hexo-theme-stellar 1.39.0 → 1.39.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.39.1
+
+> 发布日期：2026-08-13
+
+### 新功能
+- 置顶文章新增平铺样式配置 `article.pin_style: flat`：首页第一页不再渲染置顶轮播，置顶文章按与轮播一致的排序权重在文章列表靠前平铺展示
+
+### 修复
+- 用户内容统一 HTML 转义并移除圆点 aria-label，修复标题含引号导致构建失败
+
+### 升级注意（配置变更与破坏性改动）
+- 新增 `article.pin_style`（`carousel` / `flat`，默认 `carousel`）：默认行为不变；设置 `flat` 后首页置顶文章改为平铺样式展示
+
+Full Changelog: [1.39.0...1.39.1](https://github.com/xaoxuu/hexo-theme-stellar/compare/1.39.0...1.39.1)
+
 ## 1.39.0
 
 > 发布日期：2026-08-13

package/_config.yml

@@ -1,6 +1,6 @@
 ######## Stellar info ########
 stellar:
-  version: '1.39.0'
+  version: '1.39.1'
   homepage: 'https://xaoxuu.com/wiki/stellar/'
   repo: 'https://github.com/xaoxuu/hexo-theme-stellar'
   main_css: /css/main.css
@@ -180,6 +180,8 @@ notebook:
 
 ######## Article ########
 article:
+  # 置顶文章样式：carousel = 轮播（默认）， flat = 平铺（不渲染轮播，置顶文章在首页文章列表靠前展示，排序规则与轮播一致）
+  pin_style: carousel
   # 文章类型，决定布局风格，可以在 front-matter/topic/wiki 中覆盖此参数
   type: tech # tech: 默认技术类文章, story: 图文类文章，文字和段落间增距大
   # 缩进两个文字宽度，适合文字类博客，可以在 front-matter/topic/wiki 中覆盖此参数

package/layout/_partial/cover/post_cover.ejs

@@ -28,7 +28,7 @@ function div() {
   }
   el += '<div class="l_cover post' + scrollreveal(' ') + '">';
   el += '<div class="cover">';
-  el += '<div class="lazy img bg" data-bg="' + url + '"></div>';
+  el += '<div class="lazy img bg" data-bg="' + escape_html(url) + '"></div>';
   el += '</div>';
   el += '</div>';
   return el;

package/layout/_partial/main/article/article_footer.ejs

@@ -98,6 +98,9 @@ function layoutDiv() {
     showSharePlugin = true
   }
   if (theme.article.share && showSharePlugin) {
+    function urlenc(v) {
+      return encodeURIComponent(v == null ? '' : String(v))
+    }
     function socialButtons() {
       var el = ''
       theme.article.share.forEach((item, i) => {
@@ -109,20 +112,20 @@ function layoutDiv() {
           if (item == 'wechat') {
             el += ' onclick="util.toggle("qrcode-wechat")"';
           } else if (item == 'weibo') {
-            el += ' href="https://service.weibo.com/share/share.php?url=' + page.permalink;
-            el += '&title=' + page.title + ' - ' + config.title;
+            el += ' href="https://service.weibo.com/share/share.php?url=' + urlenc(page.permalink);
+            el += '&title=' + urlenc(page.title + ' - ' + config.title);
             if (page.layout == 'post' && page.cover) {
-              el += '&pics=' + page.cover;
+              el += '&pics=' + urlenc(page.cover);
             } else if (page.wiki && page.icon) {
-              el += '&pics=' + page.icon;
+              el += '&pics=' + urlenc(page.icon);
             }
-            el += '&summary=' + truncate(page.description || strip_html(page.excerpt || page.content), {length: 120});
+            el += '&summary=' + urlenc(truncate(page.description || strip_html(page.excerpt || page.content), {length: 120}));
             el += '"';
           } else if (item == 'email') {
-            el += ' href="mailto:?subject=' + page.title + ' - ' + config.title + '&'
-            el += 'body=' + page.permalink + '"';
+            el += ' href="mailto:?subject=' + urlenc(page.title + ' - ' + config.title) + '&'
+            el += 'body=' + urlenc(page.permalink) + '"';
           } else if (item == 'link') {
-            el += ' onclick="util.copy("copy-link", "' + __('message.copied') + '")"';
+            el += ' onclick="util.copy("copy-link", "' + escape_html(__('message.copied')) + '")"';
           }
           el += '>';
           el += icon(`share:${item}`)
@@ -135,7 +138,7 @@ function layoutDiv() {
       if (theme.article.share.includes('wechat')) {
         return `
         <div class="qrcode" id="qrcode-wechat" style="opacity:0;height:0">
-          <img src="https://api.qrserver.com/v1/create-qr-code/?size=256x256&data=${page.permalink}"/>
+          <img src="https://api.qrserver.com/v1/create-qr-code/?size=256x256&data=${urlenc(page.permalink)}"/>
         </div>
         `
       } else {
@@ -146,7 +149,7 @@ function layoutDiv() {
     <section id="share">
       <div class="header"><span>${__('meta.share')}</span></div>
       <div class="body">
-        <div class="link"><input class="copy-area" readonly="true" id="copy-link" value="${page.permalink}" /></div>
+        <div class="link"><input class="copy-area" readonly="true" id="copy-link" value="${escape_html(page.permalink)}" /></div>
         <div class="social-wrap dis-select">${socialButtons()}</div>
         ${qrcode()}
       </div>

