chanjs 2.8.11 → 2.8.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/middleware/template.js +2 -7
- package/package.json +1 -1
package/middleware/template.js
CHANGED
|
@@ -4,7 +4,6 @@ import { createRequire } from "module";
|
|
|
4
4
|
import relativeTime from "dayjs/plugin/relativeTime.js";
|
|
5
5
|
import "dayjs/locale/zh-cn.js";
|
|
6
6
|
import { marked } from "marked";
|
|
7
|
-
import { filterXSS } from "../security/xss-filter.js";
|
|
8
7
|
import logger from "../utils/logger.js";
|
|
9
8
|
|
|
10
9
|
const require = createRequire(import.meta.url);
|
|
@@ -96,12 +95,8 @@ artTemplate.defaults.imports.renderContent = (content, editorType = "rich", allo
|
|
|
96
95
|
}
|
|
97
96
|
}
|
|
98
97
|
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
catch (e) {
|
|
102
|
-
logger.error(`[renderContent] XSS过滤失败: ${e.message}`);
|
|
103
|
-
}
|
|
104
|
-
}
|
|
98
|
+
// 正文 XSS 已在后台保存时统一 sanitize（sanitizeRichText），
|
|
99
|
+
// 此处不再二次转义，避免破坏第三方嵌入（B站 iframe）与自定义 class 样式。
|
|
105
100
|
return html;
|
|
106
101
|
};
|
|
107
102
|
|