ztxkui 4.2.23-608 → 4.2.23-609

package/dist/UI/Detail/index.js

@@ -3,6 +3,7 @@ import React, { useMemo, useRef } from 'react';
 import { DetailHeader, OperationBtnGroup, Container, Button, InputNumber, Input, Tabs, Dropdown, DatePicker, Collapse, Modal, Tooltip, } from '../../index.build';
 import dayjs from 'dayjs';
 import EditTable from '../Table/EditTable';
+import { obj } from './test';
 var Detail = function () {
     var rangeDatesRef = useRef(null);
     var items = useMemo(function () {
@@ -214,7 +215,20 @@ var Detail = function () {
         React.createElement(InputNumber, { precision: 6, min: 0 }),
         React.createElement(InputNumber, { precision: 0, min: 0, formatterType: "currency" }),
         React.createElement(Input, { placeholder: i18next.t('若遇"共同责任"、"授权委托"审批情形，则"合同金额"字段填写(拟)授信金额。') }),
-        React.createElement(Input.Quill, { placeholder: i18next.t('若遇"共同责任"、"授权委托"审批情形，则"合同金额"字段填写(拟)授信金额。') }),
+        React.createElement(Input.Quill, { placeholder: i18next.t('若遇"共同责任"、"授权委托"审批情形，则"合同金额"字段填写(拟)授信金额。'), onChange: function (value) {
+                console.log(value);
+            } }),
+        React.createElement(Input.Quill, { placeholder: i18next.t('若遇"共同责任"、"授权委托"审批情形，则"合同金额"字段填写(拟)授信金额。'), onChange: function (value) {
+                console.log(value);
+            } }),
+        "111",
+        React.createElement(Input.QuillRead, { escapeHtml: true, 
+            // value={
+            //   '111<img+src="x"+onerror="eval(unescape(\'%61%6c%65%72%74%28%22%78%73%73%34%22%29%3b\'))">' ??
+            //   ''
+            // }
+            value: obj.mark }),
+        "222",
         React.createElement(Tabs, { isHeader: true }, Array.from({ length: 6 }, function (_, i) { return (React.createElement(Tabs.TabPane, { key: i, tab: React.createElement(Dropdown, { trigger: ['contextMenu'], overlay: React.createElement("div", null,
                     React.createElement("a", null, i18next.t('编辑')),
                     React.createElement("a", null, i18next.t('删除'))) },