package/layout/_partial/main/navbar/nav_tabs_blog.ejs

@@ -1,7 +1,10 @@
 <%
 function layoutDiv() {
   var el = '';
-  el += partial('_partial/main/pin_slider', {type: 'post'});
+  // 置顶文章样式为平铺时不渲染轮播，置顶文章改由首页文章列表靠前展示
+  if (theme.article?.pin_style !== 'flat') {
+    el += partial('_partial/main/pin_slider', {type: 'post'});
+  }
   el += '<div class="navbar top">';
   el += '<div class="navbar-blur">';
   el += '<div class="navbar-container">';
@@ -14,7 +17,7 @@ function layoutDiv() {
 
   if (site.categories && site.categories.length > 0) {
     if (page.category) {
-      el += '<a class="active" href="' + pretty_url(config.category_dir) + '">' + __("btn.category") + __("symbol.colon") + page.category + '</a>';
+      el += '<a class="active" href="' + pretty_url(config.category_dir) + '">' + __("btn.category") + __("symbol.colon") + escape_html(page.category) + '</a>';
     } else if (page.layout == "categories") {
       el += '<a class="active" href="' + pretty_url(config.category_dir) + '">' + __("btn.categories") + '</a>';
     } else {
@@ -24,7 +27,7 @@ function layoutDiv() {
 
   if (site.tags && site.tags.length > 0) {
     if (page.tag) {
-      el += '<a class="active" href="' + pretty_url(config.tag_dir) + '">' + __("btn.tag") + __("symbol.colon") + page.tag + '</a>';
+      el += '<a class="active" href="' + pretty_url(config.tag_dir) + '">' + __("btn.tag") + __("symbol.colon") + escape_html(page.tag) + '</a>';
     } else if (page.layout == "tags") {
       el += '<a class="active" href="' + pretty_url(config.tag_dir) + '">' + __("btn.tags") + '</a>';
     } else {

package/layout/_partial/main/navbar/nav_tabs_wiki.ejs

@@ -23,7 +23,7 @@ function layoutDiv() {
       if (tag.name && tag.name.length > 0 && page.tagName === tag.name) {
         el += ' class="active"';
       }
-      el += ' href="' + pretty_url(tag.path) + '">' + tag.name + '</a>';
+      el += ' href="' + escape_html(pretty_url(tag.path)) + '">' + escape_html(tag.name) + '</a>';
       el += '</a>';
     }
   }

