`ReactEmailExporter` 中未解码的文本导致 HTML 注入 / XSS 以及输出损坏

作者: codeCraft-Ritik创建于 2026年9月9日更新于 2026年9月9日

标签needs-triage

+++ -24,6 @@ -24,6 +24,7 import { escapeHtml } from "html-entities"; import { transformStyledText } from "./transformStyledText"; import { ReactEmailExporter } from "./reactEmailExporter"; import { BlockNoteSchema, defaultBlockSpecs } from "@blocknote/core"; import { reactEmailDefaultSchemaMappings } from "@blocknote/xl-email-exporter";

const schema = BlockNoteSchema.create({ blockSpecs: defaultBlockSpecs });

const schema = BlockNoteSchema.create({
blockSpecs: defaultBlockSpecs,
}); const exporter = new ReactEmailExporter(schema, reactEmailDefaultSchemaMappings); const blocks = [
{
id: "block-1",
type: "paragraph" as const,
props: {},
content: [
```
{
```
```
  type: "text" as const,
```

  text: "Condition check: x < 10 & y > 20, or <script>alert(1)</script>",

```
  styles: {},
```
```
},
```
],
children: [],
}, ]; const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(blocks);

const emailHtml = await exporter.toReactEmailDocument(blocks); console.log(emailHtml);

const emailHtml = await exporter.toReactEmailDocument(block

内容来源: TypeCellOS/BlockNote

查看 GitHub 原文在 GitHub 查看讨论