From cbdd0e202c0308939d796bb376e48ec396469c30 Mon Sep 17 00:00:00 2001 From: PIGCLOUD Date: Tue, 3 Nov 2026 14:51:50 +0800 Subject: [PATCH] fix(xss): adapt safelist override to updated jsoup --- .../main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java index 249c9ced8..4eb77d837 100644 --- a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java @@ -100,7 +100,7 @@ public class XssUtil { } @Override - protected boolean isSafeAttribute(String tagName, Element el, Attribute attr) { + public boolean isSafeAttribute(String tagName, Element el, Attribute attr) { // 不允许 javascript 开头的 src 和 href if ("src".equalsIgnoreCase(attr.getKey()) || "href".equalsIgnoreCase(attr.getKey())) { String value = attr.getValue();