0ct0pu5/siyuan
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

🎨 Do not execute scripts in HTML blocks by default to prevent XSS https://github.com/siyuan-note/siyuan/issues/11172

Browse source
This commit is contained in:
Daniel 2024-04-27 23:13:06 +08:00
parent 34caeb5871
commit 9c1ebe6e6d
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
6 changed files with 365 additions and 253 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

113
app/guide/20210808180117-6v0mkxr/20200923234011-ieuun1p/20210808180303-6yi0dv5/20200924101225-k254i8g.sy
View file

@ -6,7 +6,7 @@
"id": "20200924101225-k254i8g",
"title": "Content Block Type",
"type": "doc",
"updated": "20220623201527"
"updated": "20240427231144"
},
"Children": [
{
@ -1552,9 +1552,13 @@
"Type": "NodeParagraph",
"Properties": {
"id": "20220429115221-suekrrv",
"updated": "20220429115221"
"updated": "20240427231027"
},
"Children": [
{
"Type": "NodeText",
"Data": "​"
},
{
"Type": "NodeTextMark",
"TextMarkType": "tag",
@ -1562,7 +1566,110 @@
},
{
"Type": "NodeText",
"Data": ": The code in the HTML block will not be safely filtered when using it. Please confirm the code is safe before using it to avoid cross-site scripting (XSS)."
"Data": "​:"
}
]
},
{
"ID": "20240427231112-lcwev4m",
"Type": "NodeList",
"ListData": {},
"Properties": {
"id": "20240427231112-lcwev4m",
"updated": "20240427231144"
},
"Children": [
{
"ID": "20240427231112-q60pwo8",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20240427231112-q60pwo8",
"updated": "20240427231144"
},
"Children": [
{
"ID": "20240427231112-e7j3mqt",
"Type": "NodeParagraph",
"Properties": {
"id": "20240427231112-e7j3mqt",
"updated": "20240427231144"
},
"Children": [
{
"Type": "NodeText",
"Data": "When using HTML blocks, the code in them will be security filtered by default. If filtering is not required, please enable "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "Settings"
},
{
"Type": "NodeText",
"Data": "​ - "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "Editor"
},
{
"Type": "NodeText",
"Data": "​ - "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "Allow execution of scripts within HTML blocks"
},
{
"Type": "NodeText",
"Data": "​, but please confirm that the code is safe before opening it to avoid cross-site scripting attacks (XSS)."
}
]
}
]
},
{
"ID": "20240427231112-o1imtjo",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20240427231112-o1imtjo",
"updated": "20240427231112"
},
"Children": [
{
"ID": "20240427231112-3txbq9w",
"Type": "NodeParagraph",
"Properties": {
"id": "20240427231112-3txbq9w",
"updated": "20240427231112"
},
"Children": [
{
"Type": "NodeText",
"Data": "Because the Markdown specification has complicated parsing rules for HTML blocks, it is recommended to use "
},
{
"Type": "NodeTextMark",
"TextMarkType": "code",
"TextMarkTextContent": "\u0026lt;div\u0026gt;\u0026lt;/div\u0026gt;"
},
{
"Type": "NodeText",
"Data": "​ to wrap HTML code and remove blank lines."
}
]
}
]
}
]
},

92
app/guide/20210808180117-6v0mkxr/20200923234011-ieuun1p/20210808180303-h361q1i/20200924093441-ft2rhps.sy
View file

