fix: 修复 WYSIWYG 清空内容 + 分屏工具栏 + XSS 防御(bulemondy消毒)

internal/controller/post_controller.go

@@ -1,6 +1,7 @@
 package controller
 
 import (
+	"html/template"
 	"net/http"
 	"strconv"
 
@@ -102,10 +103,11 @@ func (ctrl *PostController) ShowPage(c *gin.Context) {
 	}
 
 	c.HTML(http.StatusOK, "posts/show.html", common.BuildPageData(c, gin.H{
-		"Title":    post.Title,
-		"Post":     post,
-		"UID":      uid,
-		"ExtraCSS": "/static/css/posts.css",
+		"Title":        post.Title,
+		"Post":         post,
+		"PostBodyHTML": template.HTML(post.BodyHTML),
+		"UID":          uid,
+		"ExtraCSS":     "/static/css/posts.css",
 	}))
 }
 

internal/service/post_service.go

@@ -8,9 +8,14 @@ import (
 	"metazone.cc/metalab/internal/config"
 	"metazone.cc/metalab/internal/model"
 
+	"github.com/microcosm-cc/bluemonday"
 	"github.com/yuin/goldmark"
 )
 
+// ucgPolicy 对 Goldmark 输出的 HTML 做安全消毒
+// 移除 script / iframe / javscript: / data: 等危险内容
+var ucgPolicy = bluemonday.UGCPolicy()
+
 // postStore 帖子服务所需的最小仓储接口（ISP）
 type postStore interface {
 	Create(post *model.Post) error
@@ -44,13 +49,13 @@ func (s *PostService) auditEnabled() bool {
 	return s.ss.IsAuditEnabled()
 }
 
-// renderMarkdown 将 Markdown 渲染为 HTML
+// renderMarkdown 将 Markdown 渲染为安全 HTML（Goldmark + bluemonday 消毒）
 func (s *PostService) renderMarkdown(body string) (string, error) {
 	var buf bytes.Buffer
 	if err := s.md.Convert([]byte(body), &buf); err != nil {
 		return "", err
 	}
-	return buf.String(), nil
+	return ucgPolicy.Sanitize(buf.String()), nil
 }
 
 // Create 创建帖子