feat: 渲染 HTML 内容时进行过滤以防止 XSS 攻击 (#844)

EcoPasteHub · Nov 26, 2024 · d2c4f51 · d2c4f51
1 parent 7f9fafa
commit d2c4f51
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/package.json b/package.json
@@ -42,6 +42,7 @@
 		"antd": "^5.22.2",
 		"clsx": "^2.1.1",
 		"dayjs": "^1.11.13",
+		"dompurify": "^3.2.1",
 		"filesize": "^10.1.6",
 		"i18next": "^23.16.8",
 		"is-url": "^1.2.4",

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/pages/Clipboard/Panel/components/List/components/Item/components/HTML/index.tsx b/src/pages/Clipboard/Panel/components/List/components/Item/components/HTML/index.tsx
@@ -1,4 +1,5 @@
 import type { HistoryTablePayload } from "@/types/database";
+import DOMPurify from "dompurify";
 import type { FC } from "react";
 
 const HTML: FC<Partial<HistoryTablePayload>> = (props) => {
@@ -35,8 +36,8 @@ const HTML: FC<Partial<HistoryTablePayload>> = (props) => {
 	return (
 		<div
 			ref={containerRef}
-			dangerouslySetInnerHTML={{ __html: value }}
 			className="translate-z-0"
+			dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(value) }}
 		/>
 	);
 };