package/layout/_partial/main/pin_slider.ejs

@@ -69,18 +69,18 @@ function postSlide(post) {
   var headline = (post.poster != null && post.poster.headline != null && post.poster.headline.length > 0) ? post.poster.headline : post.title
   var subtitle = postSubtitle(post)
   var el = ''
-  el += '<a class="pin-slide post-slide' + (noCover ? ' no-cover' : '') + '" href="' + pretty_url(post.link || post.path) + '"'
+  el += '<a class="pin-slide post-slide' + (noCover ? ' no-cover' : '') + '" href="' + escape_html(pretty_url(post.link || post.path)) + '"'
   if (!noCover) {
-    el += ' style="--pin-cover-url:url(\'' + post.cover.replace(/'/g, '%27') + '\')"'
+    el += ' style="--pin-cover-url:url(\'' + escape_html(post.cover.replace(/'/g, '%27')) + '\')"'
   }
   el += '>'
   if (!noCover) {
-    el += '<img class="pin-slide-bg" src="' + post.cover + '" alt=""/>'
+    el += '<img class="pin-slide-bg" src="' + escape_html(post.cover) + '" alt=""/>'
   }
   el += '<div class="pin-slide-text">'
-  el += '<div class="pin-slide-headline">' + headline + '</div>'
+  el += '<div class="pin-slide-headline">' + escape_html(headline) + '</div>'
   if (subtitle.length > 0) {
-    el += '<div class="pin-slide-caption">' + subtitle + '</div>'
+    el += '<div class="pin-slide-caption">' + escape_html(subtitle) + '</div>'
   }
   el += '</div>'
   el += '</a>'
@@ -90,7 +90,7 @@ function postSlide(post) {
 function projectChips(tags) {
   var caps = ''
   if (tags && tags.length > 0) {
-    caps += '<span class="pin-slide-chip">' + tags.join('</span><span class="pin-slide-chip">') + '</span>'
+    caps += '<span class="pin-slide-chip">' + tags.map(function(t) { return escape_html(t) }).join('</span><span class="pin-slide-chip">') + '</span>'
   }
   return caps
 }
@@ -100,14 +100,14 @@ function wikiSlide(proj) {
   var title = proj.title || proj.name || proj.id
   var excerpt = proj.description || ''
   var el = ''
-  el += '<a class="pin-slide" href="' + pretty_url(proj.homepage?.path || '/') + '">'
-  el += '<img class="pin-slide-bg" src="' + img + '" alt=""/>'
+  el += '<a class="pin-slide" href="' + escape_html(pretty_url(proj.homepage?.path || '/')) + '">'
+  el += '<img class="pin-slide-bg" src="' + escape_html(img) + '" alt=""/>'
   el += '<div class="pin-slide-mask"></div>'
   el += '<div class="pin-slide-info">'
   el += '<div class="pin-slide-caps">' + projectChips(proj.tags) + '</div>'
-  el += '<div class="pin-slide-title">' + title + '</div>'
+  el += '<div class="pin-slide-title">' + escape_html(title) + '</div>'
   if (excerpt.length > 0) {
-    el += '<div class="pin-slide-excerpt">' + excerpt + '</div>'
+    el += '<div class="pin-slide-excerpt">' + escape_html(excerpt) + '</div>'
   }
   el += '</div>'
   el += '</a>'
@@ -125,8 +125,7 @@ if (pinItems.length > 0) {
       slidesHtml += postSlide(item)
     }
     if (pinItems.length > 1) {
-      var label = item.title || item.name || item.id || (si + 1)
-      dotsHtml += '<button type="button" class="pin-slider-dot' + (si == 0 ? ' active' : '') + '" data-index="' + si + '" aria-label="' + label + '"></button>'
+      dotsHtml += '<button type="button" class="pin-slider-dot' + (si == 0 ? ' active' : '') + '" data-index="' + si + '"></button>'
     }
   }
   var groupKey = pinType == 'wiki' ? 'wiki' : 'post'

package/layout/_partial/main/post_list/post_card.ejs

@@ -39,14 +39,14 @@ function div_default() {
     }
     if (cover_url) {
       el += '<div class="post-cover">';
-      el += '<img src="' + cover_url + '"/>';
+      el += '<img src="' + escape_html(cover_url) + '"/>';
       el += '</div>';
     }
   }
 
   // 标题
   el += '<h2 class="post-title">';
-  el += post.title ? post.title : date(post.date, config.date_format);
+  el += post.title ? escape_html(post.title) : date(post.date, config.date_format);
   el += '</h2>';
 
