@whitesev/pops 2.0.0 → 2.0.2

package/dist/types/src/utils/PopsSafeUtils.d.ts

@@ -1,4 +1,8 @@
 export declare const PopsSafeUtils: {
+    /**
+     * 获取安全的html
+     */
+    getSafeHTML(text: string): any;
     /**
      * 设置安全的html
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whitesev/pops",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "弹窗库",
   "main": "dist/index.cjs.js",
   "module": "dist/index.esm.js",

package/src/components/panel/PanelHandleContentDetails.ts

@@ -188,7 +188,12 @@ export const PanelHandleContentDetails = () => {
 				return;
 			}
 			Object.keys(props).forEach((propName) => {
-				Reflect.set(element, propName, props[propName]);
+				let value = props[propName];
+				if (propName === "innerHTML") {
+					PopsSafeUtils.setSafeHTML(element, value);
+					return;
+				}
+				Reflect.set(element, propName, value);
 			});
 		},
 		/**

package/src/components/rightClickMenu/index.ts

@@ -4,6 +4,7 @@ import { PopsHandler } from "../../handler/PopsHandler";
 import { pops } from "../../Pops";
 import type { PopsIcon } from "../../types/icon";
 import { popsDOMUtils } from "../../utils/PopsDOMUtils";
+import { PopsSafeUtils } from "../../utils/PopsSafeUtils";
 import { popsUtils } from "../../utils/PopsUtils";
 import { rightClickMenuConfig as PopsRightClickMenuConfig } from "./config";
 import type {
@@ -453,7 +454,7 @@ export class PopsRightClickMenu {
 					/* 插入文字 */
 					menuLiElement.insertAdjacentHTML(
 						"beforeend",
-						`<span>${item.text}</span>`
+						PopsSafeUtils.getSafeHTML(`<span>${item.text}</span>`)
 					);
 					/* 如果存在子数据，显示 */
 					if (item.item && Array.isArray(item.item)) {

package/src/utils/PopsDOMUtils.ts

@@ -1944,7 +1944,10 @@ class PopsDOMUtils extends PopsDOMUtilsEvent {
 		}
 		function elementAppendChild(ele: HTMLElement, text: HTMLElement | string) {
 			if (typeof content === "string") {
-				ele.insertAdjacentHTML("beforeend", text as string);
+				ele.insertAdjacentHTML(
+					"beforeend",
+					PopsSafeUtils.getSafeHTML(text as string)
+				);
 			} else {
 				ele.appendChild(text as HTMLElement);
 			}
@@ -2078,7 +2081,10 @@ class PopsDOMUtils extends PopsDOMUtilsEvent {
 			return;
 		}
 		if (typeof content === "string") {
-			element.insertAdjacentHTML("beforebegin", content);
+			element.insertAdjacentHTML(
+				"beforebegin",
+				PopsSafeUtils.getSafeHTML(content)
+			);
 		} else {
 			element!.parentElement!.insertBefore(content, element);
 		}
@@ -2103,7 +2109,10 @@ class PopsDOMUtils extends PopsDOMUtilsEvent {
 			return;
 		}
 		if (typeof content === "string") {
-			element.insertAdjacentHTML("afterend", content);
+			element.insertAdjacentHTML(
+				"afterend",
+				PopsSafeUtils.getSafeHTML(content)
+			);
 		} else {
 			element!.parentElement!.insertBefore(content, element.nextSibling);
 		}

package/src/utils/PopsSafeUtils.ts

@@ -1,22 +1,24 @@
 export const PopsSafeUtils = {
+	/**
+	 * 获取安全的html
+	 */
+	getSafeHTML(text: string) {
+		// @ts-ignore
+		if (globalThis.trustedTypes) {
+			// @ts-ignore
+			const policy = globalThis.trustedTypes.createPolicy("safe-innerHTML", {
+				createHTML: (html: string) => html,
+			});
+			return policy.createHTML(text);
+		} else {
+			return text;
+		}
+	},
 	/**
 	 * 设置安全的html
 	 */
 	setSafeHTML($el: Element, text: string) {
 		// 创建 TrustedHTML 策略（需 CSP 允许）
-		try {
-			$el.innerHTML = text;
-		} catch (error) {
-			// @ts-ignore
-			if (globalThis.trustedTypes) {
-				// @ts-ignore
-				const policy = globalThis.trustedTypes.createPolicy("safe-innerHTML", {
-					createHTML: (html: string) => html,
-				});
-				$el.innerHTML = policy.createHTML(text);
-			} else {
-				throw new Error("trustedTypes is not defined");
-			}
-		}
+		$el.innerHTML = this.getSafeHTML(text);
 	},
 };