添加 DOMPurify 依赖并更新 HTML 处理函数以确保安全性

client/js/util.string.js

@@ -1,20 +1,34 @@
+// Use DOMPurify to safely handle HTML content
+// 使用 DOMPurify 安全处理 HTML 内容
+import DOMPurify from 'dompurify';
+
 // Escape HTML special characters
 // 转义 HTML 特殊字符
 export function escapeHTML(str) {
 	if (typeof str !== 'string') return '';
+	// 使用替换方法确保 HTML 特殊字符被转义，而不是被移除
+	// 这样 <java> 会变成 &lt;java&gt; 而不是被删除
 	return str.replace(/[&<>"']/g, function(c) {
 		return {
-			'&': '&amp;', // & to &amp;  // & 转为 &amp;
-			'<': '&lt;',   // < to &lt;  // < 转为 &lt;
-			'>': '&gt;',   // > to &gt;  // > 转为 &gt;
-			'"': '&quot;', // " to &quot; // " 转为 &quot;
-			'\'': '&#39;'  // ' to &#39;  // ' 转为 &#39;
-		} [c]
-	})
+			'&': '&amp;',  // & 转为 &amp;
+			'<': '&lt;',   // < 转为 &lt;
+			'>': '&gt;',   // > 转为 &gt;
+			'"': '&quot;', // " 转为 &quot;
+			"'": '&#39;'   // ' 转为 &#39;
+		}[c];
+	});
 }
+
 // Convert text to HTML, preserving line breaks
 // 将文本转换为 HTML，保留换行符
 export function textToHTML(text) {
 	if (typeof text !== 'string') return '';
-	return escapeHTML(text).replace(/\n/g, '<br>')
+	// 先进行 HTML 转义，然后将换行符替换为 <br> 标签
+	// 最后使用 DOMPurify 确保结果是安全的 HTML
+	const escaped = escapeHTML(text);
+	const withLineBreaks = escaped.replace(/\n/g, '<br>');
+	return DOMPurify.sanitize(withLineBreaks, {
+		ALLOWED_TAGS: ['br'], // 只允许 <br> 标签
+		ALLOWED_ATTR: [],     // 不允许任何属性
+	});
 }

package-lock.json

@@ -13,6 +13,7 @@
         "@dicebear/micah": "^9.2.2",
         "aes-js": "^3.1.2",
         "buffer": "^6.0.3",
+        "dompurify": "^3.2.6",
         "elliptic": "^6.6.1",
         "emoji-picker-element": "^1.26.3",
         "js-chacha20": "^1.1.0",
@@ -841,6 +842,13 @@
       "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
       "license": "MIT"
     },
+    "node_modules/@types/trusted-types": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmmirror.com/@types/trusted-types/-/trusted-types-2.0.7.tgz",
+      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/acorn": {
       "version": "8.14.1",
       "resolved": "https://registry.npmmirror.com/acorn/-/acorn-8.14.1.tgz",
@@ -1278,6 +1286,15 @@
         "url": "https://github.com/fb55/domhandler?sponsor=1"
       }
     },
+    "node_modules/dompurify": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmmirror.com/dompurify/-/dompurify-3.2.6.tgz",
+      "integrity": "sha512-/2GogDQlohXPZe6D6NOgQvXLPSYBqIWMnZ8zzOhn09REE4eyAzb+Hed3jhoM9OkuaJ8P6ZGTTVWQKAi8ieIzfQ==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
     "node_modules/domutils": {
       "version": "3.2.2",
       "resolved": "https://registry.npmmirror.com/domutils/-/domutils-3.2.2.tgz",

package.json

@@ -31,6 +31,7 @@
     "@dicebear/micah": "^9.2.2",
     "aes-js": "^3.1.2",
     "buffer": "^6.0.3",
+    "dompurify": "^3.2.6",
     "elliptic": "^6.6.1",
     "emoji-picker-element": "^1.26.3",
     "js-chacha20": "^1.1.0",