Skip to content

Commit

Permalink
Merge pull request #1407 from luofann/fix_test_0923
Browse files Browse the repository at this point in the history
fix: tooltips组件XSS问题统一处理
  • Loading branch information
luofann authored Sep 24, 2024
2 parents f547d65 + e9d789c commit a305790
Show file tree
Hide file tree
Showing 36 changed files with 59 additions and 42 deletions.
1 change: 1 addition & 0 deletions docs/RELEASE.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
【修复】公共API文件导出实现方式修改
【修复】修复单据列表在非首页搜索报错的问题
【修复】任务模板编辑点击上一步返回路径优化
【修复】tooltips组件XSS问题修复

## [Version: 2.6.30] - 2024-08-15
【修复】项目初始化时登录后重定向url异常修复
Expand Down
1 change: 1 addition & 0 deletions docs/RELEASE_EN.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
【Fixed】Modified the implementation method for exporting common API files.
【Fixed】Fixed the issue where searching on the document list in non-home pages resulted in an error.
【Fixed】Optimized the return path when clicking ‘Previous’ during task template editing.
【Fixed】Fixed XSS vulnerability in tooltips component.

## [Version: 2.6.30] - 2024-08-15
【Fixed】Fixed the URL Redirection Issue after Login during Project Initialization
Expand Down
4 changes: 2 additions & 2 deletions frontend/pc/src/components/renderview/tags/TagText.vue
Original file line number Diff line number Diff line change
Expand Up @@ -27,15 +27,15 @@
<p class="text-block" v-for="(item, index) in value" :key="index">
<label v-if="item.label" class="label">
{{ item.label }}
<i v-if="item.desc || desc" v-bk-tooltips="item.desc || desc" class="bk-itsm-icon icon-itsm-icon-help"></i>
<i v-if="item.desc || desc" v-bk-tooltips="{ content: item.desc || desc, allowHtml: false }" class="bk-itsm-icon icon-itsm-icon-help"></i>
</label>
<span class="value">{{ item.value }}</span>
</p>
</div>
<p v-else>
<label v-if="label" class="label">
{{ label }}
<i v-if="desc" v-bk-tooltips="desc" class="bk-itsm-icon icon-itsm-icon-help"></i>
<i v-if="desc" v-bk-tooltips="{ content: desc, allowHtml: false }" class="bk-itsm-icon icon-itsm-icon-help"></i>
</label>
<span class="value">{{ value }}</span>
</p>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-select searchable
v-model="firstInfo"
:font-size="'medium'"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
<div v-if="item.showFeild && !loading">
<bk-form-item :label="item.name"
:required="item.validate_type === 'REQUIRE'"
:desc="item.tips"
:desc="{ content: item.tips, allowHTML: false }"
:ext-cls="'bk-line-height'"
desc-type="icon">
<bk-checkbox-group :ref="item.key" :value="selects" @change="selected">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<!-- 一级处理人 -->
<div class="bk-form-width">
<bk-select v-model="formData.levelOne"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<p style="color: #c4c6cc;" class="mt5 mb0 f12" slot="tip" v-if="item.type === 'CUSTOM-FORM'">{{$t('m["当前字段为自定义表单"]')}}</p>
<render-view
:form-data="formData"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-table
:data="item.val"
:size="'small'">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-date-picker :class="{ 'bk-border-error': item.checkValue }"
v-model="item.val"
:placeholder="$t(`m.newCommon['选择日期']`)"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-date-picker :class="{ 'bk-border-error': item.checkValue }"
v-model="item.val"
:type="'datetime'"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" style="font-size: 0" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" style="font-size: 0" desc-type="icon">
<rich-text-editor
v-model="item.val"
:full-title="item.name"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<div style="position: relative;">
<div class="bk-form-content" style="position: relative;">
<custom-upload
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-select :class="{ 'bk-border-error': item.checkValue }"
searchable
v-model="item.val"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" class="bk-form-int" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" class="bk-form-int" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-input :class="{ 'bk-border-error': item.checkValue }"
:clearable="true"
type="number"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-input :class="{ 'bk-border-error': item.checkValue }"
v-model="item.val"
:maxlength="120"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild" class="member-field">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :ext-cls="'bk-ext-item'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :ext-cls="'bk-ext-item'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<div @click="item.checkValue = false" class="member-form-item">
<member-select :class="{ 'bk-border-error': item.checkValue }"
v-model="selectedItems"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :ext-cls="'bk-ext-item'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :ext-cls="'bk-ext-item'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<div @click="item.checkValue = false" class="member-form-item">
<member-select :class="{ 'bk-border-error': item.checkValue }"
v-model="selectedItems"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-select :class="{ 'bk-border-error': item.checkValue }"
:disabled="(item.is_readonly && !isCurrent) || disabled"
searchable
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
<div v-if="item.showFeild">
<bk-form-item :label="item.name"
:required="item.validate_type === 'REQUIRE'"
:desc="item.tips"
:desc="{ content: item.tips, allowHTML: false }"
:ext-cls="'bk-line-height'"
desc-type="icon">
<bk-radio-group v-model="item.val" @change="item.checkValue = false">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-select :class="{ 'bk-border-error': item.checkValue }"
searchable
v-model="item.val"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@
</bk-form-item>
<bk-form-item :label="item.name" v-if="item.sopsContent.createWay === 'template'"
:required="item.validate_type === 'REQUIRE'"
:desc="item.tips"
:desc="{ content: item.tips, allowHTML: false }"
:ext-cls="'bk-line-height'"
:property="'id'"
:error-display-type="'normal'">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
<div v-if="item.showFeild">
<bk-form-item :label="item.name"
:required="item.validate_type === 'REQUIRE'"
:desc="item.tips"
:desc="{ content: item.tips, allowHTML: false }"
desc-type="icon">
<bk-input :class="{ 'bk-border-error': item.checkValue }"
v-model="item.val"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-table :data="item.val"
:size="'small'">
<template v-for="title in item.choice">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<bk-input :class="{ 'bk-border-error': item.checkValue }"
:placeholder="item.desc"
:type="'textarea'"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

