修改跨站脚本攻击缺陷

jero-web/public/ueditor/ADT/background/background.js

@@ -144,9 +144,13 @@
         }
 
         if(url && /^\//.test(url)) {
-            var a = document.createElement('a');
+          var a = document.createElement('a');
-            a.href = htmlspecialchars(url);
+          const index = url.indexOf('?')
-            a.ref= 'nofollow noopener noreferrer'
+          const searchLeft = url.slice(0, index)
+          const searchRight = url.slice(index + 1, url.length)
+          url = searchLeft + htmlspecialchars(searchRight)
+            a.href = url;
+            a.rel= 'nofollow noopener noreferrer'
             browser.ie && (a.href = a.href);
             url = browser.ie ? a.href:(a.protocol + '//' + a.host + a.pathname + a.search + a.hash);
         }

jero-web/src/mixins/ConfigurableTableMixin.js

@@ -288,7 +288,11 @@ export const ConfigurableTableMixin = {
           // this.$message.success(`${info.file.name} 文件上传成功`);
           if (info.file.response.code === 201) {
             const { message, result: { msg, fileUrl, fileName } } = info.file.response
-            const href = this.htmlspecialchars(window._CONFIG.domianURL + fileUrl)
+            let href = window._CONFIG.domianURL + fileUrl
+            const index = href.indexOf('?')
+            const searchLeft = href.slice(0, index)
+            const searchRight = href.slice(index + 1, href.length)
+            href = searchLeft + this.htmlspecialchars(searchRight)
             this.$warning({
               title: message,
               content: (