尝试 html 输出放在 iframe 里

plugin/preload.js

@@ -451,7 +451,7 @@ let parseStdout = stdout => stdout.map(x => parseItem(x)).join("\n")
 
 // 屏蔽危险函数
 window.getuToolsLite = () => {
-    var utoolsLite = Object.assign({}, utools)
+    var utoolsLite = Object.assign({}, _.cloneDeep(utools))
     // if (utools.isDev()) return utoolsLite
     // 数据库相关接口
     delete utoolsLite.db
@@ -473,12 +473,12 @@ window.getuToolsLite = () => {
 
 let getSandboxFuns = () => {
     var sandbox = {
+        fetch: fetch.bind(window),
         utools: getuToolsLite(),
         quickcommand,
         electron,
         axios,
         Audio,
-        fetch,
         _,
         // 兼容老版本 
         fs,
@@ -503,8 +503,7 @@ utools.isDev() && (window.godMode = code => eval(code))
 
 // vm 模块将无法在渲染进程中使用，改用 ses 来执行代码
 window.evalCodeInSandbox = (code, userVars = {}) => {
-    let sandbox = getSandboxFuns()
+    let sandboxWithUV = Object.assign(userVars, getSandboxFuns())
-    let sandboxWithUV = Object.assign(userVars, sandbox)
     try {
         return new Compartment(sandboxWithUV).evaluate(code);
     } catch (error) {

src/components/CommandRunResult.vue

@@ -16,12 +16,19 @@
             >
           </q-toolbar>
           <q-card-section class="row items-center">
+            <iframe
+              ref="iframe"
+              :srcdoc="runResult"
+              frameborder="0"
+              v-if="htmlOutput"
+            ></iframe>
             <pre
+              v-else
               :class="{
                 'text-red': !runResultStatus,
                 result: 1,
               }"
-              v-html="runResult"
+              v-text="runResult"
             ></pre>
           </q-card-section>
           <q-card-actions align="right">
@@ -31,14 +38,21 @@
       </q-dialog>
     </div>
     <div v-else>
+      <iframe
+        ref="iframe"
+        :srcdoc="runResult"
+        frameborder="0"
+        v-if="htmlOutput"
+      ></iframe>
       <pre
+        v-else
         v-show="!!runResult"
         :class="{
           'text-red': !runResultStatus,
           'q-pa-md': 1,
           result: 1,
         }"
-        v-html="runResult"
+        v-text="runResult"
       ></pre>
     </div>
   </div>
@@ -49,7 +63,6 @@
 import outputTypes from "../js/options/outputTypes.js";
 import specialVars from "../js/options/specialVars.js";
 import commandTypes from "../js/options/commandTypes.js";
-import { event } from "quasar";
 
 export default {
   data() {
@@ -61,6 +74,7 @@ export default {
       listener: null,
       history: [],
       historyIdx: null,
+      htmlOutput: false,
     };
   },
   props: {
@@ -80,6 +94,9 @@ export default {
     needTempPayload() {
       return ["edit", "new", "config"].includes(this.action.type);
     },
+    iframeCtw() {
+      return this.$refs?.iframe?.contentWindow;
+    },
   },
   methods: {
     // 运行命令
@@ -91,6 +108,7 @@ export default {
     },
     async fire(currentCommand) {
       currentCommand.cmd = this.assignSpecialVars(currentCommand.cmd);
+      this.htmlOutput = currentCommand.output === "html";
       let { hideWindow, outPlugin, action } =
         outputTypes[currentCommand.output];
       // 需要隐藏的提前隐藏窗口
@@ -203,6 +221,7 @@ export default {
     // 显示运行结果
     showRunResult(content, isSuccess, action) {
       this.isResultShow = true;
+      this.setIframe();
       this.runResultStatus = isSuccess;
       let contlength = content?.length || 0;
       if (contlength > this.resultMaxLength)
@@ -239,6 +258,17 @@ export default {
         document.removeEventListener("keydown", this.listener, true);
       }
     },
+    setIframe() {
+      this.$nextTick(() => {
+        if (!this.iframeCtw) return;
+        let ctx = {
+          quickcommand,
+          utools,
+          parent: undefined,
+        };
+        Object.assign(this.iframeCtw, _.cloneDeep(ctx));
+      });
+    },
   },
   unmounted() {
     this.stopRun();
@@ -253,4 +283,8 @@ export default {
   max-width: 100%;
   margin: 0;
 }
+iframe {
+  width: 100%;
+  height: 550px;
+}
 </style>

src/components/popup/UserInfo.vue

@@ -80,7 +80,8 @@
         <q-card-section class="q-gutter-sm">
           <div>「uTools 会员」或「插件会员」均可享受本插件的会员功能</div>
           <div class="text-weight-bolder">
-            本插件会员仅需 {{ memberPrice }} 元，一次性付费，uTools 会员享 9 折优惠
+            本插件会员仅需 {{ memberPrice }} 元，一次性付费，uTools 会员享 9
+            折优惠
           </div>
           <div>
             会员功能将在保障用户完整的插件功能体验的前提下，提供以下个性化功能：
@@ -158,7 +159,7 @@ export default {
   },
   methods: {
     getUserInfo() {
-      Object.assign(this.userInfo, utools.getUser());
+      Object.assign(this.userInfo, this.$root.utools.whole.getUser());
       let statisticsData = this.$root.utools.getDB(
         this.$root.utools.DBPRE.CFG + "statisticsData"
       );

src/js/options/outputTypes.js

@@ -22,7 +22,7 @@ const outputTypes = {
         name: "text",
         label: "纯文本输出",
         icon: "text_snippet",
-        action: result => window.htmlEncode(result)
+        action: result => result
     },
     html: {
         name: "html",