@vtx/components 4.0.0-beta.2 → 4.0.0-beta.21

package/es/vtx-wang-editor/index.js

@@ -1,5 +1,5 @@
 function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
-var _excluded = ["value", "onChange", "downloadUrl", "uploadUrl", "placeholder", "maxFileSize", "maxNumberOfFiles", "height", "status"];
+var _excluded = ["value", "onChange", "downloadUrl", "uploadUrl", "placeholder", "maxFileSize", "defaultMaxFileSize", "maxNumberOfFiles", "height", "status", "enableSanitization", "toolConfig", "editConfig"];
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
@@ -8,21 +8,22 @@ function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
+function _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }
+function _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }
 function _slicedToArray(arr, i) { return _arrayWithHoles(arr) || _iterableToArrayLimit(arr, i) || _unsupportedIterableToArray(arr, i) || _nonIterableRest(); }
 function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
 function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }
 function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i]; return arr2; }
 function _iterableToArrayLimit(r, l) { var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (null != t) { var e, n, i, u, a = [], f = !0, o = !1; try { if (i = (t = t.call(r)).next, 0 === l) { if (Object(t) !== t) return; f = !1; } else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0); } catch (r) { o = !0, n = r; } finally { try { if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return; } finally { if (o) throw n; } } return a; } }
 function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }
-function _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }
-function _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }
 /*eslint-disable*/
-import React, { forwardRef, useState, useEffect, useContext } from 'react';
+import React, { forwardRef, useState, useEffect, useContext, useCallback } from 'react';
 import PropTypes from 'prop-types';
 import { Editor, Toolbar } from '@wangeditor/editor-for-react';
 import attachmentModule from '@wangeditor/plugin-upload-attachment';
 import { Boot } from '@wangeditor/editor';
-import { withEmptyHtml, findAllImgSrcsFromHtml, extractImageDataFromRtf, replaceImagesFileSourceWithInlineRepresentation, replaceAllSpanFontSize } from "./wangEditorUtil";
+import getToken from "../utils/getToken";
+import { withEmptyHtml, findAllImgSrcsFromHtml, extractImageDataFromRtf, replaceImagesFileSourceWithInlineRepresentation, replaceAllSpanFontSize, sanitizeHtml } from "./wangEditorUtil";
 import { ConfigProvider } from 'antd';
 import cls from 'classnames';
 import { useStyle } from "./style/index";
@@ -44,13 +45,30 @@ var VtxWangEditor = function VtxWangEditor(props) {
   var _useStyle = useStyle(prefixCls),
     wrapSSR = _useStyle.wrapSSR,
     hashId = _useStyle.hashId;
+
+  // 添加加载状态管理
+  var _useState = useState(false),
+    _useState2 = _slicedToArray(_useState, 2),
+    loading = _useState2[0],
+    setLoading = _useState2[1];
+  var _useState3 = useState(null),
+    _useState4 = _slicedToArray(_useState3, 2),
+    error = _useState4[0],
+    setError = _useState4[1];
+
+  // 添加错误边界处理
+  var handleError = useCallback(function (error) {
+    console.error('VtxWangEditor Error:', error);
+    setError(error.message);
+    // 可以在这里添加错误上报逻辑
+  }, []);
   var _React$useContext = React.useContext(FormItemInputContext),
     contextStatus = _React$useContext.status,
     hasFeedback = _React$useContext.hasFeedback,
     isFormItemInput = _React$useContext.isFormItemInput,
     feedbackIcon = _React$useContext.feedbackIcon;
   var value = props.value,
-    _onChange = props.onChange,
+    onChange = props.onChange,
     _props$downloadUrl = props.downloadUrl,
