diff --git a/frontend/src/utils/postContent.ts b/frontend/src/utils/postContent.ts index 72fea82..778a239 100644 --- a/frontend/src/utils/postContent.ts +++ b/frontend/src/utils/postContent.ts @@ -3,7 +3,11 @@ import type { Config } from 'dompurify'; import { enhanceCodeBlocks } from './enhanceCodeBlocks'; import { enhanceHeadingAnchors } from './postHeadings'; -/** DOMPurify 配置：允许会员专属自定义标签与链接 target */ +/** + * DOMPurify 配置：允许会员专属自定义标签与链接 target。 + * 注意：DOMPurify 3.x 默认放行 " + out := SanitizePostHTML(in) + if strings.Contains(strings.ToLower(out), "段落

` + out := SanitizePostHTML(in) + if strings.Contains(strings.ToLower(out), "style=") { + t.Fatalf("应剥离 style 属性，得到: %q", out) + } + if strings.Contains(strings.ToLower(out), "

密

` + + `
x
` + + `

清浮动

` + out := SanitizePostHTML(in) + for _, want := range []string{"members-only", "data-image-group", "data-layout", "data-clear-float", "清浮动"} { + if !strings.Contains(out, want) { + t.Fatalf("缺少 %q，得到: %q", want, out) + } + } +} + +func TestStripHTMLForSearch_DropsStyleText(t *testing.T) { + in := "
你好
" + out := StripHTMLForSearch(in) + if strings.Contains(out, "color") || strings.Contains(out, "red") { + t.Fatalf("摘要不应含 CSS，得到: %q", out) + } + if out != "你好" { + t.Fatalf("期望 %q，得到 %q", "你好", out) + } +}