fix: 修复代码块语法高亮丢失 + 语言标签注入 + 安全性增强

- 新增 cdnjs.cloudflare.com CSP 白名单,允许加载 highlight.js
- 消毒策略放行 span 元素,保留 highlight.js 高亮 class
- 详情页和新帖子页引入 highlight.js 库和 GitHub 主题
- 代码块语言选择器默认 text,支持 prev/next 循环切换语言
- 代码块语言标签注入兼容 data-language 和 code class 双来源
- 修复 utils.js defer 导致 common.js 执行时 getCSRFToken 未定义
This commit is contained in:
2026-05-28 15:21:44 +08:00
parent 91f2cbebc1
commit fe81c879b0
6 changed files with 305 additions and 348 deletions

View File

@ -9,14 +9,14 @@ import (
func SecurityHeaders() gin.HandlerFunc {
return func(c *gin.Context) {
// Content-Security-Policy
// script-src: 本站 + esm.sh CDN (Tiptap ESM 模块)
// style-src: 本站 + esm.sh (Tiptap CSS)
// script-src: 本站 + esm.sh CDN (Tiptap ESM 模块) + cdnjs (highlight.js)
// style-src: 本站 + esm.sh (Tiptap CSS) + cdnjs (highlight.js 主题)
// connect-src: 本站 + esm.sh (source map 请求)
// img-src: 本站 + data: URI (头像裁切) + blob: (粘贴图片)
c.Header("Content-Security-Policy",
"default-src 'self'; "+
"script-src 'self' 'unsafe-inline' https://esm.sh; "+
"style-src 'self' 'unsafe-inline' https://esm.sh; "+
"script-src 'self' 'unsafe-inline' https://esm.sh https://cdnjs.cloudflare.com; "+
"style-src 'self' 'unsafe-inline' https://esm.sh https://cdnjs.cloudflare.com; "+
"img-src 'self' data: blob:; "+
"connect-src 'self' https://esm.sh")

View File

@ -16,10 +16,11 @@ import (
// sanitizePolicy Tiptap 输出 HTML 的消毒策略
// 前端 WYSIWYG 编辑器输出 HTML由 bluemonday UGC 策略消毒
// 放行 code/pre 的 class/data-language 属性以保留代码高亮和语言标签
// 放行 span class 属性以保留 highlight.js 的 hljs-* 高亮
// 放行 span 元素及其 hljs-* class 以保留 highlight.js 语法高亮
// 放行 img 的 src/alt/title 属性以保留图片
var sanitizePolicy = func() *bluemonday.Policy {
p := bluemonday.UGCPolicy()
p.AllowElements("span")
p.AllowAttrs("class", "data-language").OnElements("code", "pre")
p.AllowAttrs("class").Matching(regexp.MustCompile("^hljs-")).OnElements("span")
p.AllowAttrs("src", "alt", "title").OnElements("img")