     downloadUrl = _props$downloadUrl === void 0 ? '/cloudFile/common/downloadFile?id=' : _props$downloadUrl,
     _props$uploadUrl = props.uploadUrl,
@@ -59,77 +77,273 @@ var VtxWangEditor = function VtxWangEditor(props) {
     placeholder = _props$placeholder === void 0 ? '' : _props$placeholder,
     _props$maxFileSize = props.maxFileSize,
     maxFileSize = _props$maxFileSize === void 0 ? 5 * 1024 * 1024 : _props$maxFileSize,
+    _props$defaultMaxFile = props.defaultMaxFileSize,
+    defaultMaxFileSize = _props$defaultMaxFile === void 0 ? 1024 * 1024 * 1024 : _props$defaultMaxFile,
     _props$maxNumberOfFil = props.maxNumberOfFiles,
     maxNumberOfFiles = _props$maxNumberOfFil === void 0 ? 5 : _props$maxNumberOfFil,
     _props$height = props.height,
     height = _props$height === void 0 ? 350 : _props$height,
     customStatus = props.status,
+    _props$enableSanitiza = props.enableSanitization,
+    enableSanitization = _props$enableSanitiza === void 0 ? true : _props$enableSanitiza,
+    _props$toolConfig = props.toolConfig,
+    toolConfig = _props$toolConfig === void 0 ? {} : _props$toolConfig,
+    _props$editConfig = props.editConfig,
+    editConfig = _props$editConfig === void 0 ? {} : _props$editConfig,
     rest = _objectWithoutProperties(props, _excluded);
   var mergedStatus = getMergedStatus(contextStatus, customStatus);
-  var _useState = useState(null),
-    _useState2 = _slicedToArray(_useState, 2),
-    editor = _useState2[0],
-    setEditor = _useState2[1];
+  var _useState5 = useState(null),
+    _useState6 = _slicedToArray(_useState5, 2),
+    editor = _useState6[0],
+    setEditor = _useState6[1];
 
   // 及时销毁 editor ，重要！
   useEffect(function () {
     return function () {
+      window.REGISTRY_UPLOAD_FILE = false;
+      if (editor == null) return;
       if (editor) {
         editor.destroy();
         setEditor(null);
       }
     };
   }, []);
+
+  // 修改安全的粘贴处理函数
+  var handleSafePaste = useCallback( /*#__PURE__*/function () {
+    var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(editor, event) {
+      var html, rtf, plainText, imgSrcs, rtfImageData;
+      return _regeneratorRuntime().wrap(function _callee$(_context) {
+        while (1) switch (_context.prev = _context.next) {
+          case 0:
+            event.preventDefault();
+            _context.prev = 1;
+            // 获取粘贴内容
+            html = event.clipboardData.getData('text/html');
+            rtf = event.clipboardData.getData('text/rtf');
+            plainText = event.clipboardData.getData('text/plain'); // 如果没有HTML内容，直接粘贴纯文本
+            if (html) {
+              _context.next = 8;
+              break;
+            }
+            if (plainText) {
+              setTimeout(function () {
+                editor.insertText(plainText);
+              }, 0);
+            }
+            return _context.abrupt("return", false);
+          case 8:
+            // 安全过滤原始HTML内容
+            if (enableSanitization) {
+              html = sanitizeHtml(html);
+            }
+
+            // 处理Word粘贴（包含RTF数据）
+            if (!rtf) {
+              _context.next = 32;
+              break;
+            }
+            _context.prev = 10;
+            // 列表缩进会超出边框，直接过滤掉
+            html = html.replace(/text\-indent:\-(.*?)pt/gi, '');
+
+            // 从html内容中查找粘贴内容中是否有图片元素
+            imgSrcs = findAllImgSrcsFromHtml(html);
+            html = replaceAllSpanFontSize(html);
+
+            // 处理图片（如果有的话）
+            if (!(imgSrcs && Array.isArray(imgSrcs) && imgSrcs.length)) {
+              _context.next = 27;
+              break;
+            }
+            rtfImageData = extractImageDataFromRtf(rtf);
+            if (!rtfImageData.length) {
+              _context.next = 27;
+              break;
+            }
+            _context.prev = 17;
