修复帖内 CSS 污染整页:前后端禁止 style 并消毒 HTML。

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
2026-08-04 13:04:10 +08:00
parent 2a34699f64
commit 860dffd547
9 changed files with 129 additions and 5 deletions

View File

@@ -873,6 +873,8 @@ func (h *Handlers) APIPostDetail(c *gin.Context) {
if c.Query("skip_view") != "1" && post.Status == model.ContentStatusPublished {
h.Post.RecordView(uint(id))
}
// 出口再消毒:兼容库内历史脏 HTML如 <style>),避免旧帖污染整页
post.Content = service.SanitizePostHTML(post.Content)
if uid == 0 {
post.Content = service.RedactMembersOnlyHTML(post.Content)
}

View File

@@ -107,7 +107,7 @@ func (h *Handlers) botHomeHTML(meta *embed_static.SPAPageMeta, brand service.Sit
func (h *Handlers) botPostHTML(base, siteName, defaultImage, keywords string, post *model.Post) string {
meta := attachSiteSEO(h.postPageMeta(base, siteName, defaultImage, post), siteName, keywords)
content := service.RedactMembersOnlyHTML(post.Content)
content := service.SanitizePostHTML(service.RedactMembersOnlyHTML(post.Content))
author := service.DisplayName(&post.User)
var body strings.Builder
body.WriteString("<article>")