docsifyjs / docsifyjs/docsify

`<script>` in the md file fetched from the basePath is not executed

未关闭
#1,659 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
JavaScript
星标
31.5k
派生
5.8k
平均合并
9 天 8 小时
30 天内合并 PR
2

描述

## Bug Report
`// my script` in md file from `basePath` is not executed.

#### Steps to reproduce
- Provide the `basePath` as a full url with a domain different from the domain of `index.html`.
- open url of `index.html` with your browser.
- When you fetch the md files from `basePath`, you can check that the script in the md file cannot be executed.

#### What is current behaviour
In this case, the value of `isRemoteUrl` is determined to be true, so the code is sanitized by the code below.

https://github.com/docsifyjs/docsify/blob/c3cdadc37137edcd9e219359973902d2fc8b66ff/src/core/render/index.js#L332-L334

#### What is the expected behaviour
`basePath` is a value that can be entered only with the authority of the document site administrator, and the basePath server can also be considered owned by the administrator, so the `isRemoteUrl` value should be `false`.

#### Other relevant information

<!-- (Update "[ ]" to "[x]" to check a box) -->
- [ ] Bug does still occur when all/other plugins are disabled?

- Your OS: macOS 11
- Node.js version:
- npm/yarn version:
- Browser version:
- Docsify version: 4.12.1
- Docsify plugins:

贡献指南

打开贡献指南

调研方向

从 src/core/render/index.js 的第 332-334 行开始,使用 basePath 是另一域名上的完整 URL 的 index.html 重现该问题。检查远程 URL 判定如何影响脚本处理;完成标准是在该设置下,获取到的 Markdown 中的脚本能够执行,同时不改变其他来源的预期行为。

由索引模型根据 Issue 内容生成。

评估

技术栈
javascript
领域
frontend
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
描述清楚
新手友好度
48/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。