From ca39c24911ef20ad8d169763ff4f55859d2c0bc7 Mon Sep 17 00:00:00 2001
From: chenjianxing <jianxing.chen@fit2cloud.com>
Date: Tue, 21 Dec 2021 20:11:19 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E9=83=A8=E5=88=86=E7=BC=BA=E9=99=B7?=
 =?UTF-8?q?=E4=B8=8D=E6=98=BE=E7=A4=BA=E5=86=85=E5=AE=B9(=E6=89=A9?=
 =?UTF-8?q?=E5=85=85xss=E7=99=BD=E5=90=8D=E5=8D=95)=20--bug=3D1008133=20--?=
 =?UTF-8?q?user=3D=E9=99=88=E5=BB=BA=E6=98=9F=20[github#7877]=E2=80=9C?=
 =?UTF-8?q?=E5=90=8C=E6=AD=A5=E7=BC=BA=E9=99=B7=E2=80=9D=E5=AF=BC=E8=87=B4?=
 =?UTF-8?q?bug=E6=95=B0=E6=8D=AE=E4=B8=A2=E5=A4=B1=20https://www.tapd.cn/5?=
 =?UTF-8?q?5049933/s/1084518?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/src/main/java/io/metersphere/xpack    |  2 +-
 .../track/case/components/MsMarkDownText.vue  | 35 ++++++++++++++++++-
 frontend/src/business/components/xpack        |  2 +-
 frontend/src/common/js/constants.js           |  2 +-
 4 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/backend/src/main/java/io/metersphere/xpack b/backend/src/main/java/io/metersphere/xpack
index 25fa8fc0d7..8e54dfc4cd 160000
--- a/backend/src/main/java/io/metersphere/xpack
+++ b/backend/src/main/java/io/metersphere/xpack
@@ -1 +1 @@
-Subproject commit 25fa8fc0d7972b56f86fb466417ec55588a4812d
+Subproject commit 8e54dfc4cd510f2d676787dad1599067ac02f2d9
diff --git a/frontend/src/business/components/track/case/components/MsMarkDownText.vue b/frontend/src/business/components/track/case/components/MsMarkDownText.vue
index 3a66dc0011..da7f1838f1 100644
--- a/frontend/src/business/components/track/case/components/MsMarkDownText.vue
+++ b/frontend/src/business/components/track/case/components/MsMarkDownText.vue
@@ -8,6 +8,7 @@
 <script>
 import {getCurrentUser, getUUID} from "@/common/js/utils";
 import {deleteMarkDownImg, uploadMarkDownImg} from "@/network/image";
+import {DEFAULT_XSS_ATTR} from "@/common/js/constants";
 export default {
   name: "MsMarkDownText",
   components: {},
@@ -68,7 +69,39 @@ export default {
       id: getUUID(),
       xssOptions: {
         whiteList: {
-          img: ["src", "alt", "width", "height"],
+          div: DEFAULT_XSS_ATTR,
+          p: DEFAULT_XSS_ATTR,
+          br: [],
+          h1: DEFAULT_XSS_ATTR,
+          h2: DEFAULT_XSS_ATTR,
+          h3: DEFAULT_XSS_ATTR,
+          h4: DEFAULT_XSS_ATTR,
+          h5: DEFAULT_XSS_ATTR,
+          h6: DEFAULT_XSS_ATTR,
+          hr: DEFAULT_XSS_ATTR,
+          span: DEFAULT_XSS_ATTR,
+          strong: DEFAULT_XSS_ATTR,
+          b: DEFAULT_XSS_ATTR,
+          i: DEFAULT_XSS_ATTR,
+          pre: DEFAULT_XSS_ATTR,
+          code: DEFAULT_XSS_ATTR,
+          tr: DEFAULT_XSS_ATTR,
+          table: [...DEFAULT_XSS_ATTR, 'width', 'border'],
+          td: [...DEFAULT_XSS_ATTR, 'width', 'colspan'],
+          th: [...DEFAULT_XSS_ATTR, 'width', 'colspan'],
+          a: [...DEFAULT_XSS_ATTR, 'target', 'href', 'title', 'rel'],
+          img: [...DEFAULT_XSS_ATTR, "src", "alt", "width", "height"],
+          tbody: DEFAULT_XSS_ATTR,
+          ul: DEFAULT_XSS_ATTR,
+          li: DEFAULT_XSS_ATTR,
+          ol: DEFAULT_XSS_ATTR,
+          dl: DEFAULT_XSS_ATTR,
+          dt: DEFAULT_XSS_ATTR,
+          em: DEFAULT_XSS_ATTR,
+          blockquote: DEFAULT_XSS_ATTR,
+          // 如果支持视频
+    //      audio: ['autoplay', 'controls', 'loop', 'preload', 'src'],
+    //      video: ['autoplay', 'controls', 'loop', 'preload', 'src', 'height', 'width']
         },
         stripIgnoreTagBody: true
       },
diff --git a/frontend/src/business/components/xpack b/frontend/src/business/components/xpack
index 4ab83e897b..a598375541 160000
--- a/frontend/src/business/components/xpack
+++ b/frontend/src/business/components/xpack
@@ -1 +1 @@
-Subproject commit 4ab83e897bdbc55729fd7418b6a77e73e39b1df9
+Subproject commit a598375541a45898616db5085fd38c192bd6df4b
diff --git a/frontend/src/common/js/constants.js b/frontend/src/common/js/constants.js
index e2eaf01e39..aa0743c38d 100644
--- a/frontend/src/common/js/constants.js
+++ b/frontend/src/common/js/constants.js
@@ -202,4 +202,4 @@ export const ENV_TYPE = {
   GROUP: "GROUP"
 }
 
-
+export const DEFAULT_XSS_ATTR = ['style', 'class'];