   // 摘要
@@ -57,11 +57,11 @@ function div_default() {
   el += '">';
   el += '<p>';
   if (post.excerpt) {
-    el += strip_html(post.excerpt);
+    el += escape_html(strip_html(post.excerpt));
   } else if (post.description) {
-    el += post.description;
+    el += escape_html(post.description);
   } else if (post.content && theme.article.auto_excerpt > 0) {
-    el += truncate(strip_html(post.content), {length: theme.article.auto_excerpt});
+    el += escape_html(truncate(strip_html(post.content), {length: theme.article.auto_excerpt}));
   }
   el += '</p>';
   el += '</div>';
@@ -87,12 +87,12 @@ function div_default() {
         let lastCat = cats.pop();
         el += '<span class="cap breadcrumb"' + category_color(lastCat) + '>';
         el += icon('default:category')
-        el += `<span>${str}</span>`
+        el += `<span>${escape_html(str)}</span>`
         el += '</span>';
       }
     }
   }
-  // 置顶文章已由列表页 navbar 上方的置顶轮播展示，卡片内不再显示 pin 图标。
+  // 置顶文章由轮播（默认）或首页列表靠前展示（flat 平铺）承担，卡片内不显示 pin 图标。
   el += '</div>';
   el += '</article>';
   return el;
@@ -107,22 +107,22 @@ function div_photo() {
       position = 'bottom';
     }
   }
-  el += '<div class="cover" position="' + position + '" style="--cover-url:url(\'' + obj.image.replace(/'/g, '%27') + '\')">';
-  el += '<img src="' + obj.image + '"/>';
+  el += '<div class="cover" position="' + position + '" style="--cover-url:url(\'' + escape_html(obj.image.replace(/'/g, '%27')) + '\')">';
+  el += '<img src="' + escape_html(obj.image) + '"/>';
   if (position.length > 0) {
     el += '<div class="cover-info" position="' + position + '"';
     if (obj.color) {
-      el += 'style="color:' + obj.color + '"';
+      el += 'style="color:' + escape_html(obj.color) + '"';
     }
     el += '>';
     if (obj.topic) {
-      el += '<div class="text topic">' + obj.topic + '</div>';
+      el += '<div class="text topic">' + escape_html(obj.topic) + '</div>';
     }
     if (obj.headline) {
-      el += '<div class="text headline">' + obj.headline + '</div>';
+      el += '<div class="text headline">' + escape_html(obj.headline) + '</div>';
     }
     if (obj.caption) {
-      el += '<div class="text caption">' + obj.caption + '</div>';
+      el += '<div class="text caption">' + escape_html(obj.caption) + '</div>';
     }
     el += '</div>';
 

package/layout/_partial/sidebar/index_leftbar.ejs

@@ -131,10 +131,10 @@ function layoutFooterDiv() {
     if (item.icon && (item.url || item.onclick)) {
       el += '<a class="social"';
       if (item.title) {
-        el += ' title="' + item.title + '"';
+        el += ' title="' + escape_html(item.title) + '"';
       }
       if (item.url) {
-        el += ' href="' + url_for(item.url) + '"';
+        el += ' href="' + escape_html(url_for(item.url)) + '"';
         if (item.url.includes('://')) {
           el += ' target="_blank" rel="external nofollow noopener noreferrer"';
         } else {

package/layout/index.ejs

@@ -29,8 +29,49 @@ if (homeCmt && homeCmt !== false && is_home_first_page()) {
   }
 }
 
-// 首页第一页渲染置顶轮播时，列表不再重复展示置顶文章
-var pinSliderActive = is_home_first_page()
+// 置顶文章样式：carousel = 轮播（默认），flat = 平铺（首页列表靠前展示）
+var pinStyle = theme.article?.pin_style || 'carousel'
+var pinFlat = pinStyle === 'flat'
+
+// 与 pin_slider.ejs 保持一致的置顶判定与排序权重
+function pinValue(post) {
+  return post.pin != null ? post.pin : post.sticky
+}
+function isPinned(post) {
+  var v = pinValue(post)
+  return v !== false && v != null
+}
+function pinWeight(post) {
+  var v = pinValue(post)
+  if (v === true) {
+    return 1
+  }
+  var n = Number(v)
+  return isNaN(n) ? 0 : n
+}
+
+// 首页第一页渲染置顶轮播时，列表不再重复展示置顶文章（carousel 模式）
+var pinSliderActive = is_home_first_page() && !pinFlat
+
+// flat 模式：首页第一页收集全部置顶文章，按轮播顺序置顶展示
+var flatPins = []
+if (pinFlat && is_home_first_page()) {
+  var allPosts = site.posts.toArray() || []
+  for (var fi = 0; fi < allPosts.length; fi++) {
+    var fpost = allPosts[fi]
+    if (fpost.indexing === false) {
+      continue
+    }
+    if (isPinned(fpost)) {
+      flatPins.push({post: fpost, index: fi})
+    }
+  }
+  flatPins.sort(function(a, b) {
+    var d = pinWeight(b.post) - pinWeight(a.post)
+    // 权重相同保持原顺序（与轮播一致）
+    return d !== 0 ? d : a.index - b.index
+  })
+}
 
