@vtx/components 4.0.0-beta.7 → 4.0.0-beta.71

package/lib/vtx-wang-editor/wangEditorUtil.js

@@ -8,13 +8,33 @@ exports.extractImageDataFromRtf = extractImageDataFromRtf;
 exports.findAllImgSrcsFromHtml = findAllImgSrcsFromHtml;
 exports.replaceAllSpanFontSize = replaceAllSpanFontSize;
 exports.replaceImagesFileSourceWithInlineRepresentation = replaceImagesFileSourceWithInlineRepresentation;
+exports.sanitizeHtml = sanitizeHtml;
 exports.withEmptyHtml = withEmptyHtml;
+var _dompurify = _interopRequireDefault(require("dompurify"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 function _createForOfIteratorHelper(o, allowArrayLike) { var it = typeof Symbol !== "undefined" && o[Symbol.iterator] || o["@@iterator"]; if (!it) { if (Array.isArray(o) || (it = _unsupportedIterableToArray(o)) || allowArrayLike && o && typeof o.length === "number") { if (it) o = it; var i = 0; var F = function F() {}; return { s: F, n: function n() { if (i >= o.length) return { done: true }; return { done: false, value: o[i++] }; }, e: function e(_e) { throw _e; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var normalCompletion = true, didErr = false, err; return { s: function s() { it = it.call(o); }, n: function n() { var step = it.next(); normalCompletion = step.done; return step; }, e: function e(_e2) { didErr = true; err = _e2; }, f: function f() { try { if (!normalCompletion && it.return != null) it.return(); } finally { if (didErr) throw err; } } }; }
 function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }
 function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i]; return arr2; }
+// 添加HTML安全过滤函数
+function sanitizeHtml(html) {
+  if (!html) return '';
+
+  // 配置DOMPurify白名单
+  var config = {
+    ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'blockquote', 'pre', 'code', 'span', 'div', 'table', 'thead', 'tbody', 'tr', 'td', 'th', 'img', 'a', 'figure', 'figcaption'],
+    ALLOWED_ATTR: ['href', 'src', 'alt', 'title', 'class', 'style', 'width', 'height', 'target', 'rel', 'align', 'valign', 'colspan', 'rowspan', 'download'],
+    // 关键：允许所有data-*属性
+    ADD_ATTR: ['data-*'],
+    // 或者使用：
+    ALLOW_DATA_ATTR: true,
+    FORBID_PROTOCOLS: ['javascript:', 'data:', 'vbscript:'],
+    KEEP_CONTENT: true
+  };
+  return _dompurify.default.sanitize(html, config);
+}
 function replaceAllSpanFontSize(htmlData) {
   var spanReg = /\<span([\s\S]+?)\<\/span\>/g;
   var fontReg = /\<font([\s\S]+?)\<\/font\>/g;
@@ -141,7 +161,7 @@ function extractImageDataFromRtf(rtfData) {
 }
 function replaceImagesFileSourceWithInlineRepresentation(_x, _x2, _x3) {
   return _replaceImagesFileSourceWithInlineRepresentation.apply(this, arguments);
-}
+} // 验证base64数据有效性
 function _replaceImagesFileSourceWithInlineRepresentation() {
   _replaceImagesFileSourceWithInlineRepresentation = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(htmlData, imageSrcs, imagesHexSources) {
     var isBase64Data,
@@ -171,42 +191,53 @@ function _replaceImagesFileSourceWithInlineRepresentation() {
           uploadUrl = _args.length > 4 ? _args[4] : undefined;
           downloadUrl = _args.length > 5 ? _args[5] : undefined;
           if (!(imageSrcs.length === imagesHexSources.length)) {
-            _context.next = 23;
+            _context.next = 26;
             break;
           }
           i = 0;
         case 5:
           if (!(i < imageSrcs.length)) {
-            _context.next = 23;
+            _context.next = 26;
             break;
           }
           url = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i = imageSrcs[i]) === null || _imageSrcs$i === void 0 ? void 0 : _imageSrcs$i.url;
           width = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i2 = imageSrcs[i]) === null || _imageSrcs$i2 === void 0 ? void 0 : _imageSrcs$i2.width;
           height = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i3 = imageSrcs[i]) === null || _imageSrcs$i3 === void 0 ? void 0 : _imageSrcs$i3.height;
           img = imageSrcs === null || imageSrcs === void 0 || (_imageSrcs$i4 = imageSrcs[i]) === null || _imageSrcs$i4 === void 0 ? void 0 : _imageSrcs$i4.img;
-          newSrc = isBase64Data ? "data:".concat(imagesHexSources[i].type, ";base64,").concat(_convertHexToBase64(imagesHexSources[i].hex)) : imagesHexSources[i];
+          newSrc = isBase64Data ? "data:".concat(imagesHexSources[i].type, ";base64,").concat(_convertHexToBase64(imagesHexSources[i].hex)) : imagesHexSources[i]; // 安全检查：验证base64数据的有效性
+          if (isValidBase64(newSrc)) {
+            _context.next = 14;
+            break;
+          }
+          console.warn('Invalid base64 image data detected, skipping...');
+          return _context.abrupt("continue", 23);
+        case 14:
           formData = new FormData();
           blob = convertBase64UrlToBlob(newSrc);
           imgName = ((_url$split = url.split('\\')) === null || _url$split === void 0 || (_url$split = _url$split.slice(-1)) === null || _url$split === void 0 ? void 0 : _url$split[0]) || 'image.jpg';
           file = new File([blob], imgName);
           formData.append('file', file);
-          _context.next = 18;
+          _context.next = 21;
           return window.fetch(uploadUrl, {
             method: 'POST',
+            headers: {
+              access_token: getToken(),
+              Authorization: 'Bearer ' + getToken()
+            },
             body: formData
           }).then(function (response) {
             return response.json();
           });
-        case 18:
+        case 21:
           res = _context.sent;
-          htmlData = htmlData.replace(img, "<img src=\"".concat(downloadUrl).concat(res.data[0].id, "\" style=\"width:").concat(width, "px;height:").concat(height, "px\""));
-        case 20:
+          htmlData = htmlData.replace(img, "<img src=\"".concat(downloadUrl).concat(res.data[0].id, "\" style=\"width:").concat(width, "px;height:").concat(height, "px\" alt=\"").concat(res.data[0].fileName || imgName, "\" />"));
+        case 23:
           i++;
           _context.next = 5;
           break;
-        case 23:
+        case 26:
           return _context.abrupt("return", htmlData);
-        case 24:
+        case 27:
         case "end":
           return _context.stop();
       }
@@ -214,6 +245,24 @@ function _replaceImagesFileSourceWithInlineRepresentation() {
   }));
   return _replaceImagesFileSourceWithInlineRepresentation.apply(this, arguments);
 }
+function isValidBase64(str) {
+  try {
+    // 检查是否包含有效的base64前缀
+    if (!str.startsWith('data:image/')) {
+      return false;
+    }
+
+    // 检查base64编码的有效性
+    var base64Part = str.split(',')[1];
+    if (!base64Part) return false;
+
+    // 尝试解码验证
+    atob(base64Part);
+    return true;
+  } catch (e) {
+    return false;
+  }
+}
 function _convertHexToBase64(hexString) {
   return btoa(hexString.match(/\w{2}/g).map(function (char) {
     return String.fromCharCode(parseInt(char, 16));