<template>
<div v-if="item.showFeild">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="item.tips" desc-type="icon">
<bk-form-item :label="item.name" :required="item.validate_type === 'REQUIRE'" :desc="{ content: item.tips, allowHTML: false }" desc-type="icon">
<div class="bk-search-tree bk-form-width"
:class="{ 'bk-border-error': item.checkValue }"
v-bk-clickoutside="closeTree">
Expand Down
3 changes: 2 additions & 1 deletion frontend/pc/src/views/operation/components/tableChart.vue
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,8 @@
v-bk-tooltips="{
content: props.row.organization_full,
position: 'top',
theme: 'light'
theme: 'light',
allowHTML: false
}">
{{ props.row.organization }}
</span>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -385,6 +385,7 @@
disabled: true,
content: '',
placements: ['top'],
allowHTML: false,
},
},
emptyExpression: {
Expand All @@ -401,6 +402,7 @@
disabled: false,
content: this.$t('m.treeinfo[\'请先选择条件\']'),
placements: ['top'],
allowHTML: false,
},
},
isShowSignSwitch: false,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -339,7 +339,7 @@
@change="$emit('change')">
</textarea>
<p class="bk-label-tips">
<span v-bk-tooltips.top="(formInfo.tips || $t(`m.treeinfo['字段释疑填填看哦']`))">
<span v-bk-tooltips.top="{ content: (formInfo.tips || $t(`m.treeinfo['字段释疑填填看哦']`)), allowHTML: false }">
{{ $t('m.treeinfo["效果预览"]') }}
</span>
</p>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -58,15 +58,15 @@
</bk-form-item>
</bk-form>
</basic-card>

<basic-card class="mt20" :card-label="$t(`m.treeinfo['字段配置']`)">
<field-config
ref="field"
:flow-info="flowInfo"
:configur="configur">
</field-config>
</basic-card>

