fix: marked兼容、保存竞态、关闭死锁、XSS防护、行号虚拟化、CSP加固

2026-05-18 17:23:26 +08:00
parent 320980030e
commit 1a5ec08728
3 changed files with 188 additions and 22 deletions
@@ -3,7 +3,10 @@
 <head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self' data:;">
+  <!-- CSP: script-src 只允许 self，阻断内联脚本执行 -->
+  <!-- style-src 保留 unsafe-inline：highlight.js 代码高亮依赖 CSS class，
+       但已通过 sanitizeHTML 移除恶意 style 属性和 expression() -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self';">
  <title>MarkLite</title>
  <link rel="stylesheet" href="style.css">
  <link rel="stylesheet" href="../lib/highlight-github.css">