🔒 GHSA-ff66-236v-p4fg

Signed-off-by: Daniel <845765@qq.com>

Author: 88250

kernel/go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/88250/epub v0.0.0-20230830085737-c19055cd1f48
 	github.com/88250/go-humanize v0.0.0-20240424102817-4f78fac47ea7
 	github.com/88250/gulu v1.2.3-0.20260124101918-98654a7ca98a
-	github.com/88250/lute v1.7.7-0.20260321150117-91fef4014208
+	github.com/88250/lute v1.7.7-0.20260329134828-30ee1cf08d47
 	github.com/88250/vitess-sqlparser v0.0.0-20210205111146-56a2ded2aba1
 	github.com/ClarkThan/ahocorasick v0.0.0-20231011042242-30d1ef1347f4
 	github.com/ConradIrwin/font v0.2.1

kernel/go.sum

@@ -14,8 +14,8 @@ github.com/88250/go-sqlite3 v1.14.13-0.20231214121541-e7f54c482950 h1:Pa5hMiBceT
 github.com/88250/go-sqlite3 v1.14.13-0.20231214121541-e7f54c482950/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/88250/gulu v1.2.3-0.20260124101918-98654a7ca98a h1:s86WMolaqommXG1k2vXg9Gf1iXvgtHSdeD0eeJTQVR8=
 github.com/88250/gulu v1.2.3-0.20260124101918-98654a7ca98a/go.mod h1:D+Db16m0N7r9MLZCMcj1a0ZsEGQAxDZkadOn79Gh0vI=
-github.com/88250/lute v1.7.7-0.20260321150117-91fef4014208 h1:XC08FBuhc2FTebSxE51xHg+u97+7buMfI6bjsHmHws8=
-github.com/88250/lute v1.7.7-0.20260321150117-91fef4014208/go.mod h1:WYyUw//5yVw9BJnoVjx7rI/3szsISxNZCYGOqTIrV0o=
+github.com/88250/lute v1.7.7-0.20260329134828-30ee1cf08d47 h1:IoVGy/RDVpnBJWMtgaSffj8ch2XhLT57Z0poWcSw6eM=
+github.com/88250/lute v1.7.7-0.20260329134828-30ee1cf08d47/go.mod h1:WYyUw//5yVw9BJnoVjx7rI/3szsISxNZCYGOqTIrV0o=
 github.com/88250/pdfcpu v0.3.14-0.20250424122812-f10e8d9d8d46 h1:Bq1JsDfVbHKUxNL/B2JXd8cC/1h6aFjrlXpGycnh0Hk=
 github.com/88250/pdfcpu v0.3.14-0.20250424122812-f10e8d9d8d46/go.mod h1:fVfOloBzs2+W2VJCCbq60XIxc3yJHAZ0Gahv1oO0gyI=
 github.com/88250/vitess-sqlparser v0.0.0-20210205111146-56a2ded2aba1 h1:48T899JQDwyyRu9yXHePYlPdHtpJfrJEUGBMH3SMBWY=

kernel/model/file.go

@@ -740,6 +740,9 @@ func GetDoc(startID, endID, id string, index int, query string, queryTypes map[s
 		}
 
 		subTree.Root.AppendChild(n)
+		for _, ial := range n.KramdownIAL {
+			ial[1] = util.SanitizeAttr(ial[1])
+		}
 	}
 
 	luteEngine.RenderOptions.NodeIndexStart = index

kernel/util/misc.go

@@ -212,6 +212,17 @@ func GetContainsSubStrs(s string, subStrs []string) (ret []string) {
 	return
 }
 
+func SanitizeAttr(attr string) string {
+	attr = strings.TrimSpace(attr)
+	h := "<div data-attr=\"" + attr + "\">"
+	p := bluemonday.UGCPolicy()
+	p.AllowDataAttributes()
+	ret := p.Sanitize(h)
+	ret = strings.TrimPrefix(ret, "<div data-attr=\"")
+	ret = strings.TrimSuffix(ret, "\">")
+	return ret
+}
+
 func SanitizeImgSrc(src string) string {
 	src = strings.TrimSpace(src)
 	h := "<img src=\"" + src + "\">"