Update PureSuck_Module.js

fix DOM text reinterpreted as HTML
riceshowerX · Nov 29, 2024 · b829c83 · b829c83
1 parent 82c6a2b
commit b829c83
Showing 1 changed file with 25 additions and 17 deletions.
diff --git a/js/PureSuck_Module.js b/js/PureSuck_Module.js
@@ -58,9 +58,10 @@ class TOC {
 
         elements.each((index, element) => {
             const $element = $(element);
-            $element.attr('id', $element.attr('id') || `heading-${index}`);
+            const sanitizedId = `heading-${index}`.replace(/[^a-zA-Z0-9_-]/g, '');  // 清理 ID
+            $element.attr('id', $element.attr('id') || sanitizedId);
             const li = $('<li>', { class: `li li-${element.tagName[1]}` });
-            li.html(`<a href="#${$element.attr('id')}" id="link-${$element.attr('id')}" class="toc-a">${$element.text()}</a>`);
+            li.text(`${$element.text()}`);  // 使用 text() 方法插入纯文本
             ul.append(li);
         });
 
@@ -173,22 +174,24 @@ class FriendCards {
                     const avatarUrl = $node.attr('ico');
                     const url = $node.attr('url');
 
-                    const newContent = $(`
-                        <a href="${url}" class="friendsboard-item" target="_blank">
-                            <div class="friends-card-header">
-                                <span class="friends-card-username">${friendName}</span>
-                                <span class="friends-card-dot"></span>
-                            </div>
-                            <div class="friends-card-body">
-                                <div class="friends-card-text">${$node.html()}</div>
-                                <div class="friends-card-avatar-container">
-                                    <img src="${avatarUrl}" alt="Avatar" class="friends-card-avatar">
+                    if (this.isValidURL(url)) {
+                        const newContent = $(`
+                            <a href="${url}" class="friendsboard-item" target="_blank">
+                                <div class="friends-card-header">
+                                    <span class="friends-card-username">${friendName}</span>
+                                    <span class="friends-card-dot"></span>
                                 </div>
-                            </div>
-                        </a>
-                    `);
+                                <div class="friends-card-body">
+                                    <div class="friends-card-text">${$node.text()}</div>
+                                    <div class="friends-card-avatar-container">
+                                        <img src="${avatarUrl}" alt="Avatar" class="friends-card-avatar">
+                                    </div>
+                                </div>
+                            </a>
+                        `);
 
-                    friendsBoardList.append(newContent);
+                        friendsBoardList.append(newContent);
+                    }
                 });
 
                 const firstNode = $(group[0]);
@@ -200,6 +203,11 @@ class FriendCards {
             }
         });
     }
+
+    isValidURL(url) {
+        const pattern = new RegExp('^(https?:\\/\\/)?([a-z0-9-]+\\.)+[a-z0-9]{2,4}(\\/[^\\s]*)?$', 'i');
+        return pattern.test(url);
+    }
 }
 
 // 解析可折叠面板
@@ -214,7 +222,7 @@ class CollapsiblePanels {
         elements.each((index, element) => {
             const $element = $(element);
             const title = $element.attr('title');
-            const content = $element.html();
+            const content = $element.text();  // 使用 text() 方法，防止解析 HTML
 
             const newContent = $(`
                 <div class="collapsible-panel">