@ -8,7 +8,7 @@
"title": "Formatting elements",
"title-img": "background-color:#269;background-image: linear-gradient(white 2px, transparent 2px),linear-gradient(90deg, white 2px, transparent 2px),linear-gradient(rgba(255,255,255,.3) 1px, transparent 1px),linear-gradient(90deg, rgba(255,255,255,.3) 1px, transparent 1px);background-size: 100px 100px, 100px 100px, 20px 20px, 20px 20px;background-position:-2px -2px, -2px -2px, -1px -1px, -1px -1px;",
"type": "doc",
"updated": "20240416114218"
"updated": "20240427231204"
},
"Children": [
{
@ -2281,93 +2281,23 @@
"Type": "NodeParagraph",
"Properties": {
"id": "20220312122714-jgaetrv",
"updated": "20220828102557"
"updated": "20240427231204"
},
"Children": [
{
"Type": "NodeText",
"Data": "Please refer to "
},
{
"Type": "NodeTextMark",
"TextMarkType": "tag",
"TextMarkTextContent": "Note"
"TextMarkType": "block-ref",
"TextMarkBlockRefID": "20240427231112-lcwev4m",
"TextMarkBlockRefSubtype": "s",
"TextMarkTextContent": "HTML Block Notes"
},
{
"Type": "NodeText",
"Data": ": "
}
]
},
{
"ID": "20220828102558-h9c9bwe",
"Type": "NodeList",
"ListData": {},
"Properties": {
"id": "20220828102558-h9c9bwe",
"updated": "20220828102558"
},
"Children": [
{
"ID": "20220828102558-8ibvw54",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20220828102558-8ibvw54",
"updated": "20220828102558"
},
"Children": [
{
"ID": "20220828102558-zt2eu0w",
"Type": "NodeParagraph",
"Properties": {
"id": "20220828102558-zt2eu0w",
"updated": "20220828102558"
},
"Children": [
{
"Type": "NodeText",
"Data": "When using the HTML block, the code in it will not be security filtered, please confirm the code is safe before using it to avoid cross-site scripting attack (XSS)"
}
]
}
]
},
{
"ID": "20220828102558-r1v2xmr",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20220828102558-r1v2xmr",
"updated": "20220828102558"
},
"Children": [
{
"ID": "20220828102558-1cg51k8",
"Type": "NodeParagraph",
"Properties": {
"id": "20220828102558-1cg51k8",
"updated": "20220828102558"
},
"Children": [
{
"Type": "NodeText",
"Data": "Because the Markdown specification is more complicated for HTML block parsing rules, it is recommended to use "
},
{
"Type": "NodeTextMark",
"TextMarkType": "code",
"TextMarkTextContent": "\u0026lt;div\u0026gt;\u0026lt;/div\u0026gt;"
},
{
"Type": "NodeText",
"Data": " to wrap HTML code and remove blank lines"
}
]
}
]
"Data": " for more details."
}
]
},

94
app/guide/20210808180117-czj9bvb/20200812220555-lj3enxa/20210808180320-abz7w6k/20200825162036-4dx365o.sy
View file