+            _context.next = 20;
+            return replaceImagesFileSourceWithInlineRepresentation(html, imgSrcs, rtfImageData, true, uploadUrl, downloadUrl);
+          case 20:
+            html = _context.sent;
+            // 对处理后的HTML再次进行安全过滤
+            if (enableSanitization) {
+              html = sanitizeHtml(html);
+            }
+            _context.next = 27;
+            break;
+          case 24:
+            _context.prev = 24;
+            _context.t0 = _context["catch"](17);
+            console.warn('图片处理失败，将跳过图片处理:', _context.t0.message);
+            // 图片处理失败时，保留原始HTML（不含图片）
+            // 不抛出错误，继续处理文字内容
+          case 27:
+            _context.next = 32;
+            break;
+          case 29:
+            _context.prev = 29;
+            _context.t1 = _context["catch"](10);
+            console.warn('Word内容处理失败，将粘贴原始内容:', _context.t1.message);
+            // 处理失败时，回退到原始HTML
+          case 32:
+            // 安全插入HTML（无论是处理过的还是原始的）
+            setTimeout(function () {
+              try {
+                editor.dangerouslyInsertHtml(html);
+              } catch (insertError) {
+                // 如果HTML插入失败，尝试插入纯文本作为备选
+                if (plainText) {
+                  editor.insertText(plainText);
+                }
+                handleError(new Error('内容插入失败: ' + insertError.message));
+              }
+            }, 0);
+            return _context.abrupt("return", false);
+          case 36:
+            _context.prev = 36;
+            _context.t2 = _context["catch"](1);
+            // 最后的兜底处理
+            console.error('粘贴处理严重错误:', _context.t2);
+            if (event.clipboardData.getData('text/plain')) {
+              // 至少确保文字能够粘贴
+              setTimeout(function () {
+                editor.insertText(event.clipboardData.getData('text/plain'));
+              }, 0);
+            }
+            handleError(new Error('粘贴处理失败: ' + _context.t2.message));
+            return _context.abrupt("return", false);
+          case 42:
+          case "end":
+            return _context.stop();
+        }
+      }, _callee, null, [[1, 36], [10, 29], [17, 24]]);
+    }));
+    return function (_x, _x2) {
+      return _ref.apply(this, arguments);
+    };
+  }(), [uploadUrl, downloadUrl, enableSanitization, handleError]);
+
+  // 添加安全的onChange处理
+  var handleEditorChange = useCallback(function (editor) {
+    try {
+      var newValue = editor.getHtml() || undefined;
+      // 对输出内容也进行安全过滤
+      var processedValue = enableSanitization && newValue !== undefined ? sanitizeHtml(newValue) : newValue;
+      console.log('编辑器内容变化，处理前内容:', newValue);
+      console.log('编辑器内容变化，处理后内容:', processedValue);
+      if (processedValue !== value) {
+        onChange(processedValue);
+      }
+    } catch (error) {
+      handleError(new Error('编辑器内容处理失败: ' + error.message));
+    }
+  }, [value, onChange, enableSanitization, handleError]);
+
   // 编辑器配置
-  var editorConfig = {
+  var editorConfig = _objectSpread(_objectSpread({}, editConfig), {}, {
     MENU_CONF: {
       // 插入图片
       uploadImage: {
         server: uploadUrl,
-        maxFileSize: maxFileSize,
+        maxFileSize: defaultMaxFileSize,
         maxNumberOfFiles: maxNumberOfFiles,
+        headers: {
+          access_token: getToken(),
+          Authorization: 'Bearer ' + getToken()
+        },
         // onSuccess(file, res) {},
+        onBeforeUpload: function onBeforeUpload(file) {
+          for (var key in file) {
+            if (file[key].size > maxFileSize) {
+              message.warn("\u8D85\u8FC7\u6587\u4EF6\u5927\u5C0F\u9650\u5236\uFF0C\u6700\u5927\u6587\u4EF6\u5927\u5C0F\u4E3A".concat(maxFileSize / 1024 / 1024, "M"));
+              // return { [key]: false };
+              return {};
+            }
+          }
+          return file;
