修复帖内 CSS 污染整页:前后端禁止 style 并消毒 HTML。

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
2026-08-04 13:04:10 +08:00
parent 2a34699f64
commit 860dffd547
9 changed files with 129 additions and 5 deletions

View File

@@ -873,6 +873,8 @@ func (h *Handlers) APIPostDetail(c *gin.Context) {
if c.Query("skip_view") != "1" && post.Status == model.ContentStatusPublished {
h.Post.RecordView(uint(id))
}
// 出口再消毒:兼容库内历史脏 HTML如 <style>),避免旧帖污染整页
post.Content = service.SanitizePostHTML(post.Content)
if uid == 0 {
post.Content = service.RedactMembersOnlyHTML(post.Content)
}