diff --git a/app/src/protyle/toolbar/index.ts b/app/src/protyle/toolbar/index.ts index d85b283c2..0157bdec1 100644 --- a/app/src/protyle/toolbar/index.ts +++ b/app/src/protyle/toolbar/index.ts @@ -1053,7 +1053,7 @@ export class Toolbar { } inlineMemoElements.forEach((item) => { if (item.nodeType !== 3) { - item.setAttribute("data-inline-memo-content", Lute.EscapeHTMLStr(textElement.value)); + item.setAttribute("data-inline-memo-content", window.DOMPurify.sanitize(textElement.value)); } }); } else { @@ -1131,7 +1131,7 @@ export class Toolbar { } } else if (item.nodeType !== 3) { // 行级备注自动移除换行 https://ld246.com/article/1664205917326 - item.setAttribute("data-inline-memo-content", Lute.EscapeHTMLStr(textElement.value)); + item.setAttribute("data-inline-memo-content", window.DOMPurify.sanitize(textElement.value)); } }); } else if (types.includes("inline-math")) { diff --git a/app/src/protyle/util/onGet.ts b/app/src/protyle/util/onGet.ts index 2b998e181..bd9441e5f 100644 --- a/app/src/protyle/util/onGet.ts +++ b/app/src/protyle/util/onGet.ts @@ -134,18 +134,16 @@ const setHTML = (options: { return; } - if (DOMPurify) { - // XSS in inline memo elements https://github.com/siyuan-note/siyuan/issues/15280 - const parser = new DOMParser(); - const doc = parser.parseFromString(options.content, "text/html"); - doc.querySelectorAll("[data-inline-memo-content]").forEach(item => { - const content = item.getAttribute("data-inline-memo-content"); - if (content) { - item.setAttribute("data-inline-memo-content", DOMPurify.sanitize(content)); - } - }); - options.content = doc.body.innerHTML; - } + // XSS in inline memo elements https://github.com/siyuan-note/siyuan/issues/15280 + const parser = new DOMParser(); + const doc = parser.parseFromString(options.content, "text/html"); + doc.querySelectorAll("[data-inline-memo-content]").forEach(item => { + const content = item.getAttribute("data-inline-memo-content"); + if (content) { + item.setAttribute("data-inline-memo-content", window.DOMPurify.sanitize(content)); + } + }); + options.content = doc.body.innerHTML; protyle.block.showAll = options.action.includes(Constants.CB_GET_ALL); const REMOVED_OVER_HEIGHT = protyle.contentElement.clientHeight * 8; diff --git a/app/src/types/index.d.ts b/app/src/types/index.d.ts index ac97d82fc..284e5e3c9 100644 --- a/app/src/types/index.d.ts +++ b/app/src/types/index.d.ts @@ -140,6 +140,9 @@ interface CSSStyleDeclarationElectron extends CSSStyleDeclaration { } interface Window { + DOMPurify: { + sanitize(dirty: string): string; + }; echarts: { init(element: Element, theme?: string, options?: { width: number