fix(security): 防止 Markdown / 文本对比 / 正则结果中的 DOM XSS - #9
Draft
cursor[bot] wants to merge 1 commit into
Draft
Conversation
Prevents DOM XSS in Markdown preview, text diff, and regex match display when pasting HTML or script-like payloads. Co-authored-by: Muki182 <Muki182@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题与影响
在
index.html中，Markdown 预览、文本对比与正则匹配结果将用户可控字符串直接写入innerHTML。攻击者可诱导用户粘贴恶意内容（例如包含<img onerror=…>或<script>的片段），在同一来源下执行脚本，存在会话劫持、钓鱼等风险。根因
未对插入 DOM 的 HTML 上下文做转义，仅依赖简易 Markdown/差异渲染替换，原始 HTML 会原样进入
innerHTML。修复
escapeHtml()，对& < > " '进行实体转义。验证
innerHTML的路径（工具网格与面板 HTML 来自静态模板）。备注
已核对
actions/upload-pages-artifact：对.git/.github有硬编码排除，部署工作流不构成仓库元数据泄露，本次未改动 CI。