Skip to content

fix: prevent HTML injection in Live2D messages - #88

Open
LIlGG wants to merge 1 commit into
mainfrom
feat/safe-tip-rendering
Open

LIlGG wants to merge 1 commit into
mainfrom
feat/safe-tip-rendering

Conversation

@LIlGG

@LIlGG LIlGG commented Oct 13, 2026 •

Copy link
Copy Markdown
Owner

What this PR does / why we need it:

页面标题、选择器提示中的 {text}、一言内容及来源/作者此前直接进入提示语 HTML,可能创建 iframe 等活动元素。现在复用 markdown-it 转义动态文本,并使用 DOMPurify 过滤普通提示语,保留基础排版。AI Markdown 渲染保持现有行为。

自定义普通提示语不再支持嵌入内容、事件和样式属性,支持的排版标签已在 README 中说明。{text} 会替换全部占位符,并保持 $& 等文字原样显示。

Which issue(s) this PR fixes:

Fixes #86

Does this PR introduce a user-facing change?

修复看板娘提示语将页面标题等文本当作 HTML 渲染的问题,并过滤不安全的标签和属性。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

看板娘发消息不带转义的QAQ

1 participant