View File

@ -1,184 +1,4 @@
{{template "layout/header.html" .}}
<style>
/* Tiptap 编辑器容器适配全高布局 */
#editor-container {
flex: 1;
overflow: hidden;
min-height: 0;
background: #fff;
}
/* Tiptap 编辑器核心样式 */
.tiptap {
padding: 16px 24px;
outline: none;
min-height: 100%;
font-size: 15px;
line-height: 1.7;
color: #24292f;
}
/* 段落间距 */
.tiptap p { margin: 0.5em 0; }
/* 标题 */
.tiptap h1 { margin: 1em 0 0.5em; font-size: 2em; font-weight: 700; }
.tiptap h2 { margin: 0.8em 0 0.4em; font-size: 1.5em; font-weight: 700; }
.tiptap h3 { margin: 0.6em 0 0.3em; font-size: 1.17em; font-weight: 700; }
/* 列表 */
.tiptap ul, .tiptap ol { padding-left: 1.5em; margin: 0.5em 0; }
.tiptap li { margin: 0.2em 0; }
.tiptap ul[data-type="taskList"] { list-style: none; padding-left: 0; }
.tiptap ul[data-type="taskList"] li { display: flex; align-items: flex-start; gap: 0.4em; }
.tiptap ul[data-type="taskList"] li > label { flex-shrink: 0; margin-top: 0.15em; }
/* 引用 */
.tiptap blockquote {
border-left: 3px solid #3498db;
padding-left: 1em;
margin: 0.5em 0;
color: #6b7280;
}
/* 代码块 */
.tiptap pre {
background: #1a2332;
color: #e2e8f0;
padding: 12px 16px;
border-radius: 6px;
font-size: 13px;
line-height: 1.5;
overflow-x: auto;
margin: 0.5em 0;
position: relative;
}
.tiptap pre code { background: transparent; padding: 0; color: inherit; font-size: inherit; white-space: pre; display: block; }
.tiptap code {
background: #f3f4f6;
padding: 2px 5px;
border-radius: 4px;
font-size: 0.9em;
font-family: 'SF Mono', 'Menlo', 'Monaco', monospace;
}
/* 代码块语言标签 */
.tiptap pre .code-lang-label {
position: absolute;
top: 0;
left: 0;
right: 0;
padding: 4px 16px;
font-size: 11px;
font-weight: 600;
color: #94a3b8;
background: #2c3e50;
border-radius: 6px 6px 0 0;
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Helvetica Neue', Arial, sans-serif;
pointer-events: none;
z-index: 1;
}
/* highlight.js 语法高亮主题 — 基于 One Dark适配 MetaLab 深蓝背景 */
.tiptap pre code .hljs-keyword,
.tiptap pre code .hljs-selector-tag,
.tiptap pre code .hljs-literal,
.tiptap pre code .hljs-section,
.tiptap pre code .hljs-link { color: #c792ea; }
.tiptap pre code .hljs-string,
.tiptap pre code .hljs-title,
.tiptap pre code .hljs-name,
.tiptap pre code .hljs-type,
.tiptap pre code .hljs-attribute,
.tiptap pre code .hljs-symbol,
.tiptap pre code .hljs-bullet,
.tiptap pre code .hljs-addition,
.tiptap pre code .hljs-variable,
.tiptap pre code .hljs-template-tag,
.tiptap pre code .hljs-template-variable { color: #c3e88d; }
.tiptap pre code .hljs-comment,
.tiptap pre code .hljs-quote,
.tiptap pre code .hljs-deletion,
.tiptap pre code .hljs-meta { color: #676e95; }
.tiptap pre code .hljs-number,
.tiptap pre code .hljs-regexp,
.tiptap pre code .hljs-built_in { color: #f78c6c; }
.tiptap pre code .hljs-function .hljs-title,
.tiptap pre code .hljs-doctag,
.tiptap pre code .hljs-formula { color: #82aaff; }
.tiptap pre code .hljs-tag,
.tiptap pre code .hljs-subst { color: #f07178; }
.tiptap pre code .hljs-emphasis { font-style: italic; }
.tiptap pre code .hljs-strong { font-weight: bold; }
.tiptap pre code .hljs-attr,
.tiptap pre code .hljs-selector-attr,
.tiptap pre code .hljs-selector-class,
.tiptap pre code .hljs-selector-id,
.tiptap pre code .hljs-selector-pseudo { color: #ffcb6b; }
/* 水平线 */
.tiptap hr { border: none; border-top: 1px solid #e5e7eb; margin: 1em 0; }
/* 图片 */
.tiptap img { max-width: 100%; height: auto; border-radius: 6px; }
/* 链接 */
.tiptap a { color: #3498db; text-decoration: underline; }
/* Placeholder */
.tiptap p.is-editor-empty:first-child::before {
content: attr(data-placeholder);
float: left;
color: #c4c4c4;
pointer-events: none;
height: 0;
}
/* 工具栏 */
.editor-toolbar {
display: flex;
gap: 2px;
padding: 6px 12px;
background: #fafafa;
border-bottom: 1px solid #e5e7eb;
flex-shrink: 0;
flex-wrap: wrap;
}
.editor-toolbar button {
display: inline-flex;
align-items: center;
justify-content: center;
width: 32px;
height: 30px;
border: 1px solid transparent;
border-radius: 4px;
background: transparent;
color: #374151;
font-size: 13px;
cursor: pointer;
transition: background 0.15s;
}
.editor-toolbar button:hover { background: #e5e7eb; }
.editor-toolbar button.is-active { background: #1a2332; color: #fff; }
.code-lang-select {
height: 30px;
padding: 0 6px;
border: 1px solid transparent;
border-radius: 4px;
background: transparent;
color: #374151;
font-size: 12px;
cursor: pointer;
font-family: inherit;
outline: none;
}
.code-lang-select:hover { border-color: #e5e7eb; }
.code-lang-select:focus { border-color: #3498db; }
.editor-toolbar .toolbar-divider {
width: 1px;
background: #e5e7eb;
margin: 3px 4px;
}
</style>
<body>
{{template "layout/nav.html" .}}

