优化

2026-06-14 20:24:00 +08:00
parent 92e13ac836
commit 73c9c7f988
16 changed files with 102 additions and 53 deletions
@@ -2,6 +2,16 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
        const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNoaXhzc3JwaGZneHZxcWlna3pvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzQ2OTE0OTEsImV4cCI6MjA5MDI2NzQ5MX0.Az_Ew2J2zdOMcSV0UNAjBS-LPqGpqhsaN4IyZ5R7iqU';
        const sb = supabase.createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

+        function escapeHtml(value) {
+            return String(value ?? '').replace(/[&<>"']/g, char => ({
+                '&': '&amp;',
+                '<': '&lt;',
+                '>': '&gt;',
+                '"': '&quot;',
+                "'": '&#39;'
+            }[char]));
+        }
+
        async function handleSearch() {
            const recipientTerm = document.getElementById('recipientTerm').value.trim();
            const contentTerm = document.getElementById('searchTerm').value.trim();
@@ -19,7 +29,7 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';

            const { data, error } = await q.order('sent_date', { ascending: false });
            if (error) {
-                out.innerHTML = `<div class="error-state">查询失败：${error.message}</div>`;
+                out.innerHTML = `<div class="error-state">查询失败：${escapeHtml(error.message)}</div>`;
                return;
            }
            renderResults(data || []);
@@ -51,16 +61,16 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
            rows.forEach(row => {
                const content = row.content || '';
                const summary = content.length > 60
-                    ? `<span class="text-truncate" title="${content}">${content}</span>`
-                    : content;
+                    ? `<span class="text-truncate" title="${escapeHtml(content)}">${escapeHtml(content)}</span>`
+                    : escapeHtml(content);

                html += `
                    <tr>
-                        <td class="table-highlight">${row.id}</td>
-                        <td>${row.recipient || ''}</td>
-                        <td>${row.destination || ''}</td>
-                        <td>${row.sent_date || ''}</td>
-                        <td>${row.arrival_date || ''}</td>
+                        <td class="table-highlight">${escapeHtml(row.id)}</td>
+                        <td>${escapeHtml(row.recipient || '')}</td>
+                        <td>${escapeHtml(row.destination || '')}</td>
+                        <td>${escapeHtml(row.sent_date || '')}</td>
+                        <td>${escapeHtml(row.arrival_date || '')}</td>
                        <td>${summary}</td>
                    </tr>
                `;