From 4a8902f1c96ac5114f12bd49b3da1250fcf89437 Mon Sep 17 00:00:00 2001
From: chenqi <chen.qi@jin-group.cn>
Date: Thu, 18 Jun 2026 20:31:27 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20=E4=BF=AE=E5=A4=8DXSS=20v-html?=
 =?UTF-8?q?=E5=AE=89=E5=85=A8=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 healthlink-his-ui/src/components/NoticePanel.vue       | 7 +++++--
 healthlink-his-ui/src/components/NoticePanel/index.vue | 7 +++++--
 healthlink-his-ui/src/components/NoticePopup/index.vue | 7 +++++--
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/healthlink-his-ui/src/components/NoticePanel.vue b/healthlink-his-ui/src/components/NoticePanel.vue
index d1ba0ae8d..7782de420 100755
--- a/healthlink-his-ui/src/components/NoticePanel.vue
+++ b/healthlink-his-ui/src/components/NoticePanel.vue
@@ -83,8 +83,7 @@
         </div>
         <div
           class="detail-content"
-          v-html="currentNotice.noticeContent"
-        />
+        >{{ safeContent }}</div>
       </div>
       <template #footer>
         <el-button @click="detailVisible = false">
@@ -106,6 +105,10 @@ const detailVisible = ref(false)
 const noticeList = ref([])
 const currentNotice = ref({})
 const readNoticeIds = ref(new Set())
+const safeContent = computed(() => {
+  const content = currentNotice.value && currentNotice.value.noticeContent
+  return content ? String(content).replace(/<[^>]*>/g, '') : ''
+})
 
 // 打开公告/通知面板
 function open() {
diff --git a/healthlink-his-ui/src/components/NoticePanel/index.vue b/healthlink-his-ui/src/components/NoticePanel/index.vue
index 06f99a8ab..4722836dc 100755
--- a/healthlink-his-ui/src/components/NoticePanel/index.vue
+++ b/healthlink-his-ui/src/components/NoticePanel/index.vue
@@ -112,8 +112,7 @@
         <el-divider />
         <div
           class="notice-detail-body"
-          v-html="activeNotice.noticeContent"
-        />
+        >{{ safeContent }}</div>
       </div>
 
       <!-- 未选择状态 -->
@@ -156,6 +155,10 @@ const activeNotice = computed(() => {
 const unreadCount = computed(() => {
   return noticeList.value.filter(n => !n.isRead).length
 })
+const safeContent = computed(() => {
+  const content = activeNotice.value && activeNotice.value.noticeContent
+  return content ? String(content).replace(/<[^>]*>/g, '') : ''
+})
 
 // 获取公告类型图标
 // noticeType: 1=通知, 2=公告
diff --git a/healthlink-his-ui/src/components/NoticePopup/index.vue b/healthlink-his-ui/src/components/NoticePopup/index.vue
index 55a9ed526..b733799a5 100755
--- a/healthlink-his-ui/src/components/NoticePopup/index.vue
+++ b/healthlink-his-ui/src/components/NoticePopup/index.vue
@@ -91,8 +91,7 @@
         <el-divider />
         <div
           class="notice-detail-body"
-          v-html="activeNotice.noticeContent"
-        />
+        >{{ safeContent }}</div>
       </div>
 
       <!-- 空状态 -->
@@ -166,6 +165,10 @@ const unreadCount = computed(() => {
 const hasUnread = computed(() => {
   return unreadCount.value > 0
 })
+const safeContent = computed(() => {
+  const content = activeNotice.value && activeNotice.value.noticeContent
+  return content ? String(content).replace(/<[^>]*>/g, '') : ''
+})
 
 // 获取公告类型图标
 // noticeType: 1=通知, 2=公告