package/dist/UI/Detail/test.d.ts

@@ -0,0 +1,106 @@
+export namespace obj {
+    const id: string;
+    const tenantId: string;
+    const serviceId: string;
+    const serverIp: string;
+    const serverHost: string;
+    const env: string;
+    const remoteIp: string;
+    const userAgent: string;
+    const requestUri: string;
+    const method: string;
+    const methodClass: string;
+    const methodName: string;
+    const params: string;
+    const createBy: string;
+    const createTime: string;
+    const requestType: number;
+    const mobileModel: any;
+    const appVersion: any;
+    const offlineVersion: any;
+    const system: number;
+    const paramsCleanRegex: any;
+    const logLevel: string;
+    const logId: string;
+    const logData: string;
+    const mark: string;
+    const logModule: string;
+    const operationName: any;
+    const operationTime: any;
+    const logExtra: any;
+    const createByName: string;
+    const createDeptByName: string;
+    const mobile: boolean;
+    const systemName: string;
+    const requestTypeName: string;
+}
+export namespace obj1 {
+    const id_1: string;
+    export { id_1 as id };
+    const tenantId_1: string;
+    export { tenantId_1 as tenantId };
+    const serviceId_1: string;
+    export { serviceId_1 as serviceId };
+    const serverIp_1: string;
+    export { serverIp_1 as serverIp };
+    const serverHost_1: string;
+    export { serverHost_1 as serverHost };
+    const env_1: string;
+    export { env_1 as env };
+    const remoteIp_1: string;
+    export { remoteIp_1 as remoteIp };
+    const userAgent_1: string;
+    export { userAgent_1 as userAgent };
+    const requestUri_1: string;
+    export { requestUri_1 as requestUri };
+    const method_1: string;
+    export { method_1 as method };
+    const methodClass_1: string;
+    export { methodClass_1 as methodClass };
+    const methodName_1: string;
+    export { methodName_1 as methodName };
+    const params_1: string;
+    export { params_1 as params };
+    const createBy_1: string;
+    export { createBy_1 as createBy };
+    const createTime_1: string;
+    export { createTime_1 as createTime };
+    const requestType_1: number;
+    export { requestType_1 as requestType };
+    const mobileModel_1: any;
+    export { mobileModel_1 as mobileModel };
+    const appVersion_1: any;
+    export { appVersion_1 as appVersion };
+    const offlineVersion_1: any;
+    export { offlineVersion_1 as offlineVersion };
+    const system_1: number;
+    export { system_1 as system };
+    const paramsCleanRegex_1: any;
+    export { paramsCleanRegex_1 as paramsCleanRegex };
+    const logLevel_1: string;
+    export { logLevel_1 as logLevel };
+    const logId_1: string;
+    export { logId_1 as logId };
+    const logData_1: string;
+    export { logData_1 as logData };
+    const mark_1: string;
+    export { mark_1 as mark };
+    const logModule_1: string;
+    export { logModule_1 as logModule };
+    const operationName_1: any;
+    export { operationName_1 as operationName };
+    const operationTime_1: any;
+    export { operationTime_1 as operationTime };
+    const logExtra_1: any;
+    export { logExtra_1 as logExtra };
+    const createByName_1: string;
+    export { createByName_1 as createByName };
+    const createDeptByName_1: string;
+    export { createDeptByName_1 as createDeptByName };
+    const mobile_1: boolean;
+    export { mobile_1 as mobile };
+    const systemName_1: string;
+    export { systemName_1 as systemName };
+    const requestTypeName_1: string;
+    export { requestTypeName_1 as requestTypeName };
+}

