update

scripts/tag/button.js

@@ -7,15 +7,16 @@
 
 'use strict'
 
-const urlFor = require('hexo-util').url_for.bind(hexo)
+const { url_for, escapeHTML } = require('hexo-util')
+const urlFor = url_for.bind(hexo)
 
 const btn = args => {
   const [url = '', text = '', icon = '', option = ''] = args.join(' ').split(',').map(arg => arg.trim())
 
-  const iconHTML = icon ? `<i class="${icon}"></i>` : ''
-  const textHTML = text ? `<span>${text}</span>` : ''
+  const iconHTML = icon ? `<i class="${escapeHTML(icon)}"></i>` : ''
+  const textHTML = text ? `<span>${escapeHTML(text)}</span>` : ''
 
-  return `<a class="btn-beautify ${option}" href="${urlFor(url)}" title="${text}">${iconHTML}${textHTML}</a>`
+  return `<a class="btn-beautify ${escapeHTML(option)}" href="${urlFor(url)}" title="${escapeHTML(text)}">${iconHTML}${textHTML}</a>`
 }
 
 hexo.extend.tag.register('btn', btn, { ends: false })

scripts/tag/flink.js

@@ -4,24 +4,25 @@
 
 'use strict'
 
-const urlFor = require('hexo-util').url_for.bind(hexo)
+const { url_for, escapeHTML } = require('hexo-util')
+const urlFor = url_for.bind(hexo)
 
 const flinkFn = (args, content) => {
   const data = hexo.render.renderSync({ text: content, engine: 'yaml' })
   let result = ''
 
   data.forEach(item => {
-    const className = item.class_name ? `<div class="flink-name">${item.class_name}</div>` : ''
-    const classDesc = item.class_desc ? `<div class="flink-desc">${item.class_desc}</div>` : ''
+    const className = item.class_name ? `<div class="flink-name">${escapeHTML(item.class_name)}</div>` : ''
+    const classDesc = item.class_desc ? `<div class="flink-desc">${escapeHTML(item.class_desc)}</div>` : ''
 
     const listResult = item.link_list.map(link => `
       <div class="flink-list-item">
-        <a href="${link.link}" title="${link.name}" target="_blank">
+        <a href="${escapeHTML(link.link)}" title="${escapeHTML(link.name)}" target="_blank">
           <div class="flink-item-icon">
-            <img class="no-lightbox" src="${link.avatar}" onerror='this.onerror=null;this.src="${urlFor(hexo.theme.config.error_img.flink)}"' alt="${link.name}" />
+            <img class="no-lightbox" src="${escapeHTML(link.avatar)}" onerror='this.onerror=null;this.src="${urlFor(hexo.theme.config.error_img.flink)}"' alt="${escapeHTML(link.name)}" />
           </div>
-          <div class="flink-item-name">${link.name}</div>
-          <div class="flink-item-desc" title="${link.descr}">${link.descr}</div>
+          <div class="flink-item-name">${escapeHTML(link.name)}</div>
+          <div class="flink-item-desc" title="${escapeHTML(link.descr)}">${escapeHTML(link.descr)}</div>
         </a>
       </div>`).join('')
 

scripts/tag/gallery.js

@@ -27,6 +27,7 @@ const parseGalleryArgs = args => {
 const parseImageContent = content => {
   const images = []
   let match
+  IMAGE_REGEX.lastIndex = 0
 
   while ((match = IMAGE_REGEX.exec(content)) !== null) {
     images.push({

scripts/tag/hide.js

@@ -16,7 +16,7 @@
 
 'use strict'
 
-const parseArgs = args => args.join(' ').split(',')
+const parseArgs = args => args.join(' ').split(',').map(s => s.trim())
 
 const generateStyle = (bg, color) => {
   let style = 'style="'

scripts/tag/score.js

@@ -5,20 +5,10 @@
 
 'use strict'
 
+const { escapeHTML } = require('hexo-util')
+
 const score = (args, content) => {
-  // Escape HTML tags and some special characters, including curly braces
-  const escapeHtmlTags = s => {
-    const lookup = {
-      '&': '&',
-      '"': '"',
-      "'": ''',
-      '<': '&lt;',
-      '>': '&gt;',
-      '{': '&#123;',
-      '}': '&#125;'
-    }
-    return s.replace(/[&"'<>{}]/g, c => lookup[c])
-  }
+  const escapeHtmlTags = s => escapeHTML(s).replace(/[{}]/g, c => c === '{' ? '&#123;' : '&#125;')
 
   const trimmed = content.trim()
   // Split content using six dashes as a delimiter

scripts/tag/series.js

@@ -12,6 +12,10 @@
 const urlFor = require('hexo-util').url_for.bind(hexo)
 const groups = {}
 
+hexo.extend.filter.register('before_generate', () => {
+  Object.keys(groups).forEach(k => delete groups[k])
+})
+
 hexo.extend.filter.register('before_post_render', data => {
   if (!hexo.theme.config.series.enable) return data