fixed xss and more #400

xCss · Jun 24, 2022 · c40826c · c40826c
1 parent 7ed6d0e
commit c40826c
Show file tree

Hide file tree

Showing 4 changed files with 46 additions and 68 deletions.
diff --git a/dist/Valine.Pure.min.js b/dist/Valine.Pure.min.js
diff --git a/dist/Valine.min.js b/dist/Valine.min.js
diff --git a/docs/index.html b/docs/index.html
@@ -1,82 +1,59 @@
-
-
-
-
 <!DOCTYPE html>
 <html lang="zh" class="no-js">
   <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <meta http-equiv="x-ua-compatible" content="ie=edge">
+    <meta name="keywords" content="极简风评论系统,社会化评论系统,无后端评论系统,评论系统,comment system,valine comment system,simple &amp; fast,Minimalist style">
 
-      <meta charset="utf-8">
-      <meta name="viewport" content="width=device-width,initial-scale=1">
-      <meta http-equiv="x-ua-compatible" content="ie=edge">
-	  <meta name="keywords" content="极简风评论系统,社会化评论系统,无后端评论系统,评论系统,comment system,valine comment system,simple &amp; fast,Minimalist style">
-
-        <meta name="description" content="A fast, simple & powerful comment system.">
-
-
-        <link rel="canonical" href="https://valine.js.org/">
-
-
-        <meta name="author" content="xCss">
-
-
-        <meta name="lang:clipboard.copy" content="复制">
-
-        <meta name="lang:clipboard.copied" content="已复制">
-
-        <meta name="lang:search.language" content="jp">
-
-        <meta name="lang:search.pipeline.stopwords" content="True">
-
-        <meta name="lang:search.pipeline.trimmer" content="True">
-
-        <meta name="lang:search.result.none" content="没有找到符合条件的结果">
-
-        <meta name="lang:search.result.one" content="找到 1 个符合条件的结果">
-
-        <meta name="lang:search.result.other" content="# 个符合条件的结果">
-
-        <meta name="lang:search.tokenizer" content="[\uff0c\u3002]+">
-
-      <link rel="shortcut icon" href="./assets/images/favicon.ico">
-      <meta name="generator" content="mkdocs-0.17.3, mkdocs-material-2.7.1">
+      <meta name="description" content="A fast, simple & powerful comment system.">
 
 
-
-        <title>Valine - A fast, simple & powerful comment system.</title>
-
+      <link rel="canonical" href="https://valine.js.org/">
 
 
-      <link rel="stylesheet" href="./assets/stylesheets/application.78aab2dc.css">
-
-        <link rel="stylesheet" href="./assets/stylesheets/application-palette.6079476c.css">
-
+      <meta name="author" content="xCss">
 
 
-      <script src="./assets/javascripts/modernizr.1aa3b519.js"></script>
+      <meta name="lang:clipboard.copy" content="复制">
+
+      <meta name="lang:clipboard.copied" content="已复制">
+
+      <meta name="lang:search.language" content="jp">
 
+      <meta name="lang:search.pipeline.stopwords" content="True">
 
+      <meta name="lang:search.pipeline.trimmer" content="True">
+
+      <meta name="lang:search.result.none" content="没有找到符合条件的结果">
+
+      <meta name="lang:search.result.one" content="找到 1 个符合条件的结果">
+
+      <meta name="lang:search.result.other" content="# 个符合条件的结果">
+
+      <meta name="lang:search.tokenizer" content="[\uff0c\u3002]+">
+
+      <link rel="shortcut icon" href="./assets/images/favicon.ico">
+      <meta name="generator" content="mkdocs-0.17.3, mkdocs-material-2.7.1">
+      <title>Valine - A fast, simple & powerful comment system.</title>
+
+      <link rel="stylesheet" href="./assets/stylesheets/application.78aab2dc.css">
+
+      <link rel="stylesheet" href="./assets/stylesheets/application-palette.6079476c.css">
+      <script src="./assets/javascripts/modernizr.1aa3b519.js"></script>
       <link href="https://fonts-gstatic.proxy.ustclug.org" rel="preconnect" crossorigin>
 
-        <link rel="stylesheet" href="https://fonts.proxy.ustclug.org/css?family=Ubuntu:300,400,400i,700|Ubuntu+Mono">
-        <style>body,input{font-family:"Ubuntu","Helvetica Neue",Helvetica,Arial,sans-serif}code,kbd,pre{font-family:"Ubuntu Mono","Courier New",Courier,monospace}</style>
+      <link rel="stylesheet" href="https://fonts.proxy.ustclug.org/css?family=Ubuntu:300,400,400i,700|Ubuntu+Mono">
+      <style>body,input{font-family:"Ubuntu","Helvetica Neue",Helvetica,Arial,sans-serif}code,kbd,pre{font-family:"Ubuntu Mono","Courier New",Courier,monospace}</style>
 
       <link rel="stylesheet" href="https://fonts.proxy.ustclug.org/icon?family=Material+Icons">
 
-
-
   </head>
-
-
 
     <body dir="ltr" data-md-color-primary="white" data-md-color-accent="">
-
     <svg class="md-svg">
       <defs>
-
-
-          <svg xmlns="http://www.w3.org/2000/svg" width="416" height="448"
-    viewBox="0 0 416 448" id="github">
+          <svg xmlns="http://www.w3.org/2000/svg" width="416" height="448" viewBox="0 0 416 448" id="github">
   <path fill="currentColor" d="M160 304q0 10-3.125 20.5t-10.75 19-18.125
         8.5-18.125-8.5-10.75-19-3.125-20.5 3.125-20.5 10.75-19 18.125-8.5
         18.125 8.5 10.75 19 3.125 20.5zM320 304q0 10-3.125 20.5t-10.75

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "valine",
-  "version": "1.4.18",
+  "version": "1.5.0",
   "description": "A simple comment system based on Leancloud.",
   "main": "dist/Valine.min.js",
   "author": "xCss <[email protected]> (https://github.com/xCss)",
@@ -49,6 +49,7 @@
     "balajs": "^1.0.7",
     "balalaika": "^1.0.1",
     "blueimp-md5": "^2.8.0",
+    "dompurify": "^2.3.8",
     "element-closest": "^3.0.2",
     "hanabi": "^0.4.0",
     "insane": "^2.6.2",