View File

@ -1,4 +1,5 @@
{{template "layout/header.html" .}}
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.11.0/styles/github-dark.min.css">
<body>
{{template "layout/nav.html" .}}
@ -45,18 +46,34 @@
{{template "layout/footer.html" .}}
<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.11.0/highlight.min.js"></script>
<script src="/static/js/common.js"></script>
<script>
// ---- 代码块语言标签注入 ----
// ---- 代码块语言标签注入 + 语法高亮 ----
(function() {
document.querySelectorAll('.post-detail-body pre').forEach(function(pre) {
// 从 pre 的 data-language 或 code 的 class 中获取语言
var lang = pre.getAttribute('data-language');
if (lang) {
var label = document.createElement('div');
label.className = 'code-lang-label';
label.textContent = lang;
pre.insertBefore(label, pre.firstChild);
pre.style.paddingTop = '32px';
if (!lang) {
var code = pre.querySelector('code');
if (code) {
var match = code.className.match(/language-(\w+)/);
if (match) lang = match[1];
}
}
lang = lang || 'text';
var label = document.createElement('div');
label.className = 'code-lang-label';
label.textContent = lang;
pre.insertBefore(label, pre.firstChild);
pre.style.paddingTop = '32px';
// 语法高亮
var code = pre.querySelector('code');
if (code && lang !== 'text') {
code.classList.add('language-' + lang);
hljs.highlightElement(code);
}
});
})();