+        },
+        onError: function onError(file, err, res) {
+          handleError(new Error(intl.getMessage('wangEditor.imageUploadFailed', '图片上传失败')));
+        },
         customInsert: function customInsert(res, insertFn) {
-          console.log(res, insertFn);
-          // res 即服务端的返回结果
-          // 从 res 中找到 url alt href ，然后插入图片
-          if (res.result == 0) {
-            res.data.map(function (item) {
-              insertFn("".concat(downloadUrl).concat(item.id), item.fileName);
-            });
-          } else {
-            console.log(111);
-            throw new Error(intl.getMessage('wangEditor.imageInsertionFailed', '插入图片失败'));
+          try {
+            console.log(res, insertFn);
+            // res 即服务端的返回结果
+            // 从 res 中找到 url alt href ，然后插入图片
+            if (res.result == 0) {
+              res.data.map(function (item) {
+                insertFn("".concat(downloadUrl).concat(item.id), item.fileName);
+              });
+            } else {
+              throw new Error(intl.getMessage('wangEditor.imageInsertionFailed', '插入图片失败'));
+            }
+          } catch (error) {
+            handleError(error);
           }
         }
       },
       // 插入视频
       uploadVideo: {
         server: uploadUrl,
+        maxFileSize: defaultMaxFileSize,
+        headers: {
+          access_token: getToken(),
+          Authorization: 'Bearer ' + getToken()
+        },
+        onError: function onError(file, err, res) {
+          handleError(new Error(intl.getMessage('wangEditor.videoUploadFailed', '视频上传失败')));
+        },
+        onBeforeUpload: function onBeforeUpload(file) {
+          for (var key in file) {
+            if (file[key].size > maxFileSize) {
+              message.warn("\u8D85\u8FC7\u6587\u4EF6\u5927\u5C0F\u9650\u5236\uFF0C\u6700\u5927\u6587\u4EF6\u5927\u5C0F\u4E3A".concat(maxFileSize / 1024 / 1024, "M"));
+              // return { [key]: false };
+              return {};
+            }
+          }
+          return file;
+        },
         // onSuccess(file, res) {},
         // 上传成功后，用户自定义插入文件
         customInsert: function customInsert(res, insertFn) {
-          if (res.result == 0) {
-            res.data.map(function (item) {
-              insertFn("".concat(downloadUrl).concat(item.id), item.fileName);
-            });
-          } else {
-            throw new Error(intl.getMessage('wangEditor.videoInsertionFailed', '插入视频失败'));
+          try {
+            if (res.result == 0) {
+              res.data.map(function (item) {
+                insertFn("".concat(downloadUrl).concat(item.id), item.fileName);
+              });
+            } else {
+              throw new Error(intl.getMessage('wangEditor.videoInsertionFailed', '插入视频失败'));
+            }
+          } catch (error) {
+            handleError(error);
           }
         }
       },
       // 插入附件
       uploadAttachment: {
         server: uploadUrl,
+        headers: {
+          access_token: getToken(),
+          Authorization: 'Bearer ' + getToken()
+        },
+        onError: function onError(file, err, res) {
+          handleError(new Error(intl.getMessage('wangEditor.attachmentUploadFailed', '附件上传失败')));
+        },
         // onSuccess(file, res) {},
         // 上传成功后，用户自定义插入文件
         customInsert: function customInsert(res, file, insertFn) {
-          if (res.result == 0) {
-            res.data.map(function (item) {
-              insertFn(item.fileName, "".concat(downloadUrl).concat(item.id));
-            });
-          } else {
-            throw new Error(intl.getMessage('wangEditor.attachmentInsertionFailed', '插入附件失败'));
+          try {
+            if (res.result == 0) {
+              res.data.map(function (item) {
+                console.log('插入附件:', item, insertFn);
