wuyuan/Classworks
1
0
Fork 0
mirror of https://github.com/ZeroCatDev/Classworks.git synced 2026-02-04 07:53:11 +00:00
Code Releases Activity

improve background url sanitization

Browse Source 
Co-authored-by: Sunwuyuan <88357633+Sunwuyuan@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2025-12-29 10:26:32 +00:00
parent cdbe06f528
commit b96484d26a
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/pages/index.vue
View File

@ -689,10 +689,12 @@ export default {
backgroundImageStyle() { backgroundImageStyle() {
const url = this.backgroundImageUrl; const url = this.backgroundImageUrl;
if (!this.isSafeBackgroundUrl(url)) return { display: "none" }; if (!this.isSafeBackgroundUrl(url)) return { display: "none" };
const safeUrl = this.sanitizeBackgroundUrl(url);
if (!safeUrl) return { display: "none" };
const blur = Math.min(Math.max(this.backgroundBlurAmount, 0), 50); const blur = Math.min(Math.max(this.backgroundBlurAmount, 0), 50);
return { return {
backgroundImage: `url("${this.sanitizeBackgroundUrl(url)}")`, backgroundImage: `url("${encodeURI(safeUrl)}")`,
filter: `blur(${blur}px)`, filter: `blur(${blur}px)`,
}; };
}, },
@ -700,7 +702,9 @@ export default {
if (!this.hasBackgroundImage) return { display: "none" }; if (!this.hasBackgroundImage) return { display: "none" };
const dim = Math.min(Math.max(this.backgroundDimAmount, 0), 90); const dim = Math.min(Math.max(this.backgroundDimAmount, 0), 90);
const overlayBlur = Math.min(Math.max(this.backgroundBlurAmount, 0), 50) / 3; // Slightly reduce overlay blur to avoid overwhelming foreground
const overlayBlur =
Math.min(Math.max(this.backgroundBlurAmount, 0), 50) / 3;
return { return {
backgroundColor: `rgba(0, 0, 0, ${dim / 100})`, backgroundColor: `rgba(0, 0, 0, ${dim / 100})`,
backdropFilter: `blur(${overlayBlur}px)`, backdropFilter: `blur(${overlayBlur}px)`,
@ -2232,7 +2236,8 @@ export default {
const parsed = new URL(url, window.location.origin); const parsed = new URL(url, window.location.origin);
return parsed.href; return parsed.href;
} catch (e) { } catch (e) {
return url.replace(/["'()\\]/g, ""); // Fallback for relative paths when URL parsing fails
return url.replace(/[^a-zA-Z0-9-._~!$&'()*+,;=/:@%]/g, "");
} }
}, },