From 56c1c7f5595aa45b34a1eebe630e0b30872d8480 Mon Sep 17 00:00:00 2001
From: taojinlong <jinlong@fit2cloud.com>
Date: Wed, 12 Jul 2023 23:42:29 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E5=AD=98=E5=82=A8?=
 =?UTF-8?q?=E5=9E=8BXSS=E6=BC=8F=E6=B4=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 frontend/src/views/chart/view/TitleRemark.vue            | 2 +-
 frontend/src/views/dataset/data/components/LazyTree.vue  | 2 +-
 frontend/src/views/dataset/group/GroupMoveSelector.vue   | 2 +-
 frontend/src/views/login/index.vue                       | 2 +-
 frontend/src/views/panel/export/PDFPreExport.vue         | 2 +-
 frontend/src/views/system/user/index.vue                 | 2 +-
 frontend/src/views/wizard/WizardCard.vue                 | 2 +-
 frontend/src/views/wizard/WizardCardEnterprise.vue       | 2 +-
 frontend/src/views/wizard/details/CardDetail.vue         | 2 +-
 frontend/src/views/wizard/details/LatestDevelopments.vue | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/frontend/src/views/chart/view/TitleRemark.vue b/frontend/src/views/chart/view/TitleRemark.vue
index 151bb41d36..2d6beaa0b2 100644
--- a/frontend/src/views/chart/view/TitleRemark.vue
+++ b/frontend/src/views/chart/view/TitleRemark.vue
@@ -10,7 +10,7 @@
       <div
         class="remark-style"
         :style="{backgroundColor:remarkCfg.bgFill}"
-        v-html="remarkCfg.content"
+        v-html="$xss(remarkCfg.content)"
       />
       <i
         slot="reference"
diff --git a/frontend/src/views/dataset/data/components/LazyTree.vue b/frontend/src/views/dataset/data/components/LazyTree.vue
index 42c6a0df6f..6452d83cf7 100644
--- a/frontend/src/views/dataset/data/components/LazyTree.vue
+++ b/frontend/src/views/dataset/data/components/LazyTree.vue
@@ -34,7 +34,7 @@
           <span>
             <span
               style="margin-left: 6px"
-              v-html="data.name"
+              v-html="$xss(data.name)"
             />
           </span>
           <span
diff --git a/frontend/src/views/dataset/group/GroupMoveSelector.vue b/frontend/src/views/dataset/group/GroupMoveSelector.vue
index 83bc0328aa..8a668582b7 100644
--- a/frontend/src/views/dataset/group/GroupMoveSelector.vue
+++ b/frontend/src/views/dataset/group/GroupMoveSelector.vue
@@ -34,7 +34,7 @@
                 text-overflow: ellipsis;
               "
               :title="data.name"
-              v-html="highlights(data.name)"
+              v-html="$xss(highlights(data.name))"
             />
           </span>
         </span>
diff --git a/frontend/src/views/login/index.vue b/frontend/src/views/login/index.vue
index 50df6c744b..75a3db4e5f 100644
--- a/frontend/src/views/login/index.vue
+++ b/frontend/src/views/login/index.vue
@@ -202,7 +202,7 @@
     <div
       v-if="showFoot"
       class="dynamic-login-foot"
-      v-html="footContent"
+      v-html="$xss(footContent)"
     />
   </div>
 </template>
diff --git a/frontend/src/views/panel/export/PDFPreExport.vue b/frontend/src/views/panel/export/PDFPreExport.vue
index 83fc3e37d2..76e0a58f1e 100644
--- a/frontend/src/views/panel/export/PDFPreExport.vue
+++ b/frontend/src/views/panel/export/PDFPreExport.vue
@@ -15,7 +15,7 @@
         <div
           class="export_body_inner_class"
           :style="templateHtmlStyle"
-          v-html="templateContentChange"
+          v-html="$xss(templateContentChange)"
         />
       </div>
     </el-row>
diff --git a/frontend/src/views/system/user/index.vue b/frontend/src/views/system/user/index.vue
index 7afbb41c7e..ca726d34c8 100644
--- a/frontend/src/views/system/user/index.vue
+++ b/frontend/src/views/system/user/index.vue
@@ -202,7 +202,7 @@
               <!-- // {{}}会将数据解释为普通文本，而非 HTML 代码。 -->
               <div
                 slot="content"
-                v-html="filterRoles(scope.row.roles)"
+                v-html="$xss(filterRoles(scope.row.roles))"
               />
               <div class="de-one-line">{{ filterRoles(scope.row.roles) }}</div>
             </el-tooltip>
diff --git a/frontend/src/views/wizard/WizardCard.vue b/frontend/src/views/wizard/WizardCard.vue
index ca795e4dd6..d124a4e225 100644
--- a/frontend/src/views/wizard/WizardCard.vue
+++ b/frontend/src/views/wizard/WizardCard.vue
@@ -9,7 +9,7 @@
         {{ details.head }}
       </el-row>
       <el-row class="card_content">
-        <span v-html="details.content" />
+        <span v-html="$xss(details.content)" />
       </el-row>
       <el-row class="card_bottom">
         {{ $t('wizard.click_show') }}
diff --git a/frontend/src/views/wizard/WizardCardEnterprise.vue b/frontend/src/views/wizard/WizardCardEnterprise.vue
index 8f1d344436..9d46cc886b 100644
--- a/frontend/src/views/wizard/WizardCardEnterprise.vue
+++ b/frontend/src/views/wizard/WizardCardEnterprise.vue
@@ -9,7 +9,7 @@
         {{ details.head }}
       </el-row>
       <el-row class="card_content">
-        <span v-html="details.content" />
+        <span v-html="$xss(details.content)" />
       </el-row>
       <el-row class="card_bottom">
         {{ $t('wizard.apply') }}
diff --git a/frontend/src/views/wizard/details/CardDetail.vue b/frontend/src/views/wizard/details/CardDetail.vue
index 7699033021..f725d31833 100644
--- a/frontend/src/views/wizard/details/CardDetail.vue
+++ b/frontend/src/views/wizard/details/CardDetail.vue
@@ -18,7 +18,7 @@
         <span>{{ details.head }}</span>
       </el-row>
       <el-row class="content">
-        <span v-html="details.content" />
+        <span v-html="$xss(details.content)" />
       </el-row>
       <el-row class="bottom">
         <span class="span-box">{{ details.bottom }}</span>
diff --git a/frontend/src/views/wizard/details/LatestDevelopments.vue b/frontend/src/views/wizard/details/LatestDevelopments.vue
index 8873f51aa0..7d656d00b6 100644
--- a/frontend/src/views/wizard/details/LatestDevelopments.vue
+++ b/frontend/src/views/wizard/details/LatestDevelopments.vue
@@ -18,7 +18,7 @@
         <span>{{ details.head }}</span>
       </el-row>
       <el-row class="content">
-        <span v-html="details.content" />
+        <span v-html="$xss(details.content)" />
       </el-row>
       <el-row class="bottom">
         <span class="span-box">{{ details.bottom }}</span>