+                insertFn(item.fileName, "".concat(downloadUrl).concat(item.id));
+              });
+            } else {
+              throw new Error(intl.getMessage('wangEditor.attachmentInsertionFailed', '插入附件失败'));
+            }
+          } catch (error) {
+            handleError(error);
           }
         }
       }
@@ -141,74 +355,19 @@ var VtxWangEditor = function VtxWangEditor(props) {
         menuKeys: ['downloadAttachment'] // “下载附件”菜单
       }
     },
-    customPaste: function () {
-      var _customPaste = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(editor, event) {
-        var html, rtf, imgSrcs, rtfImageData;
-        return _regeneratorRuntime().wrap(function _callee$(_context) {
-          while (1) switch (_context.prev = _context.next) {
-            case 0:
-              event.preventDefault();
-              // 获取粘贴的html部分（？？没错粘贴word时候，一部分内容就是html），该部分包含了图片img标签
-              html = event.clipboardData.getData('text/html'); // 获取rtf数据（从word、wps复制粘贴时有），复制粘贴过程中图片的数据就保存在rtf中
-              rtf = event.clipboardData.getData('text/rtf'); // 该条件分支即表示要自定义word粘贴
-              if (!(html && rtf)) {
-                _context.next = 17;
-                break;
-              }
-              // 列表缩进会超出边框，直接过滤掉
-              html = html.replace(/text\-indent:\-(.*?)pt/gi, '');
-
-              // 从html内容中查找粘贴内容中是否有图片元素，并返回img标签的属性src值的集合
-              imgSrcs = findAllImgSrcsFromHtml(html);
-              html = replaceAllSpanFontSize(html);
-
-              // 如果有图片
-              if (!(imgSrcs && Array.isArray(imgSrcs) && imgSrcs.length)) {
-                _context.next = 13;
-                break;
-              }
-              // 从rtf内容中查找图片数据
-              // 从rtf内容中查找图片数据
-              rtfImageData = extractImageDataFromRtf(rtf);
-              if (!rtfImageData.length) {
-                _context.next = 13;
-                break;
-              }
-              _context.next = 12;
-              return replaceImagesFileSourceWithInlineRepresentation(html, imgSrcs, rtfImageData, true, uploadUrl, downloadUrl);
-            case 12:
-              html = _context.sent;
-            case 13:
-              editor.dangerouslyInsertHtml(html);
-              return _context.abrupt("return", false);
-            case 17:
-              if (!html) {
-                _context.next = 20;
-                break;
-              }
-              editor.dangerouslyInsertHtml(html);
-              return _context.abrupt("return", false);
-            case 20:
-            case "end":
-              return _context.stop();
-          }
-        }, _callee);
-      }));
-      function customPaste(_x, _x2) {
-        return _customPaste.apply(this, arguments);
-      }
-      return customPaste;
-    }()
-  };
+    // 使用安全的粘贴处理函数
+    customPaste: handleSafePaste
+  });
   // 工具栏配置
-  var toolbarConfig = {
+  var toolbarConfig = _objectSpread(_objectSpread({}, toolConfig), {}, {
+    // 自定义工具栏
     insertKeys: {
       // 自定义插入的位置
       index: 24,
       // “上传附件”菜单
       keys: ['uploadAttachment']
     }
-  };
+  });
   return /*#__PURE__*/_jsxs("div", {
     className: cls(prefixCls, getStatusClassNames(prefixCls, mergedStatus, hasFeedback), props.prefixCls),
     children: [/*#__PURE__*/_jsx(Toolbar, {
@@ -217,19 +376,14 @@ var VtxWangEditor = function VtxWangEditor(props) {
       mode: "default"
     }), /*#__PURE__*/_jsx(Editor, _objectSpread({
       defaultConfig: editorConfig,
-      value: value ? value : '',
-      onCreated: function onCreated(editor) {
-        setEditor(editor);
-      },
-      onChange: function onChange(editor) {
-        var nextValue = value ? value : undefined;
-        var prevValue = editor.getHtml() ? editor.getHtml() : undefined;
-        if (nextValue !== prevValue) {
