qwqcode
bad248534c
BREAKING CHANGE: The following top-level functions exported by the 'artalk' npm package have been deprecated: `Artalk.update`, `Artalk.reload`, and `Artalk.destroy`. These methods now require invocation on an instance created by either `Artalk.init` or `new Artalk`. Please utilize instance-level methods instead, such as `artalkInstance.update`. For more information, refer to [the documentation](https://artalk.js.org/guide/frontend/import-framework.html). The update was implemented to enable the concurrent creation of multiple instances, adapting to situations where Vue components are simultaneously referenced across various pages. Initially, only a singular instance was permitted to mitigate memory leak concerns. However, this proved limiting for scenarios involving the caching of multiple component instances through 'keep-alive.' To better suit intricate SPA application needs, the choice was made to permit the creation of multiple independent instances. It's crucial to remember to manually invoke the `artalk.destroy` method when releasing components to avoid memory leaks (Issue #660).
1.4 KiB
1.4 KiB
安全防范
用户身份凭证存储
Artalk 在努力保护用户的安全。参考 OWASP 安全备忘录 中提到的内容，Artalk 的开发对于来自用户输入的任何数据始终持以怀疑的态度，我们严格遵循以下准则防范 XSS 攻击：
- 不直接或间接地调用
innerHTML输出未经处理的用户输入数据，而是使用innerText。 - 需要额外注意将用户输入数据带入程序上下文时的处理，防止非法数据在页面被执行。例如不要在
setAttribute时直接引用来自用户的输入值。 - 注意类型合法性判断、做好类型的转换。例如 URL 以
javascript:前缀开头应被视为非法。 - 不要去调用一些高风险的内置函数，因为会带来潜在的安全隐患。例如：
eval()。 - 注意来自内置 API 的数据，应任被视为不可信的。例如：
location.hash.split("#")[1]。
跨域请求安全性
参考：Cross-Origin Resource Sharing (CORS) ｜ MDN
【待补充】
API 设计安全性
【待补充】
写在结尾
Artalk 的功能在不断完善，同时也在不断向提高安全性的目标努力，但在努力的同时还是难免发生一些疏忽和遗漏，若遇问题或有好的建议，欢迎反馈与指正。