fix #1274

src/app/service/service_worker/index.ts

@@ -21,7 +21,6 @@ import { FaviconDAO } from "@App/app/repo/favicon";
 import { onRegularUpdateCheckAlarm } from "./regular_updatecheck";
 import { cacheInstance } from "@App/app/cache";
 import { InfoNotification } from "./utils";
-import { sanitizeHTML } from "@App/pkg/utils/sanitize";
 
 // service worker的管理器
 export default class ServiceWorkerManager {
@@ -116,7 +115,7 @@ export default class ServiceWorkerManager {
         .then((resp: { data: { [key: string]: any; notice: string; version: string } }) => {
           const data = resp.data;
           systemConfig
-            .getCheckUpdate({ sanitizeHTML })
+            .getCheckUpdate()
             .then((items) => {
               const isRead = items.notice !== data.notice ? false : items.isRead;
               systemConfig.setCheckUpdate({ ...data, isRead: isRead });

src/pages/popup/App.tsx

@@ -271,9 +271,12 @@ function App() {
     const checkScriptEnableAndUpdate = async () => {
       const [isEnableScript, checkUpdate] = await Promise.all([
         systemConfig.getEnableScript(),
-        systemConfig.getCheckUpdate({ sanitizeHTML }),
+        systemConfig.getCheckUpdate(),
       ]);
       if (!hookMgr.isMounted) return;
+      if (typeof checkUpdate.notice === "string") {
+        checkUpdate.notice = sanitizeHTML(checkUpdate.notice);
+      }
       setIsEnableScript(isEnableScript);
       setCheckUpdate(checkUpdate);
     };

src/pkg/utils/sanitize.ts

@@ -1,14 +1,14 @@
 import DOMPurify from "dompurify";
 
 // 允许的安全 CSS 属性白名单
-const ALLOWED_CSS_PROPERTIES = ["color", "font-size", "font-weight", "font-style"];
+const ALLOWED_CSS_PROPERTIES = new Set(["color", "font-size", "font-weight", "font-style"]);
 
 // 过滤不安全的 CSS 属性，只保留白名单中的属性
 DOMPurify.addHook("afterSanitizeAttributes", (node) => {
   if (node instanceof HTMLElement && node.hasAttribute("style")) {
     const { style } = node;
     for (let i = style.length - 1; i >= 0; i--) {
-      if (!ALLOWED_CSS_PROPERTIES.includes(style[i])) {
+      if (!ALLOWED_CSS_PROPERTIES.has(style[i])) {
         style.removeProperty(style[i]);
       }
     }