Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bugfix: 避免xss #7166

Merged
merged 3 commits into from
Nov 13, 2023
Merged

bugfix: 避免xss #7166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5703c1f
bugfix: 避免xss
ywywZhou Nov 13, 2023
aa328ff
optimization: 实体名称切开展示
ywywZhou Nov 13, 2023
7f0dbbe
optimization: 脚本种没有全局变量时提示自动关闭
ywywZhou Nov 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions frontend/desktop/src/components/common/RenderForm/tags/TagCodeEditor.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,6 +223,7 @@
})
})
this.decorationsMap = {}
this.globalVarLength = 0
}
},
onLanguageChange () {
Expand Down
16 changes: 10 additions & 6 deletions frontend/desktop/src/components/common/RenderForm/tags/TagInput.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -417,13 +417,13 @@
return item.type === 'button' ? item.value : item.textContent
}).join('')
}
// 用户手动输入的空格编码渲染时需要切开展示
domValue = domValue.replace(/&(nbsp|ensp|emsp|thinsp|zwnj|zwj);/g, ($0, $1) => {
// 将html标签拆成文本形式
domValue = domValue.replace(/(<|>)/g, ($0, $1) => `<span>${$1}</span>`)
// 用户手动输入的实体字符渲染时需要切开展示
domValue = domValue.replace(/&(nbsp|ensp|emsp|thinsp|zwnj|zwj|quot|apos|lt|gt|amp|cent|pound|yen|euro|sect|copy|reg|trade|times|divide);/g, ($0, $1) => {
return `<span>&</span><span>${$1}</span><span>;</span>`
})

// 初始化时是通过innerText进行复制的，如果有多个连续空格则只会显示一个，所以需手动将转为&nbsp;
domValue = domValue.replace(/( )/g, '&nbsp;')
const innerHtml = domValue.replace(varRegexp, (match, $0) => {
let isExistVar = false
if ($0) {
Expand All @@ -437,7 +437,11 @@
}
if (isExistVar) {
const randomId = Math.random().toString().slice(-6)
return `<input type="button" class="var-tag" id="${randomId}" value=${match} />` // 两边留空格保持间距
// 将装转的尖括号恢复原样
let value = match.replace(/<span>(<|>)<\/span>/g, ($0, $1) => $1)
// 将双引号转为实体字符
value = value.replace(/"/g, '&quot;')
return `<input type="button" class="var-tag" id="${randomId}" value="${value}" />`
}
return match
})
Expand Down Expand Up @@ -593,7 +597,7 @@
line-height: 18px;
padding: 7px 0;
color: #63656e;
white-space: nowrap;
white-space: pre;
overflow: hidden;
/deep/.var-tag {
margin-right: 1px;
Expand Down
16 changes: 12 additions & 4 deletions frontend/desktop/src/components/common/RenderForm/tags/TagTextarea.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -386,8 +386,10 @@
return item.type === 'button' ? item.value : item.textContent
}).join('')
}
// 用户手动输入的空格编码渲染时需要切开展示
domValue = domValue.replace(/&(nbsp|ensp|emsp|thinsp|zwnj|zwj);/g, ($0, $1) => {
// 将html标签拆成文本形式
domValue = domValue.replace(/(<|>)/g, ($0, $1) => `<span>${$1}</span>`)
// 用户手动输入的实体字符渲染时需要切开展示
domValue = domValue.replace(/&(nbsp|ensp|emsp|thinsp|zwnj|zwj|quot|apos|lt|gt|amp|cent|pound|yen|euro|sect|copy|reg|trade|times|divide);/g, ($0, $1) => {
return `<span>&</span><span>${$1}</span><span>;</span>`
})

Expand All @@ -406,9 +408,12 @@
})
}
if (isExistVar) {
// 两边留空格保持间距
const randomId = Math.random().toString().slice(-6)
return `<input type="button" class="var-tag" id="tag_${randomId}" value=${match} />`
// 将装转的尖括号恢复原样
let value = match.replace(/<span>(<|>)<\/span>/g, ($0, $1) => $1)
// 将双引号转为实体字符
value = value.replace(/"/g, '&quot;')
return `<input type="button" class="var-tag" id="tag_${randomId}" value="${value}" />`
}
return match
})
Expand Down Expand Up @@ -602,6 +607,9 @@
background: #eaebf0;
}
}
/deep/div {
word-break: break-all;
}
&.input-before::before {
content: attr(data-placeholder);
color: #c4c6cc;
Expand Down
Loading