From 583208898fc2c355194fe7ddca3bfa0c285ab4fa Mon Sep 17 00:00:00 2001 From: kl Date: Fri, 14 Aug 2026 11:12:50 +0800 Subject: [PATCH] fix: sandbox HTML preview execution --- server/src/main/config/application.properties | 4 +- server/src/main/config/test.properties | 6 +- server/src/main/resources/web/code.ftl | 87 ++++++++++--------- .../keking/web/HtmlPreviewSandboxTests.java | 38 ++++++++ 4 files changed, 87 insertions(+), 48 deletions(-) create mode 100644 server/src/test/java/cn/keking/web/HtmlPreviewSandboxTests.java diff --git a/server/src/main/config/application.properties b/server/src/main/config/application.properties index 4986e7be..eda3b4b6 100644 --- a/server/src/main/config/application.properties +++ b/server/src/main/config/application.properties @@ -469,8 +469,8 @@ kk.xlsxshowtoolbar = false # 首页是否显示key密钥 默认为false（禁用） kk.isshowkey = false -# 预览html文件 是否启用JavaScript 默认为true（启用） -kk.scriptjs = true +# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用） +kk.scriptjs = false ############################################################################### diff --git a/server/src/main/config/test.properties b/server/src/main/config/test.properties index eb79f232..1d469df3 100644 --- a/server/src/main/config/test.properties +++ b/server/src/main/config/test.properties @@ -466,8 +466,8 @@ kk.xlsxshowtoolbar = true # 首页是否显示key密钥 默认为false（禁用） kk.isshowkey = true -# 预览html文件 是否启用JavaScript 默认为true（启用） -kk.scriptjs = true +# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用） +kk.scriptjs = false ############################################################################### @@ -475,4 +475,4 @@ kk.scriptjs = true ############################################################################### # 纯文本文件类型，直接显示 -simText = ${KK_SIMTEXT:txt,html,htm,asp,jsp,xml,json,properties,md,gitignore,log,java,py,c,cpp,sql,sh,bat,m,bas,prg,cmd} \ No newline at end of file +simText = ${KK_SIMTEXT:txt,html,htm,asp,jsp,xml,json,properties,md,gitignore,log,java,py,c,cpp,sql,sh,bat,m,bas,prg,cmd} diff --git a/server/src/main/resources/web/code.ftl b/server/src/main/resources/web/code.ftl index 00e475a2..a6912e86 100644 --- a/server/src/main/resources/web/code.ftl +++ b/server/src/main/resources/web/code.ftl @@ -16,6 +16,22 @@ + @@ -25,7 +41,7 @@

- + ${file.name} @@ -39,58 +55,43 @@ - \ No newline at end of file + diff --git a/server/src/test/java/cn/keking/web/HtmlPreviewSandboxTests.java b/server/src/test/java/cn/keking/web/HtmlPreviewSandboxTests.java new file mode 100644 index 00000000..7363e657 --- /dev/null +++ b/server/src/test/java/cn/keking/web/HtmlPreviewSandboxTests.java @@ -0,0 +1,38 @@ +package cn.keking.web; + +import org.junit.jupiter.api.Test; +import org.springframework.core.io.ClassPathResource; + +import java.io.IOException; +import java.nio.charset.StandardCharsets; + +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertTrue; + +class HtmlPreviewSandboxTests { + + @Test + void shouldRenderHtmlOnlyInsideAnOpaqueOriginSandbox() throws IOException { + String template = readResource("web/code.ftl"); + + assertTrue(template.contains("frame.setAttribute(\"sandbox\", scriptjs ? \"allow-scripts\" : \"\")")); + assertTrue(template.contains("frame.srcdoc = decodePreviewText()")); + assertFalse(template.contains("allow-same-origin")); + assertFalse(template.contains("$('#text').html(textData)")); + assertFalse(template.contains("function htmlttt")); + } + + @Test + void shouldDisplaySourceAsTextAndDisableScriptsByDefault() throws IOException { + String template = readResource("web/code.ftl"); + String properties = readResource("application.properties"); + + assertTrue(template.contains("source.textContent = decodePreviewText()")); + assertTrue(properties.contains("kk.scriptjs = false")); + } + + private String readResource(String path) throws IOException { + ClassPathResource resource = new ClassPathResource(path); + return new String(resource.getInputStream().readAllBytes(), StandardCharsets.UTF_8); + } +}