@ -8,7 +8,7 @@
"title": "排版元素",
"title-img": "background-color: hsl(2, 57%, 40%);background-image: repeating-linear-gradient(transparent, transparent 50px, rgba(0,0,0,.4) 50px, rgba(0,0,0,.4) 53px, transparent 53px, transparent 63px, rgba(0,0,0,.4) 63px, rgba(0,0,0,.4) 66px, transparent 66px, transparent 116px, rgba(0,0,0,.5) 116px, rgba(0,0,0,.5) 166px, rgba(255,255,255,.2) 166px, rgba(255,255,255,.2) 169px, rgba(0,0,0,.5) 169px, rgba(0,0,0,.5) 179px, rgba(255,255,255,.2) 179px, rgba(255,255,255,.2) 182px, rgba(0,0,0,.5) 182px, rgba(0,0,0,.5) 232px, transparent 232px),repeating-linear-gradient(270deg, transparent, transparent 50px, rgba(0,0,0,.4) 50px, rgba(0,0,0,.4) 53px, transparent 53px, transparent 63px, rgba(0,0,0,.4) 63px, rgba(0,0,0,.4) 66px, transparent 66px, transparent 116px, rgba(0,0,0,.5) 116px, rgba(0,0,0,.5) 166px, rgba(255,255,255,.2) 166px, rgba(255,255,255,.2) 169px, rgba(0,0,0,.5) 169px, rgba(0,0,0,.5) 179px, rgba(255,255,255,.2) 179px, rgba(255,255,255,.2) 182px, rgba(0,0,0,.5) 182px, rgba(0,0,0,.5) 232px, transparent 232px),repeating-linear-gradient(125deg, transparent, transparent 2px, rgba(0,0,0,.2) 2px, rgba(0,0,0,.2) 3px, transparent 3px, transparent 5px, rgba(0,0,0,.2) 5px);",
"type": "doc",
"updated": "20240416105853"
"updated": "20240427230913"
},
"Children": [
{
@ -2263,7 +2263,7 @@
"Data": "\u003cdiv\u003e\n\u003cruby\u003e\n你\u003crt\u003enǐ\u003c/rt\u003e\n　好\u003crt\u003e　hǎo\u003c/rt\u003e\n　世\u003crt\u003e　shì\u003c/rt\u003e\n　界\u003crt\u003e　jiè\u003c/rt\u003e\n\u003c/ruby\u003e\u003cbr\u003e\nHello World\n\u003c/div\u003e",
"Properties": {
"id": "20220312004517-f6i1k8m",
"updated": "20220828102447"
"updated": "20240427230559"
}
},
{
@ -2271,93 +2271,23 @@
"Type": "NodeParagraph",
"Properties": {
"id": "20220312122055-qsltja9",
"updated": "20220312122518"
"updated": "20240427230913"
},
"Children": [
{
"Type": "NodeText",
"Data": "更多细节请参考 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "tag",
"TextMarkTextContent": "注意"
"TextMarkType": "block-ref",
"TextMarkBlockRefID": "20240427230507-yeaxqbs",
"TextMarkBlockRefSubtype": "s",
"TextMarkTextContent": "HTML 块注意"
},
{
"Type": "NodeText",
"Data": "："
}
]
},
{
"ID": "20220828102305-kv9o4nz",
"Type": "NodeList",
"ListData": {},
"Properties": {
"id": "20220828102305-kv9o4nz",
"updated": "20220828102421"
},
"Children": [
{
"ID": "20220828102306-gt8j7lc",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20220828102306-gt8j7lc",
"updated": "20220828102306"
},
"Children": [
{
"ID": "20220828102306-4yswrhi",
"Type": "NodeParagraph",
"Properties": {
"id": "20220828102306-4yswrhi",
"updated": "20220828102306"
},
"Children": [
{
"Type": "NodeText",
"Data": "使用 HTML 块时不会对其中的代码进行安全过滤，请确认代码安全后再使用，以免遭遇跨站脚本攻击（XSS）"
}
]
}
]
},
{
"ID": "20220828102307-hhuecb8",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20220828102307-hhuecb8",
"updated": "20220828102421"
},
"Children": [
{
"ID": "20220828102307-t8ssvfi",
"Type": "NodeParagraph",
"Properties": {
"id": "20220828102307-t8ssvfi",
"updated": "20220828102421"
},
"Children": [
{
"Type": "NodeText",
"Data": "因为 Markdown 规范对 HTML 块解析规则较为复杂，建议使用 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "code",
"TextMarkTextContent": "\u0026lt;div\u0026gt;\u0026lt;/div\u0026gt;"
},
{
"Type": "NodeText",
"Data": " 包裹 HTML 代码并去掉空行"
}
]
}
]
"Data": "。"
}
]
},

113
app/guide/20210808180117-czj9bvb/20200812220555-lj3enxa/20210808180320-fqgskfj/20200905090211-2vixtlf.sy
View file

@ -6,7 +6,7 @@
"id": "20200905090211-2vixtlf",
"title": "内容块类型",
"type": "doc",
"updated": "20220429115850"
"updated": "20240427230507"
},
"Children": [
{
@ -1537,9 +1537,13 @@
"Type": "NodeParagraph",
"Properties": {
"id": "20220429115137-qys9mvv",
"updated": "20220429115310"
"updated": "20240427230506"
},
"Children": [
{
"Type": "NodeText",
"Data": "​"
},
{
"Type": "NodeTextMark",
"TextMarkType": "tag",
@ -1547,7 +1551,110 @@
},
{
"Type": "NodeText",
"Data": "：使用 HTML 块时不会对其中的代码进行安全过滤，请确认代码安全后再使用，以免遭遇跨站脚本攻击（XSS）。"
"Data": "​："
}
]
},
{
"ID": "20240427230507-yeaxqbs",
"Type": "NodeList",
"ListData": {},
"Properties": {
"id": "20240427230507-yeaxqbs",
"updated": "20240427230507"
},
"Children": [
{
"ID": "20240427230507-x75u8vb",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20240427230507-x75u8vb",
"updated": "20240427230507"
},
"Children": [
{
"ID": "20240427230507-i73h3ru",
"Type": "NodeParagraph",
"Properties": {
"id": "20240427230507-i73h3ru",
"updated": "20240427230507"
},
"Children": [
{
"Type": "NodeText",
"Data": "使用 HTML 块时默认会对其中的代码进行安全过滤，如果不需要过滤，请开启 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "设置"
},
{
"Type": "NodeText",
"Data": "​ - "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "编辑器"
},
{
"Type": "NodeText",
"Data": "​ - "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "允许执行 HTML 块内脚本"
},
{
"Type": "NodeText",
"Data": "​，但请确认代码安全后再开启，以免遭遇跨站脚本攻击（XSS）"
}
]
}
]
},
{
"ID": "20240427230507-d9kna2p",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20240427230507-d9kna2p",
"updated": "20240427230507"
},
"Children": [
{
"ID": "20240427230507-2qbjv6v",
"Type": "NodeParagraph",
"Properties": {
"id": "20240427230507-2qbjv6v",
"updated": "20240427230507"
},
"Children": [
{
"Type": "NodeText",
"Data": "因为 Markdown 规范对 HTML 块解析规则较为复杂，建议使用 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "code",
"TextMarkTextContent": "\u0026lt;div\u0026gt;\u0026lt;/div\u0026gt;"
},
{
"Type": "NodeText",
"Data": "​ 包裹 HTML 代码并去掉空行"
}
]
}
]
}
]
},

