json"));
 var import_UeditorResourceLoader = __toESM(require("./tools/UeditorResourceLoader"));
 var import_lodash = require("lodash");
+var import_filterHtmlNode = require("./tools/filterHtmlNode");
 var LcdpUeditor = class extends import_react.default.Component {
   constructor(props) {
     super(props);
@@ -83,7 +84,8 @@ var LcdpUeditor = class extends import_react.default.Component {
     if (this.props.ueditorPath) {
       this.ueditorPath = this.props.ueditorPath;
     }
-    this.currentContent = this.props.value;
+    const nextValue = (0, import_filterHtmlNode.filterHtmlNode)(this.props.value || "");
+    this.currentContent = nextValue;
     this.uploadFunction = (file, type) => {
       var _a;
       if (type === "image" && ((_a = this.props.config) == null ? void 0 : _a.imageType) === "base64") {
@@ -111,7 +113,7 @@ var LcdpUeditor = class extends import_react.default.Component {
         this.fileSelect(cb, type);
       },
       uploadFunction: this.uploadFunction,
-      initialContent: this.props.value || ""
+      initialContent: nextValue || ""
     };
     this.debounceContentChange = (0, import_lodash.debounce)(this.onContentChange.bind(this), 300);
   }
@@ -122,7 +124,7 @@ var LcdpUeditor = class extends import_react.default.Component {
     if (this.isReady) {
       if ("value" in nextProps && this.currentContent !== nextProps.value) {
         this.isReportFlag = false;
-        this.ueditorInst.setContent(nextProps.value || "");
+        this.ueditorInst.setContent((0, import_filterHtmlNode.filterHtmlNode)(nextProps.value || ""));
       }
       if (nextProps.disabled !== this.props.disabled) {
         if (nextProps.disabled) {
@@ -143,7 +145,7 @@ var LcdpUeditor = class extends import_react.default.Component {
     if (!this.isReportFlag) {
       this.isReportFlag = true;
     } else if (this.props.onChange) {
-      this.currentContent = this.ueditorInst.getContent();
+      this.currentContent = (0, import_filterHtmlNode.filterHtmlNode)(this.ueditorInst.getContent() || "");
       this.props.onChange(this.currentContent);
     }
   }

package/lib/tools/filterHtmlNode.d.ts

@@ -0,0 +1 @@
+export declare const filterHtmlNode: (str: string) => string;

package/lib/tools/filterHtmlNode.js

@@ -0,0 +1,55 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/tools/filterHtmlNode.ts
+var filterHtmlNode_exports = {};
+__export(filterHtmlNode_exports, {
+  filterHtmlNode: () => filterHtmlNode
+});
+module.exports = __toCommonJS(filterHtmlNode_exports);
+var filterHtmlNode = (str) => {
+  if (typeof str !== "string")
+    return str || "";
+  const blacklist = ["script", "style", "iframe"];
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(str, "text/html");
+  function cleanNode(node) {
+    var _a;
+    if (node.nodeType === 1) {
+      if (blacklist.indexOf(node.nodeName.toLowerCase()) !== -1) {
+        (_a = node.parentNode) == null ? void 0 : _a.removeChild(node);
+        return;
+      }
+      for (let i = node.attributes.length - 1; i >= 0; i -= 1) {
+        const attr = node.attributes[i];
+        if (attr.name.startsWith("on") || String(node.getAttribute(attr.name)).toLowerCase().indexOf("javascript:") !== -1) {
+          node.removeAttribute(attr.name);
+        }
+      }
+    }
+    for (let i = 0; i < node.childNodes.length; i += 1) {
+      cleanNode(node.childNodes[i]);
+    }
+  }
+  cleanNode(doc.body);
+  return doc.body.innerHTML;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  filterHtmlNode
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lingxiteam/lcdp-ueditor-react",
-  "version": "1.0.0-alpha.12",
+  "version": "1.0.0-alpha.14",
   "module": "es/index.js",
   "main": "lib/index.js",
   "license": "MIT",