Fix to filter @import CSS syntax in style tag to prevent XSS [Security Issue]

Author: jackycute

public/js/extra.js

@@ -552,17 +552,22 @@ export function finishView (view) {
   } catch (err) {
     console.warn(err)
   }
-  // unescape > symbel inside the style tags
-  view.find('style').each((key, value) => {
-    $(value).html($(value).html().replace(/>/g, '>'))
-  })
     // render title
   document.title = renderTitle(view)
 }
 
 // only static transform should be here
 export function postProcess (code) {
   const result = $(`<div>${code}</div>`)
+  // process style tags
+  result.find('style').each((key, value) => {
+    let html = $(value).html()
+    // unescape > symbel inside the style tags
+    html = html.replace(/&gt;/g, '>')
+    // remove css @import to prevent XSS
+    html = html.replace(/@import url\(([^)]*)\);?/gi, '')
+    $(value).html(html)
+  })
   // link should open in new window or tab
   result.find('a:not([href^="#"]):not([target])').attr('target', '_blank')
   // update continue line numbers