View File

@ -125,11 +125,11 @@
color: #2980b9;
}
/* 代码块基础样式 */
/* 代码块基础样式(背景色与 github-dark 主题保持一致) */
.post-detail-body pre {
position: relative;
background: #1a2332;
color: #e2e8f0;
background: #0d1117;
color: #c9d1d9;
padding: 12px 16px;
border-radius: 8px;
overflow-x: auto;
@ -147,8 +147,8 @@
padding: 4px 16px;
font-size: 11px;
font-weight: 600;
color: #94a3b8;
background: #2c3e50;
color: #8b949e;
background: #161b22;
border-radius: 8px 8px 0 0;
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Helvetica Neue', Arial, sans-serif;
pointer-events: none;
@ -171,42 +171,7 @@
font-size: 0.9em;
}
/* highlight.js 语法高亮 — 适配 MetaLab 深蓝背景 */
.post-detail-body pre code .hljs-keyword,
.post-detail-body pre code .hljs-selector-tag,
.post-detail-body pre code .hljs-literal,
.post-detail-body pre code .hljs-section,
.post-detail-body pre code .hljs-link { color: #c792ea; }
.post-detail-body pre code .hljs-string,
.post-detail-body pre code .hljs-title,
.post-detail-body pre code .hljs-name,
.post-detail-body pre code .hljs-type,
.post-detail-body pre code .hljs-attribute,
.post-detail-body pre code .hljs-symbol,
.post-detail-body pre code .hljs-bullet,
.post-detail-body pre code .hljs-addition,
.post-detail-body pre code .hljs-variable,
.post-detail-body pre code .hljs-template-tag,
.post-detail-body pre code .hljs-template-variable { color: #c3e88d; }
.post-detail-body pre code .hljs-comment,
.post-detail-body pre code .hljs-quote,
.post-detail-body pre code .hljs-deletion,
.post-detail-body pre code .hljs-meta { color: #676e95; }
.post-detail-body pre code .hljs-number,
.post-detail-body pre code .hljs-regexp,
.post-detail-body pre code .hljs-built_in { color: #f78c6c; }
.post-detail-body pre code .hljs-function .hljs-title,
.post-detail-body pre code .hljs-doctag,
.post-detail-body pre code .hljs-formula { color: #82aaff; }
.post-detail-body pre code .hljs-tag,
.post-detail-body pre code .hljs-subst { color: #f07178; }
.post-detail-body pre code .hljs-emphasis { font-style: italic; }
.post-detail-body pre code .hljs-strong { font-weight: bold; }
.post-detail-body pre code .hljs-attr,
.post-detail-body pre code .hljs-selector-attr,
.post-detail-body pre code .hljs-selector-class,
.post-detail-body pre code .hljs-selector-id,
.post-detail-body pre code .hljs-selector-pseudo { color: #ffcb6b; }
/* 代码块语法高亮由 highlight.js CDN 主题提供,此处仅保留基础布局 */
.post-detail-body img {
max-width: 100%;
@ -250,103 +215,6 @@
gap: 12px;
}
/* ========== 编辑器布局(全宽) ========== */
.editor-layout {
height: calc(100vh - 56px);
display: flex;
flex-direction: column;
overflow: hidden;
}
.editor-form {
display: flex;
flex-direction: column;
height: 100%;
}
/* ---- 标题区域 ---- */
.editor-header {
padding: 16px 24px 12px;
border-bottom: 1px solid #e5e7eb;
background: #fff;
flex-shrink: 0;
}
.editor-title-input {
width: 100%;
padding: 6px 0;
border: none;
font-size: 26px;
font-weight: 700;
color: #111;
outline: none;
background: transparent;
line-height: 1.4;
}
.editor-title-input::placeholder {
color: #c4c4c4;
}
/* ---- 编辑器主体 ---- */
.editor-main {
flex: 1;
display: flex;
overflow: hidden;
min-height: 0;
}
.editor-pane {
flex: 1;
overflow: hidden;
min-width: 0;
}
/* ---- 状态栏 ---- */
.editor-statusbar {
display: flex;
align-items: center;
gap: 16px;
padding: 6px 20px;
background: #fafafa;
border-top: 1px solid #e5e7eb;
font-size: 12px;
color: #9ca3af;
flex-shrink: 0;
min-height: 34px;
}
.status-item {
white-space: nowrap;
}
.status-spacer {
flex: 1;
}
.status-draft {
color: #059669;
font-weight: 500;
}
.btn-submit {
padding: 5px 18px;
font-size: 13px;
border-radius: 6px;
}
/* ---- 全屏模式 ---- */
.editor-layout.fullscreen {
position: fixed;
top: 0;
left: 0;
right: 0;
bottom: 0;
z-index: 9999;
height: 100vh;
background: #fff;
}
/* ========== 404 ========== */
.error-404 {
text-align: center;
@ -442,3 +310,241 @@
color: #b91c1c;
margin-bottom: 16px;
}
/* ========== 编辑器布局 ========== */
.editor-layout {
height: calc(100vh - 56px);
display: flex;
flex-direction: column;
overflow: hidden;
}
.editor-form {
display: flex;
flex-direction: column;
height: 100%;
}
.editor-header {
padding: 16px 24px 12px;
border-bottom: 1px solid #e5e7eb;
background: #fff;
flex-shrink: 0;
}
.editor-title-input {
width: 100%;
padding: 6px 0;
border: none;
font-size: 26px;
font-weight: 700;
color: #111;
outline: none;
background: transparent;
line-height: 1.4;
}
.editor-title-input::placeholder { color: #c4c4c4; }
.editor-main {
flex: 1;
display: flex;
overflow: hidden;
min-height: 0;
}
.editor-pane {
flex: 1;
overflow: hidden;
min-width: 0;
}
.editor-statusbar {
display: flex;
align-items: center;
gap: 16px;
padding: 6px 20px;
background: #fafafa;
border-top: 1px solid #e5e7eb;
font-size: 12px;
color: #9ca3af;
flex-shrink: 0;
min-height: 34px;
