14 lines
712 B
JavaScript
14 lines
712 B
JavaScript
// 可独立测试的预览内容安全策略。HTML 预览只允许文件内的静态样式和内嵌媒体，
|
|
// 不允许脚本、表单提交、外部资源请求或 base URL 改写。
|
|
export const HTML_PREVIEW_CSP = "default-src 'none'; img-src data: blob:; media-src data: blob:; " +
|
|
"font-src data:; style-src 'unsafe-inline'; form-action 'none'; base-uri 'none'";
|
|
|
|
export function htmlPreviewDocument(text) {
|
|
const meta = `<meta http-equiv="Content-Security-Policy" content="${HTML_PREVIEW_CSP}">`;
|
|
const source = String(text || "");
|
|
if (/<head(?:\s[^>]*)?>/i.test(source)) {
|
|
return source.replace(/<head(?:\s[^>]*)?>/i, (head) => head + meta);
|
|
}
|
|
return `<head>${meta}</head>${source}`;
|
|
}
|