From f623466ca24fc7c72a7c5e5e5155f918fb95370d Mon Sep 17 00:00:00 2001
From: hLinx <327159425@qq.com>
Date: Fri, 11 Nov 2022 10:47:39 +0800
Subject: [PATCH] =?UTF-8?q?bugfix:=20copyright=20markdown=E8=A7=A3?=
 =?UTF-8?q?=E6=9E=90=E9=97=AE=E9=A2=98=20#1471?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/frontend/package.json                   |  3 ++-
 src/frontend/src/views/home/index/index.vue | 16 ++++++++++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/frontend/package.json b/src/frontend/package.json
index ac32e4f991..0dbe4b5aac 100644
--- a/src/frontend/package.json
+++ b/src/frontend/package.json
@@ -37,7 +37,8 @@
     "vue-progressbar": "0.7.5",
     "vue-router": "3.5.2",
     "vuedraggable": "2.23.2",
-    "vuex": "3.6.2"
+    "vuex": "3.6.2",
+    "xss": "^1.0.14"
   },
   "devDependencies": {
     "@babel/core": "^7.17.8",
diff --git a/src/frontend/src/views/home/index/index.vue b/src/frontend/src/views/home/index/index.vue
index 00c0554544..da41b77c7e 100644
--- a/src/frontend/src/views/home/index/index.vue
+++ b/src/frontend/src/views/home/index/index.vue
@@ -77,6 +77,7 @@
 </template>
 <script>
     import marked from 'marked';
+    import xss from 'xss';
     import QueryGlobalSettingService from '@service/query-global-setting';
     import LayoutCard from './components/card';
     import User from './components/user';
@@ -85,6 +86,17 @@
     import FavorTask from './components/favor-task';
     import HistoryRecord from './components/history-record';
 
+    const xssHTML = (html) => {
+        const attrs = ['class', 'title', 'target', 'style'];
+        return xss(html, {
+            onTagAttr: (tag, name, value, isWhiteAttr) => {
+                if (attrs.includes(name)) {
+                    return `${name}=${value}`;
+                }
+            },
+        });
+    };
+
     export default {
         name: '',
         components: {
@@ -109,8 +121,8 @@
                 const formatLink = link => link.replace(/(?=( href))/g, ' target="_blank"');
                 QueryGlobalSettingService.fetchFooterConfig()
                     .then((data) => {
-                        this.footerLink = formatLink(marked(`${data.footerLink}`));
-                        this.footerCopyRight = marked(data.footerCopyRight);
+                        this.footerLink = xssHTML(formatLink(marked(`${data.footerLink}`)));
+                        this.footerCopyRight = xssHTML(marked(data.footerCopyRight));
                     });
             },
         },