114
app/guide/20211226090932-5lcq56f/20211226115423-d5z1joq/20211226115825-mhcslw2/20211226120147-ib6yy3i.sy
View file

@ -5,7 +5,8 @@
"Properties": {
"id": "20211226120147-ib6yy3i",
"title": "內容塊類型",
"updated": "20220429115701"
"type": "doc",
"updated": "20240427230732"
},
"Children": [
{
@ -1499,9 +1500,13 @@
"Type": "NodeParagraph",
"Properties": {
"id": "20220429115013-bsph7kh",
"updated": "20220429115013"
"updated": "20240427230731"
},
"Children": [
{
"Type": "NodeText",
"Data": "​"
},
{
"Type": "NodeTextMark",
"TextMarkType": "tag",
@ -1509,7 +1514,110 @@
},
{
"Type": "NodeText",
"Data": "：使用 HTML 塊時不會對其中的代碼進行安全過濾，請確認代碼安全後再使用，以免遭遇跨站腳本攻擊（XSS）。"
"Data": "​："
}
]
},
{
"ID": "20240427230732-snprakd",
"Type": "NodeList",
"ListData": {},
"Properties": {
"id": "20240427230732-snprakd",
"updated": "20240427230732"
},
"Children": [
{
"ID": "20240427230732-tgvmt21",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20240427230732-tgvmt21",
"updated": "20240427230732"
},
"Children": [
{
"ID": "20240427230732-p75fah5",
"Type": "NodeParagraph",
"Properties": {
"id": "20240427230732-p75fah5",
"updated": "20240427230732"
},
"Children": [
{
"Type": "NodeText",
"Data": "使用 HTML 區塊時預設會對其中的程式碼進行安全過濾，如果不需要過濾，請開啟 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "設定"
},
{
"Type": "NodeText",
"Data": "​ - "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "編輯器"
},
{
"Type": "NodeText",
"Data": "​ - "
},
{
"Type": "NodeTextMark",
"TextMarkType": "kbd",
"TextMarkTextContent": "允許執行 HTML 區塊內腳本"
},
{
"Type": "NodeText",
"Data": "​，但請確認程式碼安全後再開啟，以免遭遇跨站腳本攻擊（XSS）"
}
]
}
]
},
{
"ID": "20240427230732-dhlczme",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20240427230732-dhlczme",
"updated": "20240427230732"
},
"Children": [
{
"ID": "20240427230732-an8u8ps",
"Type": "NodeParagraph",
"Properties": {
"id": "20240427230732-an8u8ps",
"updated": "20240427230732"
},
"Children": [
{
"Type": "NodeText",
"Data": "因為 Markdown 規範對 HTML 區塊解析規則較為複雜，建議使用 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "code",
"TextMarkTextContent": "\u0026lt;div\u0026gt;\u0026lt;/div\u0026gt;"
},
{
"Type": "NodeText",
"Data": "​ 包裹 HTML 程式碼並去掉空白行"
}
]
}
]
}
]
},

92
app/guide/20211226090932-5lcq56f/20211226115423-d5z1joq/20211226120854-dr1jfx2/20211226121319-emrk2yy.sy
View file

