Merge branch 'master' into dev

zjk

2026-07-31 8665daa7aa863f96d0d8f27c167edae1efc38022

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package com.ruoyi.system.utils;
 
public class ProtocolHtmlSanitizerTest
{
    public static void main(String[] args)
    {
        shouldKeepSupportedFormatting();
        shouldRemoveDangerousContentAndAttributes();
    }
 
    private static void shouldKeepSupportedFormatting()
    {
        String html = "<div style=\"text-align: center; position: fixed\">入园承诺</div>\n"
                + "<div><span style=\"font-weight: bold; color: #111827\">第二行</span></div>";
 
        String result = ProtocolHtmlSanitizer.clean(html);
 
        require(result.contains("<div style=\"text-align: center\">入园承诺</div>"), "居中样式未保留");
        require(result.contains("<span style=\"font-weight: bold; color: #111827\">第二行</span>"), "文字样式未保留");
        require(!result.contains("position"), "非白名单样式未清除");
    }
 
    private static void shouldRemoveDangerousContentAndAttributes()
    {
        String html = "<div onclick=\"alert(1)\">正文<script>alert(1)</script>"
                + "<span style=\"background-image: url(javascript:alert(1))\">内容</span></div>";
 
        String result = ProtocolHtmlSanitizer.clean(html);
 
        require(result.contains("<div>正文<span>内容</span></div>"), "安全正文结构未保留");
        require(!result.contains("script"), "危险标签未清除");
        require(!result.contains("onclick"), "事件属性未清除");
        require(!result.contains("javascript"), "危险样式内容未清除");
    }
 
    private static void require(boolean condition, String message)
    {
        if (!condition)
        {
            throw new AssertionError(message);
        }
    }
}