BRAND NEWS
{{ article.title }}
{{ article.publishedAt }} · {{ article.sourceName }}
{{ article.summary }}
-
+
正文
-
+
正文
-
+
简介
当前分类暂无内容，点击“新建内容”开始编辑。
diff --git a/app/pages/admin/index.vue b/app/pages/admin/index.vue
index a19c4a3..f424ba5 100644
--- a/app/pages/admin/index.vue
+++ b/app/pages/admin/index.vue
@@ -10,7 +10,6 @@ import { apiErrorMessage } from '~/composables/useUnsavedChanges'
import type { SiteDocument } from '../../../server/utils/site-schema'
definePageMeta({ layout: false })
-useHead(() => ({ title: `首页管理｜${document.value?.brand.name || '慧遇书院'}` }))
const loading = ref(true)
const saving = ref(false)
@@ -20,6 +19,7 @@ const document = ref
diff --git a/app/pages/news/[slug].vue b/app/pages/news/[slug].vue
index 19b1053..c692515 100644
--- a/app/pages/news/[slug].vue
+++ b/app/pages/news/[slug].vue
@@ -6,4 +6,4 @@ if (!article.value) throw createError({ statusCode: 404, statusMessage: '未找
useSeoMeta({ title: () => `${article.value!.title}｜${site.value.brand.name}`, description: () => article.value!.summary, ogTitle: () => article.value!.title, ogDescription: () => article.value!.summary, ogImage: () => absoluteUrl(article.value!.cover), articlePublishedTime: () => article.value!.publishedAt })
useHead(() => ({ script: [{ type: 'application/ld+json', textContent: JSON.stringify({ '@context': 'https://schema.org', '@type': 'Article', headline: article.value!.title, description: article.value!.summary, datePublished: article.value!.publishedAt, image: absoluteUrl(article.value!.cover), publisher: { '@type': 'Organization', name: site.value.brand.companyName, logo: { '@type': 'ImageObject', url: absoluteUrl(site.value.brand.logo) } } }) }] }))
-← 返回品牌动态 ![]()
← 返回品牌动态 ![]()
← 返回课程与产品 ![]()
← 返回课程与产品 ![]()
← 返回官方声明 ← 返回官方声明 ![]()
![]()
+ if (document.hero?.backgroundImage === '/images/hero-bg-v1.png') {
+ document.hero.backgroundImage = '/images/hero-bg-v3.webp'
+ }
if (Array.isArray(document.products)) {
document.products = document.products.map((product: Record, index: number) => {
const fallback = defaultSiteDocument.products[index]
@@ -102,7 +106,7 @@ function normalizeLegacyDocument(input: unknown) {
subtitle: product.subtitle || '',
type: product.type || fallback?.type || 'course',
summary: product.summary || fallback?.summary || '',
- content: product.content || fallback?.content || '',
+ content: sanitizeRichText(product.content || fallback?.content || ''),
image: product.image || fallback?.image || '/images/hero-bg-v3.webp',
href: product.href || `/products/${slug}`,
status: product.status || 'published',
@@ -110,7 +114,15 @@ function normalizeLegacyDocument(input: unknown) {
})
}
document.articles ??= structuredClone(defaultSiteDocument.articles)
+ document.articles = document.articles.map((article: Record) => ({
+ ...article,
+ content: sanitizeRichText(article.content || ''),
+ }))
document.team ??= structuredClone(defaultSiteDocument.team)
+ document.team = document.team.map((member: Record) => ({
+ ...member,
+ summary: sanitizeRichText(member.summary || ''),
+ }))
document.channels ??= structuredClone(defaultSiteDocument.channels)
document.legal ??= structuredClone(defaultSiteDocument.legal)
document.brand = { ...defaultSiteDocument.brand, ...(document.brand || {}) }
diff --git a/server/utils/rich-text.ts b/server/utils/rich-text.ts
new file mode 100644
index 0000000..4d06279
--- /dev/null
+++ b/server/utils/rich-text.ts
@@ -0,0 +1,36 @@
+import sanitizeHtml from 'sanitize-html'
+
