feat: #927 增加对html标签里style属性过滤的配置

Tencent · Sep 27, 2024 · 858f862 · 858f862
1 parent 4cdf428
commit 858f862
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 1 deletion.
diff --git a/src/Cherry.config.js b/src/Cherry.config.js
@@ -334,6 +334,14 @@ const defaultConfig = {
          */
         strict: false,
       },
+      htmlBlock: {
+        /**
+         * 是否过滤html标签中的style属性
+         *    true：过滤style属性
+         *    false：不过滤style属性
+         */
+        filterStyle: false,
+      },
     },
   },
   editor: {

diff --git a/src/core/hooks/HtmlBlock.js b/src/core/hooks/HtmlBlock.js
@@ -41,8 +41,9 @@ sanitizer.addHook('afterSanitizeAttributes', (node) => {
 
 export default class HtmlBlock extends ParagraphBase {
   static HOOK_NAME = 'htmlBlock';
-  constructor() {
+  constructor({ config }) {
     super({ needCache: true });
+    this.filterStyle = config.filterStyle || false;
   }
 
   // ref: http://www.vfmd.org/vfmd-spec/specification/#procedure-for-detecting-automatic-links
@@ -97,6 +98,10 @@ export default class HtmlBlock extends ParagraphBase {
     $str = $str.replace(/<(?=\/?(\w|\n|$))/g, '&#60;');
     // 还原被替换的尖括号
     $str = $str.replace(/\$#60;/g, '<').replace(/\$#62;/g, '>');
+    // 过滤HTML标签的style属性
+    if (this.filterStyle) {
+      $str = $str.replace(/<([^/][^>]+?) style="[^"]+"([^>]*)>/gi, '<$1$2>');
+    }
     return $str;
   }
 

diff --git a/types/cherry.d.ts b/types/cherry.d.ts
@@ -331,6 +331,14 @@ export interface CherryEngineOptions {
        */
       strict?: boolean,
     },
+    htmlBlock?: {
+      /**
+       * 是否过滤html标签中的style属性
+       *    true：过滤style属性
+       *    false：不过滤style属性
+       */
+      filterStyle?: boolean,
+    },
   };
   /** 自定义语法 */
   customSyntax?: Record<string, CustomSyntaxRegConfig['syntaxClass'] | CustomSyntaxRegConfig>;