 function layout_post_card(layout, post, content) {
   var el = '';
@@ -49,17 +90,32 @@ function layout_post_card(layout, post, content) {
 function layout_post_list(partial) {
   var el = '';
   el += `<div class="post-list post">`;
-  page.posts.each(function(post){
-    if (post.indexing != false) {
-      if (pinSliderActive) {
-        var pinVal = post.pin != null ? post.pin : post.sticky
-        if (pinVal !== false && pinVal != null) {
-          return
+  if (flatPins.length > 0) {
+    var pinnedPaths = {}
+    flatPins.forEach(function(item) {
+      pinnedPaths[item.post.path] = true
+    })
+    flatPins.forEach(function(item) {
+      el += layout_post_card('post', item.post, partial(item.post));
+    })
+    page.posts.each(function(post){
+      if (post.indexing != false && !pinnedPaths[post.path]) {
+        el += layout_post_card('post', post, partial(post));
+      }
+    })
+  } else {
+    page.posts.each(function(post){
+      if (post.indexing != false) {
+        if (pinSliderActive) {
+          var pinVal = pinValue(post)
+          if (pinVal !== false && pinVal != null) {
+            return
+          }
         }
+        el += layout_post_card('post', post, partial(post));
       }
-      el += layout_post_card('post', post, partial(post));
-    }
-  })
+    })
+  }
   el += '</div>';
   return el;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hexo-theme-stellar",
-  "version": "1.39.0",
+  "version": "1.39.1",
   "description": "Elegant and powerful theme for Hexo.",
   "main": "package.json",
   "scripts": {

package/scripts/helpers/escape_html.js

@@ -0,0 +1,9 @@
+/* global hexo */
+'use strict';
+
+const { escapeHTML } = require('hexo-util');
+
+// 供 EJS 模板使用的 HTML 转义辅助函数：属性值与文本内容均可安全使用。
+hexo.extend.helper.register('escape_html', function(value) {
+  return escapeHTML(value == null ? '' : String(value));
+});

package/scripts/helpers/related_posts.js

@@ -6,6 +6,10 @@
 
 var util = require('hexo-util');
 
+function esc(v) {
+  return util.escapeHTML(v == null ? '' : String(v))
+}
+
 hexo.extend.helper.register('popular_posts_wrapper', function(args){
   const title = args.title;
   const json = args.json.json;
@@ -18,7 +22,7 @@ hexo.extend.helper.register('popular_posts_wrapper', function(args){
   var returnHTML = "";
   var div = `
     <section class='header'>
-      <div class='title cap theme'>${title}</div>
+      <div class='title cap theme'>${esc(title)}</div>
     </section>
     <section class='body'>
     `;
@@ -28,14 +32,14 @@ hexo.extend.helper.register('popular_posts_wrapper', function(args){
 
   function listItem(obj){
     var el = '';
-    el += '<a class="item" href="' + obj.path + '" title="' + obj.title + '">';
+    el += '<a class="item" href="' + esc(obj.path) + '" title="' + esc(obj.title) + '">';
     var p = posts.filter(p => root + p.path == obj.path)
     if (p && p.length > 0) {
       p = p.data[0];
     }
-    el += '<span class="title">' + obj.title + '</span>';
+    el += '<span class="title">' + esc(obj.title) + '</span>';
     if (obj.excerpt && obj.excerpt.length > 0) {
-      el += '<span class="excerpt">' + util.truncate(util.stripHTML(obj.excerpt), {length: 120}) + '</span>';
+      el += '<span class="excerpt">' + esc(util.truncate(util.stripHTML(obj.excerpt), {length: 120})) + '</span>';
     }
     el +=  '</a>';
     return el;
@@ -47,7 +51,7 @@ hexo.extend.helper.register('popular_posts_wrapper', function(args){
       }
   }
   
-  if (returnHTML != "") returnHTML = "<div class=\"" + cls + "\">" + returnHTML + "</div>";
+  if (returnHTML != "") returnHTML = "<div class=\"" + esc(cls) + "\">" + returnHTML + "</div>";
   div += returnHTML;
   div += '</section>';
   return div;