fix(ui): add referrerpolicy attribute for iframe (#687) (#707)

ArtalkJS · Dec 20, 2023 · 7099598 · 7099598
1 parent ad8851e
commit 7099598
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 2 deletions.
diff --git a/ui/packages/artalk-sidebar/index.html b/ui/packages/artalk-sidebar/index.html
@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="referrer" content="strict-origin" />
     <title>Artalk Sidebar</title>
   </head>
   <body>

diff --git a/ui/packages/artalk/src/components/checker/captcha-renders.ts b/ui/packages/artalk/src/components/checker/captcha-renders.ts
@@ -27,7 +27,7 @@ export function imgBody(checker: CheckerCtx) {
 /** iframe 形式的通用验证服务 */
 export function iframeBody(checker: CheckerCtx) {
   const $iframeWrap = Utils.createElement(`<div class="atk-checker-iframe-wrap"></div>`)
-  const $iframe = Utils.createElement<HTMLIFrameElement>(`<iframe class="atk-fade-in"></iframe>`)
+  const $iframe = Utils.createElement<HTMLIFrameElement>(`<iframe class="atk-fade-in" referrerpolicy="strict-origin-when-cross-origin"></iframe>`)
   $iframe.style.display = 'none'
   Ui.showLoading($iframeWrap, { transparentBg: true })
   $iframe.src = `${checker.getOpts().getIframeURLBase() || ''}/api/captcha/get?t=${+new Date()}`

diff --git a/ui/packages/artalk/src/layer/sidebar-layer.ts b/ui/packages/artalk/src/layer/sidebar-layer.ts
@@ -116,7 +116,7 @@ export default class SidebarLayer extends Component {
   }
 
   private createIframe(view?: string) {
-    const $iframe = Utils.createElement<HTMLIFrameElement>('<iframe></iframe>')
+    const $iframe = Utils.createElement<HTMLIFrameElement>('<iframe referrerpolicy="strict-origin-when-cross-origin"></iframe>')
 
     // 准备 Iframe 参数
     const baseURL = (import.meta.env.DEV)  ? 'http://localhost:23367/'