diff --git a/internal/middleware/security.go b/internal/middleware/security.go index 34204ce..41685fb 100644 --- a/internal/middleware/security.go +++ b/internal/middleware/security.go @@ -9,14 +9,14 @@ import ( func SecurityHeaders() gin.HandlerFunc { return func(c *gin.Context) { // Content-Security-Policy - // script-src: 本站 + esm.sh CDN (Tiptap ESM 模块) - // style-src: 本站 + esm.sh (Tiptap CSS) + // script-src: 本站 + esm.sh CDN (Tiptap ESM 模块) + cdnjs (highlight.js) + // style-src: 本站 + esm.sh (Tiptap CSS) + cdnjs (highlight.js 主题) // connect-src: 本站 + esm.sh (source map 请求) // img-src: 本站 + data: URI (头像裁切) + blob: (粘贴图片) c.Header("Content-Security-Policy", "default-src 'self'; "+ - "script-src 'self' 'unsafe-inline' https://esm.sh; "+ - "style-src 'self' 'unsafe-inline' https://esm.sh; "+ + "script-src 'self' 'unsafe-inline' https://esm.sh https://cdnjs.cloudflare.com; "+ + "style-src 'self' 'unsafe-inline' https://esm.sh https://cdnjs.cloudflare.com; "+ "img-src 'self' data: blob:; "+ "connect-src 'self' https://esm.sh") diff --git a/internal/service/post_service.go b/internal/service/post_service.go index f396eda..7214ef7 100644 --- a/internal/service/post_service.go +++ b/internal/service/post_service.go @@ -16,10 +16,11 @@ import ( // sanitizePolicy Tiptap 输出 HTML 的消毒策略 // 前端 WYSIWYG 编辑器输出 HTML,由 bluemonday UGC 策略消毒 // 放行 code/pre 的 class/data-language 属性以保留代码高亮和语言标签 -// 放行 span 的 class 属性以保留 highlight.js 的 hljs-* 高亮 +// 放行 span 元素及其 hljs-* class 以保留 highlight.js 语法高亮 // 放行 img 的 src/alt/title 属性以保留图片 var sanitizePolicy = func() *bluemonday.Policy { p := bluemonday.UGCPolicy() + p.AllowElements("span") p.AllowAttrs("class", "data-language").OnElements("code", "pre") p.AllowAttrs("class").Matching(regexp.MustCompile("^hljs-")).OnElements("span") p.AllowAttrs("src", "alt", "title").OnElements("img") diff --git a/templates/MetaLab-2026/html/posts/new.html b/templates/MetaLab-2026/html/posts/new.html index 4664828..5a62938 100644 --- a/templates/MetaLab-2026/html/posts/new.html +++ b/templates/MetaLab-2026/html/posts/new.html @@ -1,184 +1,4 @@ {{template "layout/header.html" .}} -
{{template "layout/nav.html" .}} diff --git a/templates/MetaLab-2026/html/posts/show.html b/templates/MetaLab-2026/html/posts/show.html index 248a427..02361e8 100644 --- a/templates/MetaLab-2026/html/posts/show.html +++ b/templates/MetaLab-2026/html/posts/show.html @@ -1,4 +1,5 @@ {{template "layout/header.html" .}} + {{template "layout/nav.html" .}} @@ -45,18 +46,34 @@ {{template "layout/footer.html" .}} +