chore: 调整文档模版写法,避免使用容易导致 xss 的写法 Close: #9164 (#9165)

This commit is contained in:
liaoxuezhi 2023-12-19 14:34:35 +08:00 committed by GitHub
parent 4aed7004ca
commit f210a93d9a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 24 additions and 24 deletions

View File

@ -97,7 +97,7 @@ order: 33
```
itemSchema: {
type: 'tpl',
tpl: '<div style="background-image: url('<%= data.image %>'); background-size: cover; background-repeat: no-repeat; background-position: center center;" class="image <%= data.imageClassName %>"></div>'
tpl: '<div style="background-image: url("${image}"); background-size: cover; background-repeat: no-repeat; background-position: center center;" class="image ${imageClassName}"></div>'
}
```

View File

@ -23,7 +23,7 @@ order: 45
"name": "arr",
"items": {
"type": "tpl",
"tpl": "<span class='label label-default m-l-sm'><%= data.item %></span> "
"tpl": "<span class='label label-default m-l-sm'>${item}</span> "
}
}
}
@ -127,7 +127,7 @@ order: 45
"placeholder": "暂无内容",
"items": {
"type": "tpl",
"tpl": "<span class='label label-info m-l-sm'><%= this.item %></span>"
"tpl": "<span class='label label-info m-l-sm'>${item}</span>"
}
}
]
@ -151,7 +151,7 @@ List 的内容、Card 卡片的内容配置同上
"name": "each",
"items": {
"type": "tpl",
"tpl": "<span class='label label-info m-l-sm'><%= this.item %></span>"
"tpl": "<span class='label label-info m-l-sm'>${item}</span>"
}
}
]
@ -171,7 +171,7 @@ List 的内容、Card 卡片的内容配置同上
"source": "${arr}",
"items": {
"type": "tpl",
"tpl": "<span class='label label-default m-l-sm'><%= data.item %></span> "
"tpl": "<span class='label label-default m-l-sm'>${item}</span> "
}
}
}

View File

@ -774,7 +774,7 @@ combo 还有一个作用是增加层级,比如返回的数据是一个深层
"items": [
{
"type": "tpl",
"tpl": "<%= this.index + 1%>",
"tpl": "${ index + 1 }",
"className": "p-t-xs",
"mode": "inline"
},

View File

@ -479,7 +479,7 @@ app.listen(8080, function () {});
"className": "mb-1",
"items": {
"type": "tpl",
"tpl": "<span class='label label-info m-l-sm inline-block mb-1'><%= data.item %></span>"
"tpl": "<span class='label label-info m-l-sm inline-block mb-1'>${item}</span>"
}
},
{

View File

@ -790,7 +790,7 @@ order: 54
"name": "table",
"addable": true,
"editable": true,
"rowClassNameExpr": "<%= data.a === 'a' ? 'bg-success' : '' %>",
"rowClassNameExpr": "${ a === 'a' ? 'bg-success' : '' }",
"columns": [
{
"name": "a",

View File

@ -474,7 +474,7 @@ order: 67
`classNameExpr` 可以根据数据动态添加 CSS 类,支持 [模板](../../docs/concepts/template) 语法。
例如下例,`"<%= data.version > 5 ? "text-danger" : "" %>"` 表示当行数据的 `version` 数据大于 5 的时候添加 `text-danger` CSS 类名,使得文字颜色变红
例如下例,`"${ version > 5 ? 'text-danger' : '' }"` 表示当行数据的 `version` 数据大于 5 的时候添加 `text-danger` CSS 类名,使得文字颜色变红
```schema: scope="body"
{
@ -493,7 +493,7 @@ order: 67
{
"name": "version",
"label": "Version",
"classNameExpr": "<%= data.version > 5 ? 'text-danger' : '' %>",
"classNameExpr": "${ version > 5 ? 'text-danger' : '' }",
},
{
"name": "grade",
@ -1414,7 +1414,7 @@ popOver 的其它配置请参考 [popover](./popover)
可以通过配置`rowClassNameExpr`来为行添加 CSS 类,支持 [模板](../../docs/concepts/template) 语法。
例如下例,`"<%= data.id % 2 ? "bg-success" : "" %>"` 表示当行数据的 `id` 变量为 不能被 `2` 整除时,给当前行添加`bg-success` CSS 类名,即绿色背景色
例如下例,`"${id % 2 ? "bg-success" : ""}"` 表示当行数据的 `id` 变量为 不能被 `2` 整除时,给当前行添加`bg-success` CSS 类名,即绿色背景色
```schema: scope="body"
{
@ -1424,7 +1424,7 @@ popOver 的其它配置请参考 [popover](./popover)
{
"type": "table",
"source": "$rows",
"rowClassNameExpr": "<%= data.id % 2 ? 'bg-success' : 'bg-blue-50' %>",
"rowClassNameExpr": "${id % 2 ? 'bg-success' : 'bg-blue-50'}",
"columns": [
{
"name": "engine",

