feat: 完善内容管理通用富文本编辑器

tests/rich-text.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { sanitizeRichText } from '../server/utils/rich-text'
+
+describe('sanitizeRichText', () => {
+  it('keeps supported article formatting', () => {
+    const html = '<h2 style="text-align:center">标题</h2><p><strong>重点</strong><span style="font-size:20px;color:#17364e">正文</span></p>'
+    expect(sanitizeRichText(html)).toBe(html)
+  })
+
+  it('removes scripts, event handlers and unsafe links', () => {
+    const html = '<p onclick="alert(1)">正文<script>alert(1)</script><a href="javascript:alert(1)">危险链接</a></p>'
+    const cleaned = sanitizeRichText(html)
+    expect(cleaned).not.toContain('script')
+    expect(cleaned).not.toContain('onclick')
+    expect(cleaned).not.toContain('javascript:')
+  })
+
+  it('adds isolation attributes to new-window links', () => {
+    expect(sanitizeRichText('<a href="https://example.com" target="_blank">示例</a>'))
+      .toContain('rel="noopener noreferrer"')
+  })
+})