package/dist/UI/Detail/test.js

@@ -0,0 +1,75 @@
+/* eslint-disable */
+export var obj = {
+    id: '2085200609873104606',
+    tenantId: '000000',
+    serviceId: 'zmdms-scm-order',
+    serverIp: 'fe80:0:0:0:12:34ff:fe06:6e85%eth0:18101',
+    serverHost: 'zmdms-scm-order-test-zmdmsscm-5464cbd67-mdb2j',
+    env: 'test',
+    remoteIp: '172.28.7.23',
+    userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36',
+    requestUri: '/quotation/update',
+    method: 'POST',
+    methodClass: 'com.zmdms.core.log.logger.ZmdmsLogger',
+    methodName: 'info',
+    params: '{"id":"2094543572492935213","createUser":"8177127521209909288","createDept":"381761329295575035","createTime":"2026-08-21 15:57:09","updateUser":"8177127521209909288","updateTime":"2026-08-21 15:58:49","status":10,"isDeleted":0,"xid":null,"quotationNo":"BJ26000021","companyId":"1415837991701037057","companyName":"浙商中拓集团股份有限公司","depId":"381761329295575035","depName":"中拓本部","officeId":"1514579225679962114","officeName":"总部职能","firstDepId":null,"firstDepName":"","secondDepId":null,"secondDepName":"","profitCenterId":null,"profitCenterName":null,"customerMemberId":"8780290016480822868","customerMemberName":"CESHI","customerEmail":null,"salesmanId":"8177127521209909288","salesman":"申胜","currency":"CNY","totalQuantity":1,"totalAmount":1,"hasSent":null,"hasSealTakenOut":null,"verificationCode":null,"sealAddress":null,"predictProfit":null,"pricingType":"","disputeResolution":null,"areaScope":null,"mark":"\\"><img src=\\"x\\" onerror=\\"eval(unescape(\'%61%6c%65%72%74%28%22%78%73%73%34%22%29%3b\'))\\">","approveUser":null,"approveTime":null,"approveOpinion":null,"wfType":null,"wfProcessInstId":null,"wfParams":null,"approveFailInfo":null,"constituteOffer":0,"offerCustomer":null,"approveType":null,"exchangeRateRmb":"1.00","totalAmountRmb":1,"predictProfitRmb":null,"createUserName":"申胜","hasSentName":null,"statusName":"草稿","hasSealTakenOutName":null,"sealAddressName":null,"currencyName":null,"disputeResolutionName":null,"quotationWorkFlowVO":null,"electronicSealInfo":null,"approveTypeName":null,"officeCode":"Z098","secondDepCode":"","firstDepCode":"","constituteOfferName":"否","offerCustomerName":null,"attachmentDTOS":[],"postDate":"2026-08-21","postingDate":"2026-08-21","quotationDetailDTOList":[{"id":"2094543572492935214","createUser":"8177127521209909288","createDept":"381761329295575035","createTime":"2026-08-21 15:57:09","updateUser":"8177127521209909288","updateTime":"2026-08-21 15:58:49","status":1,"isDeleted":0,"xid":null,"quotationId":"2094543572492935213","quotationNo":"BJ26000021","quotationSubNo":"BJ26000021001","materialDescription":"1","quantityUnit":"Z34","quantityUnitName":"箱","quantity":"1.000000","unitPrice":"1.00","deliveryDate":null,"validityPeriodDate":null,"paymentMethod":null,"repaymentConditions":null,"mark":null,"unitPriceRmb":"1.00","paymentMethodName":null,"amount":"1.00","amountRmb":"1.00","_isUpdateData":true}]}',
+    createBy: '申胜',
+    createTime: '2026-08-21 16:00:55',
+    requestType: 1,
+    mobileModel: null,
+    appVersion: null,
+    offlineVersion: null,
+    system: 5,
+    paramsCleanRegex: null,
+    logLevel: 'info',
+    logId: '2094543572492935213',
+    logData: '修改',
+    // "mark": "\"><img src=\"x\" onerror=\"eval(unescape('%61%6c%65%72%74%28%22%78%73%73%34%22%29%3b'))\">",
+    // mark: '<p>"><img src="x" onerror="eval(unescape('%61%6c%65%72%74%28%22%78%73%73%34%22%29%3b'))"></p>',
+    mark: '<p>"><a href="javascript:alert(1)">你好</a></p>',
+    logModule: '报价单',
+    operationName: null,
+    operationTime: null,
+    logExtra: null,
+    createByName: '申胜',
+    createDeptByName: '中拓本部',
+    mobile: false,
+    systemName: '中拓供应链',
+    requestTypeName: 'web',
+};
+export var obj1 = {
+    id: '2085200609873104558',
+    tenantId: '000000',
+    serviceId: 'zmdms-scm-order',
+    serverIp: 'fe80:0:0:0:12:34ff:fe06:6e85%eth0:18101',
+    serverHost: 'zmdms-scm-order-test-zmdmsscm-5464cbd67-mdb2j',
+    env: 'test',
+    remoteIp: '172.28.7.23',
+    userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36',
+    requestUri: '/quotation/save',
+    method: 'POST',
+    methodClass: 'com.zmdms.core.log.logger.ZmdmsLogger',
+    methodName: 'info',
+    params: '{"companyId":"1415837991701037057","companyName":"浙商中拓集团股份有限公司","officeCode":"Z098","depId":"381761329295575035","depName":"中拓本部","salesmanId":"8177127521209909288","salesman":"申胜","constituteOffer":0,"currency":"CNY","exchangeRateRmb":1,"totalQuantity":1,"totalAmount":1,"totalAmountRmb":1,"pricingType":"","customerMemberId":"8780290016480822868","customerEmail":null,"predictProfit":null,"disputeResolution":null,"areaScope":null,"mark":"“><img+src=\\"x\\"+onerror=\\"eval(unescape(\'%61%6c%65%72%74%28%22%78%73%73%34%22%29%3b\'))\\">","customerMemberName":"CESHI","postDate":"2026-08-21","postingDate":"2026-08-21","quotationDetailDTOList":[{"_isUpdateData":false,"quantityUnit":"Z34","quantityUnitName":"箱","materialDescription":"1","quantity":1,"unitPrice":1,"unitPriceRmb":1,"amount":1,"amountRmb":1}],"status":10}',
+    createBy: '申胜',
+    createTime: '2026-08-21 15:57:09',
+    requestType: 1,
+    mobileModel: null,
+    appVersion: null,
+    offlineVersion: null,
+    system: 5,
+    paramsCleanRegex: null,
+    logLevel: 'info',
+    logId: '2094543572492935213',
+    logData: '新增',
+    mark: '“><img+src="x"+onerror="eval(unescape(\'%61%6c%65%72%74%28%22%78%73%73%34%22%29%3b\'))">',
+    logModule: '报价单',
+    operationName: null,
+    operationTime: null,
+    logExtra: null,
+    createByName: '申胜',
+    createDeptByName: '中拓本部',
+    mobile: false,
+    systemName: '中拓供应链',
+    requestTypeName: 'web',
+};

