From 274db466f2e350e5084ee6f660fd2bd755397154 Mon Sep 17 00:00:00 2001
From: zhaojisen <1301338853@qq.com>
Date: Mon, 15 Jul 2024 11:33:08 +0800
Subject: [PATCH] =?UTF-8?q?fixed=EF=BC=9AFixed=20an=20issue=20where=20the?=
 =?UTF-8?q?=20user=20was=20unable=20to=20enter=20non-MD=20content?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json                              |  1 +
 src/components/Widgets/MarkDown/index.vue | 20 ++++++++++++++++----
 yarn.lock                                 |  5 +++++
 3 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 0b846687e..a07e11f81 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "css-color-function": "^1.3.3",
     "decimal.js": "^10.4.3",
     "deepmerge": "^4.2.2",
+    "dompurify": "^3.1.6",
     "echarts": "4.7.0",
     "element-ui": "2.15.14",
     "eslint-plugin-html": "^6.0.0",
diff --git a/src/components/Widgets/MarkDown/index.vue b/src/components/Widgets/MarkDown/index.vue
index 09c8228f9..650307412 100644
--- a/src/components/Widgets/MarkDown/index.vue
+++ b/src/components/Widgets/MarkDown/index.vue
@@ -4,28 +4,29 @@
       <div class="action-bar">
         <div class="action">
           <span>
-            <i :class="[!isShow ? 'fa-eye' : 'fa-eye-slash']" class="fa" @click="onView" />
+            <i class="fa" :class="[!isShow ? 'fa-eye' : 'fa-eye-slash']" @click="onView" />
           </span>
         </div>
       </div>
       <el-col :span="span" :style="{'height': height + 'px' }">
         <el-input
           v-model="iValue"
-          :rows="rows"
           autosize
+          :rows="rows"
           type="textarea"
           @change="onChange"
         />
       </el-col>
       <el-col v-show="isShow" :span="span">
-        <VueMarkdown :html="false" :show="true" :source="iValue" class="result-html" />
+        <VueMarkdown class="result-html" :source="sanitizedValue" :html="false" :show="true" />
       </el-col>
     </el-row>
-    <VueMarkdown v-else :html="false" :source="iValue" class="source" />
+    <VueMarkdown v-else class="source" :html="false" :source="sanitizedValue" />
   </div>
 </template>
 
 <script>
+import DOMPurify from 'dompurify'
 import VueMarkdown from 'vue-markdown'
 
 export default {
@@ -55,6 +56,17 @@ export default {
       iValue: this.value
     }
   },
+  computed: {
+    sanitizedValue() {
+      // 转义特殊字符
+      let content = this.iValue.replace(/\\/g, '\\\\').replace(/\$/g, '\\$')
+
+      // 使用 DOMPurify 进行 XSS 过滤
+      content = DOMPurify.sanitize(content)
+
+      return content
+    }
+  },
   mounted() {
     this.$nextTick(() => {
       this.resizeObserver = new ResizeObserver(entries => {
diff --git a/yarn.lock b/yarn.lock
index fdc84ac97..11cee5236 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4292,6 +4292,11 @@ domhandler@^4.0.0, domhandler@^4.2.0, domhandler@^4.2.2, domhandler@^4.3.1:
   dependencies:
     domelementtype "^2.2.0"
 
+dompurify@^3.1.6:
+  version "3.1.6"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.1.6.tgz#43c714a94c6a7b8801850f82e756685300a027e2"
+  integrity sha512-cTOAhc36AalkjtBpfG6O8JimdTMWNXjiePT2xQH/ppBGi/4uIpmj8eKyIkMJErXWARyINV/sB38yf8JCLF5pbQ==
+
 domready@1.0.8:
   version "1.0.8"
   resolved "https://registry.npmmirror.com/domready/-/domready-1.0.8.tgz"