<basic-card
class="mt20"
v-bkloading="{ isLoading: getConditionFlag }"
Expand Down Expand Up @@ -263,6 +263,7 @@
disabled: true,
content: '',
placements: ['top'],
allowHTML: false,
},
},
emptyExpression: {
Expand All @@ -279,6 +280,7 @@
disabled: false,
content: this.$t('m.treeinfo[\'请先选择条件\']'),
placements: ['top'],
allowHTML: false,
},
},
nodeInfoRule: {
Expand Down Expand Up @@ -347,6 +349,7 @@
disabled: true,
content: '',
placements: ['top'],
allowHTML: false,
};
return { ...expression, tooltipInfo };
});
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
v-bk-tooltips="{
placement: 'auto',
content: node.name,
allowHTML: false,
theme: 'light'
}">
<div v-if="node.type === 'START'" class="startpoint" data-test-id="startNode">
Expand Down
3 changes: 2 additions & 1 deletion frontend/pc/src/views/ticket/details/comment/commentItem.vue
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@
v-if="curComment.update_log.length"
v-bk-tooltips="{
placement: 'top-start',
content: curComment.update_log
content: curComment.update_log,
allowHTML: false
}"
class="edited">
<span>{{ $t('m["已被编辑"]') }}</span>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@
<bk-table-column :label="$t(`m.task['任务名称']`)">
<template slot-scope="props">
<span
v-bk-tooltips.top="props.row.name"
v-bk-tooltips.top="{ content: props.row.name, allowHTML: false }"
class="task-name"
>
{{ props.row.name || "--" }}
Expand All @@ -123,14 +123,14 @@
</bk-table-column>
<bk-table-column :label="$t(`m.task['处理人']`)">
<template slot-scope="props">
<span v-bk-tooltips.top="props.row.processor_users">
<span v-bk-tooltips.top="{ content: props.row.processor_users, allowHTML: false }">
{{ props.row.processor_users || "--" }}
</span>
</template>
</bk-table-column>
<bk-table-column :label="$t(`m.task['任务类型']`)">
<template slot-scope="props">
<span v-bk-tooltips.top="props.row.processor_users">
<span v-bk-tooltips.top="{ content: props.row.processor_users, allowHTML: false }">
{{
getTaskTypeName(props.row.component_type) ||
"--"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
<template v-slot:header="{ item }">
<div class="bk-timeline-user-header">
<span class="bk-inline-block bk-default-width"
v-bk-tooltips.top="item.message">{{ item.message}}</span>
v-bk-tooltips.top="{ content: item.message, allowHTML: false }">{{ item.message}}</span>
<span class="bk-inline-block button" v-if="item.tag !== 'processors'">
<span class="bk-inline-block isOn auto" @click="item.showMore = !item.showMore"
v-if="!item.showMore">{{ $t('m.newCommon["展开"]') }}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34,21 +34,21 @@
</bk-table-column>
<bk-table-column :label="$t(`m.task['任务名称']`)" :render-header="$renderHeader" :show-overflow-tooltip="true">
<template slot-scope="props">
<span v-bk-tooltips.top="props.row.name" class="task-name">
<span v-bk-tooltips.top="{ content: props.row.name, allowHTML: false }" class="task-name">
{{ props.row.name || "--" }}
</span>
</template>
</bk-table-column>
<bk-table-column :label="$t(`m.task['处理人']`)" :render-header="$renderHeader" :show-overflow-tooltip="true">
<template slot-scope="props">
<span v-bk-tooltips.top="props.row.processor_users">{{
<span v-bk-tooltips.top="{ content: props.row.processor_users, allowHTML: false }">{{
props.row.processor_users || "--"
}}</span>
</template>
</bk-table-column>
<bk-table-column :label="$t(`m.task['任务类型']`)" :render-header="$renderHeader" :show-overflow-tooltip="true">
<template slot-scope="props">
<span v-bk-tooltips.top="props.row.processor_users">{{
<span v-bk-tooltips.top="{ content: props.row.processor_users, allowHTML: false }">{{
getTaskTypeName(props.row.component_type) || "--"
}}</span>
</template>
Expand Down
Loading

0 comments on commit a305790

Please sign in to comment.