announcement v1

internal/template/announcement.go

@@ -0,0 +1,50 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package template
+
+import (
+	"html"
+	"regexp"
+	"strings"
+
+	htmltemplate "html/template"
+)
+
+// 公告正文里的 http(s) 地址自动变链接。
+var announcementURLRe = regexp.MustCompile(`https?://[^\s<>"']+`)
+
+// 句末标点不属于 URL：中文公告里「详见 https://example.com/x。」很常见，
+// 不剥离就会把「。」一起链进去。
+const announcementURLTailChars = ".,;:!?)]}，。；：！？）】」”’"
+
+// AnnouncementHTML 把配置里的纯文本公告渲染成安全 HTML。
+//
+// 按 URL 切段、逐段转义，而不是「先整体转义再正则」：转义后的 &#34; 会被 URL
+// 字符类当成普通字符吞进链接。链接的 href 与可见文本共用同一份转义结果，
+// 因此不存在属性逃逸；内容里的 HTML 标签一律按字面显示。
+func AnnouncementHTML(raw string) htmltemplate.HTML {
+	raw = strings.ReplaceAll(raw, "\r\n", "\n")
+	raw = strings.ReplaceAll(raw, `\r\n`, "\n")
+	raw = strings.ReplaceAll(raw, `\n`, "\n")
+
+	var b strings.Builder
+	last := 0
+	for _, loc := range announcementURLRe.FindAllStringIndex(raw, -1) {
+		url := raw[loc[0]:loc[1]]
+		core := strings.TrimRight(url, announcementURLTailChars)
+		tail := url[len(core):]
+		b.WriteString(escapeAnnouncementText(raw[last:loc[0]]))
+		escaped := html.EscapeString(core)
+		b.WriteString(`<a href="` + escaped + `" target="_blank" rel="noopener noreferrer nofollow">` + escaped + `</a>`)
+		b.WriteString(escapeAnnouncementText(tail))
+		last = loc[1]
+	}
+	b.WriteString(escapeAnnouncementText(raw[last:]))
+	return htmltemplate.HTML(b.String())
+}
+
+func escapeAnnouncementText(s string) string {
+	return strings.ReplaceAll(html.EscapeString(s), "\n", "<br>")
+}

internal/template/announcement_test.go

@@ -0,0 +1,63 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package template
+
+import "testing"
+
+func TestAnnouncementHTML(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"纯文本原样输出", "机房维护通知", "机房维护通知"},
+		{"真实换行转 br", "第一行\n第二行", "第一行<br>第二行"},
+		{"字面量 \\n 也转 br", `第一行\n第二行`, "第一行<br>第二行"},
+		{"crlf 不产生多余 br", "第一行\r\n第二行", "第一行<br>第二行"},
+		{
+			"标签按字面转义",
+			`<script>alert(1)</script>`,
+			`&lt;script&gt;alert(1)&lt;/script&gt;`,
+		},
+		{
+			"地址自动变链接",
+			"详见 https://status.example.com/incident 谢谢",
+			`详见 <a href="https://status.example.com/incident" target="_blank" rel="noopener noreferrer nofollow">https://status.example.com/incident</a> 谢谢`,
+		},
+		{
+			"查询串的 & 被转义",
+			"https://example.com/a?b=1&c=2",
+			`<a href="https://example.com/a?b=1&amp;c=2" target="_blank" rel="noopener noreferrer nofollow">https://example.com/a?b=1&amp;c=2</a>`,
+		},
+		{
+			"句末中文标点不进链接",
+			"见 https://example.com/x。",
+			`见 <a href="https://example.com/x" target="_blank" rel="noopener noreferrer nofollow">https://example.com/x</a>。`,
+		},
+		{
+			"句末英文标点不进链接",
+			"https://example.com/x, thanks",
+			`<a href="https://example.com/x" target="_blank" rel="noopener noreferrer nofollow">https://example.com/x</a>, thanks`,
+		},
+		{
+			"裸 scheme 不当链接",
+			"https:// 后面没写地址",
+			"https:// 后面没写地址",
+		},
+		{
+			"引号无法逃逸属性",
+			`https://example.com/"><img src=x onerror=alert(1)>`,
+			`<a href="https://example.com/" target="_blank" rel="noopener noreferrer nofollow">https://example.com/</a>&#34;&gt;&lt;img src=x onerror=alert(1)&gt;`,
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got := string(AnnouncementHTML(c.in))
+			if got != c.want {
+				t.Fatalf("AnnouncementHTML(%q)\n got  %q\n want %q", c.in, got, c.want)
+			}
+		})
+	}
+}

internal/template/template.go

@@ -65,6 +65,15 @@ func FuncMap() []template.FuncMap {
 			"SentryDSN": func() string {
 				return conf.App.SentryDSN
 			},
+			// announcement 返回当前应展示的公告（已转义的安全 HTML），窗口外返回空串。
+			// 时间窗判定放在服务端：不依赖访客时钟，也不会先渲染出来再被脚本抹掉。
+			"announcement": func() template.HTML {
+				content, ok := conf.Announcement.Active(time.Now())
+				if !ok {
+					return ""
+				}
+				return AnnouncementHTML(content)
+			},
 			"ParsePublicURLs": func(input datatypes.JSON) string {
 				urls := make(map[string]string)
 				if err := json.Unmarshal(input, &urls); err != nil {