fix: resolve xss vulnerability (#549)

close #548
doocs · Mar 3, 2025 · 28ede70 · 28ede70
1 parent 757697b
commit 28ede70
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -35,6 +35,7 @@
     "cos-js-sdk-v5": "^1.8.7",
     "crypto-js": "^4.2.0",
     "csstype": "^3.1.3",
+    "dompurify": "^3.2.4",
     "es-toolkit": "^1.27.0",
     "form-data": "4.0.1",
     "front-matter": "^4.0.2",

diff --git a/src/stores/index.ts b/src/stores/index.ts
@@ -7,6 +7,7 @@ import { addPrefix, css2json, customCssWithTemplate, customizeTheme, downloadMD,
 import { initRenderer } from '@/utils/renderer'
 import CodeMirror from 'codemirror'
 import { marked } from 'marked'
+import DOMPurify from 'dompurify'
 
 export const useStore = defineStore(`store`, () => {
   // 是否开启深色模式
@@ -191,6 +192,7 @@ export const useStore = defineStore(`store`, () => {
     const { markdownContent, readingTime: readingTimeResult } = renderer.parseFrontMatterAndContent(editor.value!.getValue())
     readingTime.value = readingTimeResult
     let outputTemp = marked.parse(markdownContent) as string
+    outputTemp = DOMPurify.sanitize(outputTemp)
 
     // 阅读时间及字数统计
     outputTemp = renderer.buildReadingTime(readingTimeResult) + outputTemp