fix: 🐛 fixed #30 xss problem

zhanglun · Oct 25, 2023 · 426cbd7 · 426cbd7
1 parent d9da353
commit 426cbd7
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 2 deletions.
diff --git a/package.json b/package.json
@@ -52,6 +52,7 @@
     "tailwindcss-animate": "^1.0.5",
     "tauri-plugin-log-api": "github:tauri-apps/tauri-plugin-log",
     "web-vitals": "^3.1.0",
+    "xss": "^1.0.14",
     "zustand": "^4.3.7"
   },
   "devDependencies": {

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/components/ArticleView/Detail.tsx b/src/components/ArticleView/Detail.tsx
@@ -7,6 +7,7 @@ import { useBearStore } from "@/stores";
 import * as dataAgent from "@/helpers/dataAgent";
 import { motion, AnimatePresence } from "framer-motion";
 import { fetch } from "@tauri-apps/api/http";
+import xss from 'xss';
 
 function createMarkup(html: string) {
   return { __html: html };
@@ -57,7 +58,7 @@ export const ArticleDetail = (props: ArticleDetailProps) => {
         // try to get the best banner if there is no image in article content
         // it will make render slower
         setShowBanner(content.search(/<img[^>]+>/gi) === -1);
-        setPageContent(content);
+        setPageContent(xss(content));
       });
 
       return () => {