fix studentAnswer xss

src/features/OnlineExam/Examing/FillBlankQuestionView.vue

@@ -6,7 +6,7 @@
     </div>
     <div v-for="(option, index) in studentAnswer.split('##')" :key="examQuestion.id + index" class="option">
       <span class="question-options">{{index+1}}. </span>
-      <input type="text" name="question" class="input-answer" :value="option" @input="inputAnswer" />
+      <input type="text" maxlength="5000" name="question" class="input-answer" :value="option" @input="inputAnswer" />
     </div>
     <div class="reset">
       <i-button type="warning" size="large" @click="resetAnswer">重置答案</i-button>
@@ -51,7 +51,10 @@ export default {
       this.studentAnswer =
         this.examQuestion.studentAnswer || "##".repeat(questionNumber - 1);
 
-      const answers = this.studentAnswer.split("##");
+      const answers = this.studentAnswer
+        .replace(/</gi, "&lt;")
+        .replace(/>/gi, "&gt;")
+        .split("##");
       this.questionBody = this.question.body.replace(
         /_{5,}/g,
         () =>
@@ -67,7 +70,11 @@ export default {
         .querySelectorAll(".option input")
         .forEach(e => (ans += e.value + "##"));
       this.studentAnswer = ans.slice(0, -2);
-      const answers = this.studentAnswer.split("##");
+      const answers = this.studentAnswer
+        .replace(/</gi, "&lt;")
+        .replace(/>/gi, "&gt;")
+        .split("##");
+      // console.log("answers: ", answers);
       this.questionBody = this.question.body.replace(
         /_{5,}/g,
         () =>
@@ -97,7 +104,10 @@ export default {
       let realAnswer = null;
       if (this.studentAnswer && this.studentAnswer.replace(/##/g, "").trim()) {
         // 如果有实际内容
-        realAnswer = this.studentAnswer;
+        realAnswer = this.studentAnswer
+          .replace(/</gi, "&lt;")
+          .replace(/>/gi, "&gt;");
+        // console.log("answers to store:", realAnswer);
       }
       if (realAnswer !== this.examQuestion.studentAnswer) {
         this.updateExamQuestion({

src/features/OnlineExam/Examing/TextQuestionView.vue

@@ -5,7 +5,7 @@
       <div class="score">({{examQuestion.questionScore}}分)</div>
     </div>
     <div class="option">
-      <textarea v-model="studentAnswer" class="stu-answer" type="text" />
+      <textarea v-model="studentAnswer" maxlength="5000" class="stu-answer" type="text" />
       </div>
     <div class="reset">
       <i-button type="warning" size="large" @click="studentAnswer=null">重置答案</i-button>
@@ -41,7 +41,9 @@ export default {
       let realAnswer = null;
       if (this.studentAnswer) {
         // 如果有实际内容
-        realAnswer = this.studentAnswer;
+        realAnswer = this.studentAnswer
+          .replace(/<script/gi, "&lt;script")
+          .replace(/script>/gi, "script&gt;");
       }
       if (realAnswer !== this.examQuestion.studentAnswer) {
         this.updateExamQuestion({