@ -8,7 +8,7 @@
"title": "排版元素",
"title-img": "background-color: hsl(2, 57%, 40%);background-image: repeating-linear-gradient(transparent, transparent 50px, rgba(0,0,0,.4) 50px, rgba(0,0,0,.4) 53px, transparent 53px, transparent 63px, rgba(0,0,0,.4) 63px, rgba(0,0,0,.4) 66px, transparent 66px, transparent 116px, rgba(0,0,0,.5) 116px, rgba(0,0,0,.5) 166px, rgba(255,255,255,.2) 166px, rgba(255,255,255,.2) 169px, rgba(0,0,0,.5) 169px, rgba(0,0,0,.5) 179px, rgba(255,255,255,.2) 179px, rgba(255,255,255,.2) 182px, rgba(0,0,0,.5) 182px, rgba(0,0,0,.5) 232px, transparent 232px),repeating-linear-gradient(270deg, transparent, transparent 50px, rgba(0,0,0,.4) 50px, rgba(0,0,0,.4) 53px, transparent 53px, transparent 63px, rgba(0,0,0,.4) 63px, rgba(0,0,0,.4) 66px, transparent 66px, transparent 116px, rgba(0,0,0,.5) 116px, rgba(0,0,0,.5) 166px, rgba(255,255,255,.2) 166px, rgba(255,255,255,.2) 169px, rgba(0,0,0,.5) 169px, rgba(0,0,0,.5) 179px, rgba(255,255,255,.2) 179px, rgba(255,255,255,.2) 182px, rgba(0,0,0,.5) 182px, rgba(0,0,0,.5) 232px, transparent 232px),repeating-linear-gradient(125deg, transparent, transparent 2px, rgba(0,0,0,.2) 2px, rgba(0,0,0,.2) 3px, transparent 3px, transparent 5px, rgba(0,0,0,.2) 5px);",
"type": "doc",
"updated": "20240416113842"
"updated": "20240427231052"
},
"Children": [
{
@ -2273,93 +2273,23 @@
"Type": "NodeParagraph",
"Properties": {
"id": "20220312122707-8258e11",
"updated": "20220828102532"
"updated": "20240427231052"
},
"Children": [
{
"Type": "NodeText",
"Data": "更多細節請參考 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "tag",
"TextMarkTextContent": "注意"
"TextMarkType": "block-ref",
"TextMarkBlockRefID": "20240427230732-snprakd",
"TextMarkBlockRefSubtype": "s",
"TextMarkTextContent": "HTML 區塊注意"
},
{
"Type": "NodeText",
"Data": "："
}
]
},
{
"ID": "20220828102532-4j8tblh",
"Type": "NodeList",
"ListData": {},
"Properties": {
"id": "20220828102532-4j8tblh",
"updated": "20220828102532"
},
"Children": [
{
"ID": "20220828102532-69g744z",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20220828102532-69g744z",
"updated": "20220828102532"
},
"Children": [
{
"ID": "20220828102532-ozh8pha",
"Type": "NodeParagraph",
"Properties": {
"id": "20220828102532-ozh8pha",
"updated": "20220828102532"
},
"Children": [
{
"Type": "NodeText",
"Data": "使用 HTML 塊時不會對其中的代碼進行安全過濾，請確認代碼安全後再使用，以免遭遇跨站腳本攻擊（XSS）"
}
]
}
]
},
{
"ID": "20220828102532-xrle9qv",
"Type": "NodeListItem",
"ListData": {
"BulletChar": 42,
"Marker": "Kg=="
},
"Properties": {
"id": "20220828102532-xrle9qv",
"updated": "20220828102532"
},
"Children": [
{
"ID": "20220828102532-u9zdtto",
"Type": "NodeParagraph",
"Properties": {
"id": "20220828102532-u9zdtto",
"updated": "20220828102532"
},
"Children": [
{
"Type": "NodeText",
"Data": "因為 Markdown 規範對 HTML 塊解析規則較為複雜，建議使用 "
},
{
"Type": "NodeTextMark",
"TextMarkType": "code",
"TextMarkTextContent": "\u0026lt;div\u0026gt;\u0026lt;/div\u0026gt;"
},
{
"Type": "NodeText",
"Data": " 包裹 HTML 代碼並去掉空行"
}
]
}
]
"Data": "。"
}
]
},