package/dist/components/Input/InputQuill.js

@@ -22,6 +22,7 @@ var __rest = (this && this.__rest) || function (s, e) {
 };
 import React, { useMemo } from 'react';
 import ReactQuill from 'react-quill';
+import DOMPurify from 'dompurify';
 import 'react-quill/dist/quill.snow.css';
 /**
  * @description HTML转义，将HTML标签转为实体字符
@@ -76,10 +77,13 @@ var CustomToolbar = function (_a) {
 var InputQuill = function (_a) {
     var value = _a.value, onBlur = _a.onBlur, buttons = _a.buttons, _b = _a.escapeHtml, escapeHtml = _b === void 0 ? false : _b, onChange = _a.onChange, props = __rest(_a, ["value", "onBlur", "buttons", "escapeHtml", "onChange"]);
     var toolbarId = useMemo(function () { return "toolbar-" + Math.random().toString(36).substring(2, 11); }, []);
-    // 如果启用了转义，显示时需要反转义
+    // 如果启用了转义，显示时需要反转义；
+    // 进入编辑器前统一净化，防止存库值被污染时（历史脏数据/后端拼接）注入恶意标签，
+    // 不再单独依赖 Quill 内部的格式白名单做安全边界
     var displayValue = useMemo(function () {
         var val = getValue(value);
-        return escapeHtml && val ? unescapeHtmlContent(val) : val;
+        var html = escapeHtml && val ? unescapeHtmlContent(val) : val;
+        return html ? DOMPurify.sanitize(html) : html;
     }, [value, escapeHtml]);
     // 处理onChange，如果启用了转义，输出时进行转义
     var handleChange = function (content) {

package/dist/components/Input/InputQuillRead.js

@@ -1,12 +1,15 @@
 import React, { useRef, useEffect, useState, useMemo } from 'react';
+import DOMPurify from 'dompurify';
 import { unescapeHtmlContent } from './InputQuill';
 var InputQuillRead = function (_a) {
     var value = _a.value, _b = _a.escapeHtml, escapeHtml = _b === void 0 ? false : _b;
     var contentRef = useRef(null);
     var _c = useState(undefined), height = _c[0], setHeight = _c[1];
-    // 如果启用了转义，显示时需要反转义
+    // 如果启用了转义，显示时需要反转义；
+    // 反转义/原始HTML在注入 innerHTML 前必须经过净化，防止 onerror 等事件属性与 script 造成 XSS
     var displayValue = useMemo(function () {
-        return escapeHtml && value ? unescapeHtmlContent(value) : value;
+        var val = escapeHtml && value ? unescapeHtmlContent(value) : value;
+        return val ? DOMPurify.sanitize(val) : val;
     }, [value, escapeHtml]);
     useEffect(function () {
         if (contentRef.current && displayValue) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ztxkui",
-  "version": "4.2.23-608",
+  "version": "4.2.23-609",
   "private": false,
   "description": "React components library",
   "author": "zt-front-end",
@@ -16,6 +16,7 @@
     "axios": "^0.21.1",
     "classnames": "^2.2.6",
     "dayjs": "^1.10.4",
+    "dompurify": "^3.4.14",
     "file-saver": "^2.0.5",
     "html-docx-js": "^0.3.1",
     "immutability-helper": "^3.1.1",