+const allowedFontFamilies = /^(?:Noto Serif SC|Source Han Serif SC|Songti SC|SimSun|Noto Sans SC|Source Han Sans SC|PingFang SC|Microsoft YaHei|Arial|sans-serif|serif)(?:,\s*(?:serif|sans-serif))?$/
+
+export function sanitizeRichText(value: string) {
+ if (!value) return ''
+
+ return sanitizeHtml(value, {
+ allowedTags: ['p', 'h2', 'h3', 'ul', 'ol', 'li', 'blockquote', 'strong', 'em', 'u', 's', 'a', 'br', 'hr', 'span'],
+ allowedAttributes: {
+ a: ['href', 'target', 'rel'],
+ '*': ['style'],
+ },
+ allowedSchemes: ['http', 'https', 'mailto', 'tel'],
+ allowProtocolRelative: false,
+ allowedStyles: {
+ '*': {
+ color: [/^#[0-9a-f]{6}$/i],
+ 'background-color': [/^#[0-9a-f]{6}$/i],
+ 'font-family': [allowedFontFamilies],
+ 'font-size': [/^(?:14|16|18|20|24|28|32)px$/],
+ 'line-height': [/^(?:1\.5|1\.75|2|2\.25)$/],
+ 'text-align': [/^(?:left|center|right|justify)$/],
+ },
+ },
+ transformTags: {
+ a: (tagName, attributes) => ({
+ tagName,
+ attribs: {
+ ...attributes,
+ ...(attributes.target === '_blank' ? { rel: 'noopener noreferrer' } : {}),
+ },
+ }),
+ },
+ })
+}
diff --git a/server/utils/site-schema.ts b/server/utils/site-schema.ts
index e12edde..d8f00df 100644
--- a/server/utils/site-schema.ts
+++ b/server/utils/site-schema.ts
@@ -15,7 +15,7 @@ const productSchema = z.object({
subtitle: z.string().max(80),
type: z.enum(['course', 'service', 'tool']).default('course'),
summary: z.string().max(300).default(''),
- content: z.string().max(6000).default(''),
+ content: z.string().max(30000).default(''),
image: localOrHttpUrl,
href: localOrHttpUrl,
status: z.enum(['draft', 'published', 'offline']).default('draft'),
@@ -26,7 +26,7 @@ const articleSchema = z.object({
type: z.enum(['news', 'statement', 'media']),
title: z.string().min(1).max(120),
summary: z.string().max(300),
- content: z.string().max(12000),
+ content: z.string().max(50000),
cover: localOrHttpUrl,
publishedAt: z.string().max(40),
status: z.enum(['draft', 'published', 'offline']),
diff --git a/tests/rich-text.test.ts b/tests/rich-text.test.ts
new file mode 100644
index 0000000..77af2a6
--- /dev/null
+++ b/tests/rich-text.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { sanitizeRichText } from '../server/utils/rich-text'
+
+describe('sanitizeRichText', () => {
+ it('keeps supported article formatting', () => {
+ const html = '
BRAND NEWS
{{ article.title }}
{{ article.publishedAt }} · {{ article.sourceName }}
{{ product.type === 'tool' ? 'TECH PRODUCT' : 'COURSE' }}
{{ product.title }}
{{ product.subtitle }}
{{ product.type === 'tool' ? 'TECH PRODUCT' : 'COURSE' }}
{{ product.title }}
{{ product.subtitle }}
OFFICIAL STATEMENT
{{ article.statementNo }}{{ article.title }}
{{ article.publishedAt }}
{{ article.summary }}
{{ article.content }}
OFFICIAL STATEMENT
{{ article.statementNo }}{{ article.title }}
{{ article.publishedAt }}
{{ article.summary }}
COMPANION TEAM
陪伴团队
以专业、温暖和清晰的协作，为每一段成长提供支持。
{{ member.name }}
{{ member.role }}
{{ member.summary }}
COMPANION TEAM
陪伴团队
以专业、温暖和清晰的协作，为每一段成长提供支持。
{{ member.name }}
{{ member.role }}
${escapeRichText(paragraph).replaceAll('\n', '
')}
标题
重点正文
' + expect(sanitizeRichText(html)).toBe(html) + }) + + it('removes scripts, event handlers and unsafe links', () => { + const html = '正文危险链接
' + const cleaned = sanitizeRichText(html) + expect(cleaned).not.toContain('script') + expect(cleaned).not.toContain('onclick') + expect(cleaned).not.toContain('javascript:') + }) + + it('adds isolation attributes to new-window links', () => { + expect(sanitizeRichText('示例')) + .toContain('rel="noopener noreferrer"') + }) +})