}
.status-item { white-space: nowrap; }
.status-spacer { flex: 1; }
.status-draft { color: #059669; font-weight: 500; }
.btn-submit { padding: 5px 18px; font-size: 13px; border-radius: 6px; }
.editor-layout.fullscreen {
position: fixed;
top: 0; left: 0; right: 0; bottom: 0;
z-index: 9999;
height: 100vh;
background: #fff;
}
/* ========== Tiptap 编辑器容器 ========== */
#editor-container {
flex: 1;
overflow: hidden;
min-height: 0;
background: #fff;
}
.tiptap {
padding: 16px 24px;
outline: none;
min-height: 100%;
font-size: 15px;
line-height: 1.7;
color: #24292f;
}
.tiptap p { margin: 0.5em 0; }
.tiptap h1 { margin: 1em 0 0.5em; font-size: 2em; font-weight: 700; }
.tiptap h2 { margin: 0.8em 0 0.4em; font-size: 1.5em; font-weight: 700; }
.tiptap h3 { margin: 0.6em 0 0.3em; font-size: 1.17em; font-weight: 700; }
.tiptap ul, .tiptap ol { padding-left: 1.5em; margin: 0.5em 0; }
.tiptap li { margin: 0.2em 0; }
.tiptap ul[data-type="taskList"] { list-style: none; padding-left: 0; }
.tiptap ul[data-type="taskList"] li { display: flex; align-items: flex-start; gap: 0.4em; }
.tiptap ul[data-type="taskList"] li > label { flex-shrink: 0; margin-top: 0.15em; }
.tiptap blockquote {
border-left: 3px solid #3498db;
padding-left: 1em;
margin: 0.5em 0;
color: #6b7280;
}
.tiptap pre {
background: #1a2332;
color: #e2e8f0;
padding: 12px 16px;
border-radius: 6px;
font-size: 13px;
line-height: 1.5;
overflow-x: auto;
margin: 0.5em 0;
position: relative;
}
.tiptap pre code { background: transparent; padding: 0; color: inherit; font-size: inherit; white-space: pre; display: block; }
.tiptap code {
background: #f3f4f6;
padding: 2px 5px;
border-radius: 4px;
font-size: 0.9em;
font-family: 'SF Mono', 'Menlo', 'Monaco', monospace;
}
.tiptap pre .code-lang-label {
position: absolute;
top: 0; left: 0; right: 0;
padding: 4px 16px;
font-size: 11px;
font-weight: 600;
color: #94a3b8;
background: #2c3e50;
border-radius: 6px 6px 0 0;
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Helvetica Neue', Arial, sans-serif;
pointer-events: none;
z-index: 1;
}
/* highlight.js One Dark 语法高亮 — 编辑器内 */
.tiptap pre code .hljs-keyword,
.tiptap pre code .hljs-selector-tag,
.tiptap pre code .hljs-literal,
.tiptap pre code .hljs-section,
.tiptap pre code .hljs-link { color: #c792ea; }
.tiptap pre code .hljs-string,
.tiptap pre code .hljs-title,
.tiptap pre code .hljs-name,
.tiptap pre code .hljs-type,
.tiptap pre code .hljs-attribute,
.tiptap pre code .hljs-symbol,
.tiptap pre code .hljs-bullet,
.tiptap pre code .hljs-addition,
.tiptap pre code .hljs-variable,
.tiptap pre code .hljs-template-tag,
.tiptap pre code .hljs-template-variable { color: #c3e88d; }
.tiptap pre code .hljs-comment,
.tiptap pre code .hljs-quote,
.tiptap pre code .hljs-deletion,
.tiptap pre code .hljs-meta { color: #676e95; }
.tiptap pre code .hljs-number,
.tiptap pre code .hljs-regexp,
.tiptap pre code .hljs-built_in { color: #f78c6c; }
.tiptap pre code .hljs-function .hljs-title,
.tiptap pre code .hljs-doctag,
.tiptap pre code .hljs-formula { color: #82aaff; }
.tiptap pre code .hljs-tag,
.tiptap pre code .hljs-subst { color: #f07178; }
.tiptap pre code .hljs-emphasis { font-style: italic; }
.tiptap pre code .hljs-strong { font-weight: bold; }
.tiptap pre code .hljs-attr,
.tiptap pre code .hljs-selector-attr,
.tiptap pre code .hljs-selector-class,
.tiptap pre code .hljs-selector-id,
.tiptap pre code .hljs-selector-pseudo { color: #ffcb6b; }
.tiptap hr { border: none; border-top: 1px solid #e5e7eb; margin: 1em 0; }
.tiptap img { max-width: 100%; height: auto; border-radius: 6px; }
.tiptap a { color: #3498db; text-decoration: underline; }
.tiptap p.is-editor-empty:first-child::before {
content: attr(data-placeholder);
float: left;
color: #c4c4c4;
pointer-events: none;
height: 0;
}
/* ========== 工具栏 ========== */
.editor-toolbar {
display: flex;
gap: 2px;
padding: 6px 12px;
background: #fafafa;
border-bottom: 1px solid #e5e7eb;
flex-shrink: 0;
flex-wrap: wrap;
}
.editor-toolbar button {
display: inline-flex;
align-items: center;
justify-content: center;
width: 32px;
height: 30px;
border: 1px solid transparent;
border-radius: 4px;
background: transparent;
color: #374151;
font-size: 13px;
cursor: pointer;
transition: background 0.15s;
}
.editor-toolbar button:hover { background: #e5e7eb; }
.editor-toolbar button.is-active { background: #1a2332; color: #fff; }
.code-lang-select {
height: 30px;
padding: 0 6px;
border: 1px solid transparent;
border-radius: 4px;
background: transparent;
color: #374151;
font-size: 12px;
cursor: pointer;
font-family: inherit;
outline: none;
}
.code-lang-select:hover { border-color: #e5e7eb; }
.code-lang-select:focus { border-color: #3498db; }
.editor-toolbar .toolbar-divider {
width: 1px;
background: #e5e7eb;
margin: 3px 4px;
}

