GET /api/public/home

GET /api/public/notices/{id} SQLite / MySQL 双数据库只读连接 .env 与现有数据库配置兼容公告 HTML 安全清洗学校、班级、考试、科目、报名及系统通知聚合
2026-07-22 18:59:53 +08:00
parent 241fa8a6d7
commit 38e42ad734
23 changed files with 1144 additions and 13 deletions
@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsTestProject>true</IsTestProject>
+    <IsPackable>false</IsPackable>
+    <RootNamespace>Eis.Infrastructure.Tests</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.runner.visualstudio">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\Eis.Infrastructure\Eis.Infrastructure.csproj" />
+  </ItemGroup>
+</Project>
@@ -0,0 +1,45 @@
+using Eis.Infrastructure.Public;
+
+namespace Eis.Infrastructure.Tests.Public;
+
+public sealed class NoticeContentFormatterTests
+{
+    private readonly NoticeContentFormatter _formatter = new();
+
+    [Fact]
+    public void Sanitize_RemovesExecutableMarkupAndUnsafeAttributes()
+    {
+        const string source = "<p onclick=\"alert(1)\">正文<script>alert(1)</script><a href=\"javascript:alert(1)\">链接</a></p>";
+
+        var result = _formatter.Sanitize(source);
+
+        Assert.Contains("正文", result, StringComparison.Ordinal);
+        Assert.Contains("链接", result, StringComparison.Ordinal);
+        Assert.DoesNotContain("script", result, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("onclick", result, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("javascript:", result, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void Sanitize_PreservesSupportedEditorMarkupAndHardensLinks()
+    {
+        const string source = "<figure class=\"image unknown\"><img src=\"https://example.test/a.png\" alt=\"图\"><figcaption>说明</figcaption></figure><a href=\"https://example.test\" target=\"_blank\">详情</a>";
+
+        var result = _formatter.Sanitize(source);
+
+        Assert.Contains("class=\"image\"", result, StringComparison.Ordinal);
+        Assert.DoesNotContain("unknown", result, StringComparison.Ordinal);
+        Assert.Contains("src=\"https://example.test/a.png\"", result, StringComparison.Ordinal);
+        Assert.Contains("rel=\"noopener noreferrer\"", result, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ContentHtml_ConvertsPlainTextParagraphsWithoutTrustingMarkup()
+    {
+        const string source = "第一段\n换行\n\n第二段 & 内容";
+
+        var result = _formatter.ContentHtml(source);
+
+        Assert.Equal("<p>第一段<br>换行</p><p>第二段 &amp; 内容</p>", result);
+    }
+}
@@ -0,0 +1 @@
+global using Xunit;