[Bug] Highlighter 组件有 XSS 漏洞

[Carrotzpc]

💻 系统环境 | Operating System

Windows

🌐 浏览器 | Browser

Chrome

🐛 问题描述 | Bug Description

如果 code 中包含 html 标签，而且解析失败的话，走到 catch 里面 html 标签会直接渲染，别问我怎么知道的。。。

lobe-ui/src/hooks/useHighlight.ts

Lines 60 to 62 in 532c5bf

	} catch {
	return `<pre><code>${text}</code></pre>`;
	}

🚦 期望结果 | Expected Behavior

需要在解析失败后对 code 进行转义

📷 复现步骤 | Recurrence Steps

No response

📝 补充信息 | Additional Information

No response

[lobehubbot]

👀 @Carrotzpc
Thank you for raising an issue. We will investigate into the matter and get back to you as soon as possible.
Please make sure you have given us as much context as possible.
非常感谢您提交 issue。我们会尽快调查此事，并尽快回复您。 请确保您已经提供了尽可能多的背景信息。

[lobehubbot]

✅ @Carrotzpc


This issue is closed, If you have any questions, you can comment and reply.
此问题已经关闭。如果您有任何问题，可以留言并回复。