View File

@ -141,27 +141,34 @@ function setupToolbar() {
// ---- 代码块语言选择器 ----
const langSelect = document.getElementById('codeLangSelect')
if (langSelect) {
// 当光标在代码块内时显示语言选择器,移出时隐藏
// 阻止 select 获取焦点导致编辑器失焦
langSelect.addEventListener('mousedown', (e) => {
e.preventDefault()
// 手动切换选项
const opts = langSelect.options
let nextIdx = langSelect.selectedIndex + 1
if (nextIdx >= opts.length) nextIdx = 0
langSelect.selectedIndex = nextIdx
const lang = opts[nextIdx].value
// 在编辑器内更新代码块语言属性
editor.chain().focus().updateAttributes('codeBlock', { language: lang === 'text' ? null : lang }).run()
})
// 当光标在代码块内时显示语言选择器并同步当前语言,移出时隐藏
editor.on('selectionUpdate', () => {
if (editor.isActive('codeBlock')) {
langSelect.style.display = ''
const attrs = editor.getAttributes('codeBlock')
langSelect.value = attrs.language || ''
langSelect.value = attrs.language || 'text'
} else {
langSelect.style.display = 'none'
}
})
// 语言切换
langSelect.addEventListener('change', () => {
const lang = langSelect.value
editor.chain().focus().updateAttributes('codeBlock', { language: lang || null }).run()
editor.commands.focus()
})
}
// ---- 代码块语言标签注入 ----
// 为每个 <pre> 注入语言标签 DOM 元素(因为 CSS ::before 在 overflow:auto 容器中不可靠)
// Tiptap CodeBlockLowlight 在 pre 上输出 data-language 属性,同时 code 上有 language-xxx class
function injectCodeLangLabels() {
const editorEl = document.querySelector('#editor-container .tiptap')
if (!editorEl) return
@ -170,16 +177,22 @@ function setupToolbar() {
const old = pre.querySelector('.code-lang-label')
if (old) old.remove()
const lang = pre.getAttribute('data-language')
if (lang) {
const label = document.createElement('div')
label.className = 'code-lang-label'
label.textContent = lang
pre.insertBefore(label, pre.firstChild)
pre.style.paddingTop = '32px'
} else {
pre.style.paddingTop = ''
// 从 pre 的 data-language 或 code 的 class 中获取语言
let lang = pre.getAttribute('data-language')
if (!lang) {
const code = pre.querySelector('code')
if (code) {
const match = code.className.match(/language-(\w+)/)
if (match) lang = match[1]
}
}
lang = lang || 'text'
const label = document.createElement('div')
label.className = 'code-lang-label'
label.textContent = lang
pre.insertBefore(label, pre.firstChild)
pre.style.paddingTop = '32px'
})
}