-          _onChange(editor.getHtml());
-        }
-      },
+      value: value ? enableSanitization ? sanitizeHtml(value) : value : '',
+      onCreated: setEditor,
+      onChange: handleEditorChange,
       mode: "default",
-      className: cls("".concat(prefixCls, "-content"), hashId)
+      className: cls("".concat(prefixCls, "-content"), hashId),
+      style: {
+        height: height
+      }
     }, rest))]
   });
 };
@@ -241,5 +395,21 @@ VtxWangEditor.propTypes = {
   placeholder: PropTypes.string,
   downloadUrl: PropTypes.string,
   uploadUrl: PropTypes.string,
-  height: PropTypes.number
+  height: PropTypes.number,
+  maxFileSize: PropTypes.number,
+  maxNumberOfFiles: PropTypes.number,
+  status: PropTypes.string,
+  prefixCls: PropTypes.string,
+  enableSanitization: PropTypes.bool // 是否启用HTML过滤
+};
+
+// 添加默认属性
+VtxWangEditor.defaultProps = {
+  enableSanitization: true,
+  maxFileSize: 5 * 1024 * 1024,
+  maxNumberOfFiles: 5,
+  height: 350,
+  placeholder: '',
+  downloadUrl: '/cloudFile/common/downloadFile?id=',
+  uploadUrl: '/cloudFile/common/uploadFile'
 };

package/es/vtx-wang-editor/wangEditorUtil.js

@@ -5,6 +5,25 @@ function _asyncToGenerator(fn) { return function () { var self = this, args = ar
 function _createForOfIteratorHelper(o, allowArrayLike) { var it = typeof Symbol !== "undefined" && o[Symbol.iterator] || o["@@iterator"]; if (!it) { if (Array.isArray(o) || (it = _unsupportedIterableToArray(o)) || allowArrayLike && o && typeof o.length === "number") { if (it) o = it; var i = 0; var F = function F() {}; return { s: F, n: function n() { if (i >= o.length) return { done: true }; return { done: false, value: o[i++] }; }, e: function e(_e) { throw _e; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var normalCompletion = true, didErr = false, err; return { s: function s() { it = it.call(o); }, n: function n() { var step = it.next(); normalCompletion = step.done; return step; }, e: function e(_e2) { didErr = true; err = _e2; }, f: function f() { try { if (!normalCompletion && it.return != null) it.return(); } finally { if (didErr) throw err; } } }; }
 function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }
 function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i]; return arr2; }
+import DOMPurify from 'dompurify';
+
+// 添加HTML安全过滤函数
+export function sanitizeHtml(html) {
+  if (!html) return '';
+
+  // 配置DOMPurify白名单
+  var config = {
+    ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'blockquote', 'pre', 'code', 'span', 'div', 'table', 'thead', 'tbody', 'tr', 'td', 'th', 'img', 'a', 'figure', 'figcaption'],
+    ALLOWED_ATTR: ['href', 'src', 'alt', 'title', 'class', 'style', 'width', 'height', 'target', 'rel', 'align', 'valign', 'colspan', 'rowspan', 'download'],
+    // 关键：允许所有data-*属性
+    ADD_ATTR: ['data-*'],
+    // 或者使用：
+    ALLOW_DATA_ATTR: true,
+    FORBID_PROTOCOLS: ['javascript:', 'data:', 'vbscript:'],
+    KEEP_CONTENT: true
+  };
+  return DOMPurify.sanitize(html, config);
+}
 export function replaceAllSpanFontSize(htmlData) {
   var spanReg = /\<span([\s\S]+?)\<\/span\>/g;
   var fontReg = /\<font([\s\S]+?)\<\/font\>/g;
@@ -132,6 +151,8 @@ export function extractImageDataFromRtf(rtfData) {
 export function replaceImagesFileSourceWithInlineRepresentation(_x, _x2, _x3) {
   return _replaceImagesFileSourceWithInlineRepresentation.apply(this, arguments);
 }
+
+// 验证base64数据有效性
 function _replaceImagesFileSourceWithInlineRepresentation() {
   _replaceImagesFileSourceWithInlineRepresentation = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(htmlData, imageSrcs, imagesHexSources) {
     var isBase64Data,
@@ -161,42 +182,53 @@ function _replaceImagesFileSourceWithInlineRepresentation() {
           uploadUrl = _args.length > 4 ? _args[4] : undefined;
