imzbf / md-editor-v3

Markdown editor for vue3, developed in jsx and typescript, dark theme、beautify content by prettier、render articles directly、paste or clip the picture and upload it...
https://imzbf.github.io/md-editor-v3
MIT License
1.49k stars 143 forks source link

插入`<img>`元素,渲染之后没有了具体的 src 属性 #582

Closed yoyocraft closed 2 months ago

yoyocraft commented 2 months ago

Describe the issue

版本信息:

具体代码: src/components/MyMdEditorPreview.vue:

<template>
    <MdPreview :editorId="id" :modelValue="text" />
    <MdCatalog :editorId="id" :scrollElement="scrollElement" />
</template>

<script setup>
import { ref } from 'vue';
import { MdPreview, MdCatalog } from 'md-editor-v3';

const id = 'preview-only';
const text = ref('<a href="static/emoji/[doge].webp" target="_blank"><img src="static/emoji/[doge].webp" style="width: 2rem; display: inline-block;" /></a>');
const scrollElement = document.documentElement;
</script>
SCR-20240623-orio

Procedure version

nodejs: v18.16.0

Reproduction link

https://github.com/yoyocraft/md-editor-demo

imzbf commented 2 months ago

内置的xss扩展中的规则会将不带/开头的链接移除,所以目前有两种方案

  1. 禁用xss扩展,参考:https://imzbf.github.io/md-editor-v3/en-US/demo#%F0%9F%94%93%20Remove%20XSS%20extension

  2. 调整标准的链接:

-<img src="static/emoji/[doge].webp">
+<img src="/static/emoji/[doge].webp">

// 或者
+<img src="http://xxx.com/static/emoji/[doge].webp">
yoyocraft commented 2 months ago

LGMT