MetonaTeam/MetonaToast
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(#1): XSS — escapeHTML 保护 confirm/prompt 模板中的所有用户输入

Browse Source
This commit is contained in:
tianhao
2026-06-16 12:40:01 +08:00
parent ff9c7cd218
commit 9ce1809928
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core.js
+6 -6
View File
@@ -539,8 +539,8 @@ const _confirmHTML = (opts) => {
const confirmColor = opts.confirmColor || '#10b981'; const confirmColor = opts.confirmColor || '#10b981';
const cancelColor = opts.cancelColor || '#6b7280'; const cancelColor = opts.cancelColor || '#6b7280';
return _btnRow(` return _btnRow(`
<button class="met-confirm-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${confirmColor};color:white;cursor:pointer;font-size:13px">${confirmText}</button> <button class="met-confirm-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${confirmColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(confirmText)}</button>
<button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${cancelText}</button> <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(cancelText)}</button>
`); `);
}; };
@@ -557,12 +557,12 @@ const _promptHTML = (opts) => {
return ` return `
<input type="${opts.inputType || 'text'}" <input type="${opts.inputType || 'text'}"
class="met-input" class="met-input"
placeholder="${opts.placeholder || ''}" placeholder="${escapeHTML(opts.placeholder || '')}"
value="${opts.defaultValue || ''}" value="${escapeHTML(opts.defaultValue || '')}"
style="width:100%;padding:8px 12px;border:1px solid rgba(0,0,0,0.1);border-radius:6px;font-size:13px;margin-top:8px;background:transparent;color:inherit;box-sizing:border-box"> style="width:100%;padding:8px 12px;border:1px solid rgba(0,0,0,0.1);border-radius:6px;font-size:13px;margin-top:8px;background:transparent;color:inherit;box-sizing:border-box">
${_btnRow(` ${_btnRow(`
<button class="met-submit-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${submitColor};color:white;cursor:pointer;font-size:13px">${submitText}</button> <button class="met-submit-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${submitColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(submitText)}</button>
<button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${cancelText}</button> <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(cancelText)}</button>
`)} `)}
`; `;
}; };