docs: add XSS whitelist configuration FAQ #3148
Conversation
WalkthroughA new section has been added to the FAQ documentation that explains how to configure an XSS whitelist using the Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Doc as Documentation
participant Util as @opentiny/utils
Dev->>Doc: Read XSS whitelist configuration section
Doc-->>Dev: Display setXssOption usage example
Dev->>Util: Call setXssOption(options)
Util-->>Dev: Return configured XSS options
Possibly related PRs
Suggested reviewers
Poem
Tip ⚡🧪 Multi-step agentic review comment chat (experimental)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
WalkthroughThis pull request adds a new FAQ section to the documentation, detailing how to configure an XSS whitelist using Changes
|
![petercat-assistant[bot]](https://avatars.githubusercontent.com/in/875736?s=60&v=4){kind=small}
| html: { | ||
| whiteList: { | ||
| a: ['class', 'style', 'contenteditable', 'data-id', 'data-title', 'data-size', 'href', 'data-last-modified'], | ||
| img: ['class', 'style', 'devui-editorx-image', 'style', 'data-image-id', 'src'] |
There was a problem hiding this comment.
The style attribute is listed twice for the img tag in the XSS whitelist configuration. This redundancy should be removed to avoid confusion.
|
[e2e-test-warn] The title of the Pull request should look like "fix(vue-renderless): [action-menu, alert] fix xxx bug". Please make sure you've read our contributing guide |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
examples/sites/demos/pc/webdoc/faq.md (1)
88-113: Enhance FAQ Clarity and Remove Duplicate AttributeThe new section on configuring an XSS whitelist is clear and helpful. The code example demonstrates how to use
setXssOptionfrom@opentiny/utilseffectively. One minor nitpick: in the whitelist for theimgtag, the attribute"style"appears twice. Consider removing the duplicate entry to avoid confusion. Additionally, you might add a reference or link to the officialJS-XSSdocumentation for users seeking further details.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
examples/sites/demos/pc/webdoc/faq.md (1)
101-102: 🛠️ Refactor suggestionRemove Duplicate 'style' Attribute in the Whitelist
The configuration for the
imgtag currently lists thestyleattribute twice. This redundancy could cause confusion. Please remove the duplicate entry. For example:- img: ['class', 'style', 'style', 'data-image-id', 'src'] + img: ['class', 'style', 'data-image-id', 'src']
🧹 Nitpick comments (1)
examples/sites/demos/pc/webdoc/faq.md (1)
88-108: Enhance FAQ Clarity on XSS Whitelist ConfigurationThe new section is a valuable addition and clearly explains how to configure an XSS whitelist using the
@opentiny/utilspackage (supported from v3.21.0). For further clarity, consider adding a brief explanation of when and why developers might need to manually adjust the whitelist for particular rich text scenarios.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
examples/sites/demos/pc/webdoc/faq.md (1)
88-112: XSS Whitelist FAQ Section: Clarity and Security ConsiderationThe new section on configuring the XSS whitelist using
@opentiny/utilsis clear and well-structured. The code example effectively demonstrates how to set custom XSS options and the accompanying explanation is concise. One minor suggestion:
- Consider adding a brief note on security implications: Enabling attributes like
stylecan sometimes introduce risks if unexpected CSS or inline style vulnerabilities are exploited. A short note or warning may help ensure developers are making an informed choice when customizing the whitelist.Overall, the changes directly address the PR objective, and the documentation update enhances clarity regarding XSS configuration.
添加配置xss白名单FAQ
PR
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
Issue Number: N/A
What is the new behavior?
Does this PR introduce a breaking change?
Other information
Summary by CodeRabbit
@opentiny/utilspackage, including recommended practices and a code example for setting custom XSS options.