View File

@ -591,7 +591,7 @@ order: 67
"expandable": {
"expandableOn": "this.record && (this.record.id === 1 || this.record.id === 3)",
"keyField": "id",
"expandedRowClassNameExpr": "<%= data.rowIndex === 2 ? 'bg-success' : '' %>",
"expandedRowClassNameExpr": "${ rowIndex === 2 ? 'bg-success' : '' }",
"expandedRowKeys": ["3"],
"type": "container",
"body": [
@ -642,7 +642,7 @@ order: 67
"expandable": {
"expandableOn": "this.record && (this.record.id === 1 || this.record.id === 3)",
"keyField": "id",
"expandedRowClassNameExpr": "<%= data.rowIndex % 2 ? 'bg-success' : '' %>",
"expandedRowClassNameExpr": "${ rowIndex % 2 ? 'bg-success' : '' }",
"expandedRowKeysExpr": "data.record.id == '3'",
"type": "container",
"body": [
@ -693,7 +693,7 @@ order: 67
"expandable": {
"expandableOn": "this.record && (this.record.id === 1 || this.record.id === 3)",
"keyField": "id",
"expandedRowClassNameExpr": "<%= data.rowIndex % 2 ? 'bg-success' : '' %>",
"expandedRowClassNameExpr": "${ rowIndex % 2 ? 'bg-success' : '' }",
"expandedRowKeys": ["3"],
"type": "container",
"position": "right",
@ -774,7 +774,7 @@ order: 67
],
"expandable": {
"keyField": "id",
"expandedRowClassNameExpr": "<%= data.rowIndex % 2 ? 'bg-success' : '' %>",
"expandedRowClassNameExpr": "${ rowIndex % 2 ? 'bg-success' : '' }",
"type": "container",
"position": "none",
"body": [
@ -843,7 +843,7 @@ order: 67
],
"expandable": {
"keyField": "id",
"expandedRowClassNameExpr": "<%= data.rowIndex % 2 ? 'bg-success' : '' %>",
"expandedRowClassNameExpr": "${ rowIndex % 2 ? 'bg-success' : '' }",
"type": "container",
"position": "none",
"body": [
@ -878,7 +878,7 @@ order: 67
{
"title": "Version",
"name": "version",
"rowSpanExpr": "<%= data.rowIndex === 2 ? 2 : 0 %>"
"rowSpanExpr": "${ rowIndex === 2 ? 2 : 0 }"
},
{
"title": "Browser",
@ -887,7 +887,7 @@ order: 67
{
"title": "Badge",
"name": "badgeText",
"colSpanExpr": "<%= data.rowIndex === 6 ? 3 : 0 %>"
"colSpanExpr": "${ rowIndex === 6 ? 3 : 0 }"
},
{
"title": "Grade",
@ -1247,7 +1247,7 @@ order: 67
{
"title": "Grade",
"name": "grade",
"colSpanExpr": "<%= data.rowIndex === 1 ? 3 : 0 %>"
"colSpanExpr": "${ rowIndex === 1 ? 3 : 0 }"
},
{
"title": "Grade1",
@ -3955,7 +3955,7 @@ order: 67
{
"title": "Version",
"name": "version",
"classNameExpr": "<%= data.version > 5 ? 'text-danger' : '' %>"
"classNameExpr": "${ version > 5 ? 'text-danger' : '' }"
},
{
"title": "Browser",

View File

@ -96,14 +96,14 @@ amis 还支持用 JavaScript 模板引擎进行组织输出,内部采用 [loda
"body": [
{
"type": "tpl",
"tpl": "User: <%= data.user %>"
"tpl": "User: <%- data.user %>"
},
{
"type": "divider"
},
{
"type": "tpl",
"tpl": "<% if (data.items && data.items.length) { %>Array: <% data.items.forEach(function(item) { %> <span class='label label-default'><%= item %></span> <% });} %>"
"tpl": "<% if (data.items && data.items.length) { %>Array: <% data.items.forEach(function(item) { %> <span class='label label-default'><%- item %></span> <% });} %>"
}
]
}
@ -122,7 +122,7 @@ amis 还支持用 JavaScript 模板引擎进行组织输出,内部采用 [loda
- `formatNumber(number)` 格式化数字格式,加上千分位。
- `countDown(value)` 倒计时,显示离指定时间还剩下多少天,只支持时间戳。
下面 filters 中的方法也可以使用如: `<%= date(data.xxx, 'YYYY-MM-DD') %>`
下面 filters 中的方法也可以使用如: `<%- date(data.xxx, 'YYYY-MM-DD') %>`
## 注意事项