           downloadUrl = _args.length > 5 ? _args[5] : undefined;
           if (!(imageSrcs.length === imagesHexSources.length)) {
-            _context.next = 23;
+            _context.next = 26;
             break;
           }
           i = 0;
         case 5:
           if (!(i < imageSrcs.length)) {
-            _context.next = 23;
+            _context.next = 26;
             break;
           }
           url = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i = imageSrcs[i]) === null || _imageSrcs$i === void 0 ? void 0 : _imageSrcs$i.url;
           width = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i2 = imageSrcs[i]) === null || _imageSrcs$i2 === void 0 ? void 0 : _imageSrcs$i2.width;
           height = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i3 = imageSrcs[i]) === null || _imageSrcs$i3 === void 0 ? void 0 : _imageSrcs$i3.height;
           img = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i4 = imageSrcs[i]) === null || _imageSrcs$i4 === void 0 ? void 0 : _imageSrcs$i4.img;
-          newSrc = isBase64Data ? "data:".concat(imagesHexSources[i].type, ";base64,").concat(_convertHexToBase64(imagesHexSources[i].hex)) : imagesHexSources[i];
+          newSrc = isBase64Data ? "data:".concat(imagesHexSources[i].type, ";base64,").concat(_convertHexToBase64(imagesHexSources[i].hex)) : imagesHexSources[i]; // 安全检查：验证base64数据的有效性
+          if (isValidBase64(newSrc)) {
+            _context.next = 14;
+            break;
+          }
+          console.warn('Invalid base64 image data detected, skipping...');
+          return _context.abrupt("continue", 23);
+        case 14:
           formData = new FormData();
           blob = convertBase64UrlToBlob(newSrc);
           imgName = ((_url$split = url.split('\\')) === null || _url$split === void 0 || (_url$split = _url$split.slice(-1)) === null || _url$split === void 0 ? void 0 : _url$split[0]) || 'image.jpg';
           file = new File([blob], imgName);
           formData.append('file', file);
-          _context.next = 18;
+          _context.next = 21;
           return window.fetch(uploadUrl, {
             method: 'POST',
+            headers: {
+              access_token: getToken(),
+              Authorization: 'Bearer ' + getToken()
+            },
             body: formData
           }).then(function (response) {
             return response.json();
           });
-        case 18:
+        case 21:
           res = _context.sent;
-          htmlData = htmlData.replace(img, "<img src=\"".concat(downloadUrl).concat(res.data[0].id, "\" style=\"width:").concat(width, "px;height:").concat(height, "px\""));
-        case 20:
+          htmlData = htmlData.replace(img, "<img src=\"".concat(downloadUrl).concat(res.data[0].id, "\" style=\"width:").concat(width, "px;height:").concat(height, "px\" alt=\"").concat(res.data[0].fileName || imgName, "\" />"));
+        case 23:
           i++;
           _context.next = 5;
           break;
-        case 23:
+        case 26:
           return _context.abrupt("return", htmlData);
-        case 24:
+        case 27:
         case "end":
           return _context.stop();
       }
@@ -204,6 +236,24 @@ function _replaceImagesFileSourceWithInlineRepresentation() {
   }));
   return _replaceImagesFileSourceWithInlineRepresentation.apply(this, arguments);
 }
+function isValidBase64(str) {
+  try {
+    // 检查是否包含有效的base64前缀
+    if (!str.startsWith('data:image/')) {
+      return false;
+    }
+
+    // 检查base64编码的有效性
+    var base64Part = str.split(',')[1];
+    if (!base64Part) return false;
+
+    // 尝试解码验证
+    atob(base64Part);
+    return true;
+  } catch (e) {
+    return false;
+  }
+}
 function _convertHexToBase64(hexString) {
   return btoa(hexString.match(/\w{2}/g).map(function (char) {
     return String.fromCharCode(parseInt(char, 16));