refactor: fix codeql warning (#22936)

lib/routes/hongkong/chp.ts

@@ -1,4 +1,5 @@
 import { load } from 'cheerio';
+import sanitizeHtml from 'sanitize-html';
 
 import type { Route } from '@/types';
 import cache from '@/utils/cache';
@@ -99,7 +100,7 @@ async function handler(ctx) {
             link,
             pubDate: parseDate(item.PublishDate),
             description: item[`Content_${language}`] ?? '',
-            title: item[`Title_${language}`]?.replace(/<.*>/, '') ?? '',
+            title: sanitizeHtml(item[`Title_${language}`] ?? '', { allowedTags: [], allowedAttributes: {} }),
         };
     });
 

lib/routes/hpoi/banner-item.ts

@@ -42,7 +42,7 @@ async function handler() {
             .map(async (_item) => {
                 const $item = $(_item);
                 const link = new URL($item.find('a').attr('href') ?? '', 'https://www.hpoi.net').href;
-                if (!link.startsWith('https://www.hpoi.net')) {
+                if (!link.startsWith('https://www.hpoi.net/')) {
                     return;
                 }
                 return await cache.tryGet(link, async () => {

lib/routes/soweather/warn.ts

@@ -93,10 +93,7 @@ function buildItem(warning: RawWarning, groupName: string): DataItem {
         description: content,
         content: {
             html: content,
-            text: content
-                .replaceAll(/<br\s*\/?>/gi, '\n')
-                .replaceAll(/<[^>]+>/g, '')
-                .trim(),
+            text: sanitizeHtml(content.replaceAll(/<br\s*\/?>/gi, '\n'), { allowedTags: [], allowedAttributes: {} }).trim(),
         },
         pubDate: timezone(parseDate(warning.fbsj, 'YYYY-MM-DD HH:mm'), 8),
         updated,

lib/routes/wechat/sogou.ts

@@ -81,7 +81,7 @@ async function fetchAndParsePage(wechatId: string): Promise<SogouItemInternal[]>
                 }
 
                 if (typeof location === 'string' && location) {
-                    if (location.startsWith('http://mp.weixin.qq.com') || location.startsWith('https://mp.weixin.qq.com')) {
+                    if (location.startsWith('http://mp.weixin.qq.com/') || location.startsWith('https://mp.weixin.qq.com/')) {
                         realLink = location;
                     } else {
                         try {
@@ -94,7 +94,7 @@ async function fetchAndParsePage(wechatId: string): Promise<SogouItemInternal[]>
                                 ignoreResponseError: true,
                             });
                             const intermediateLocation = intermediateResponse.headers?.get('location');
-                            if (intermediateLocation && (intermediateLocation.startsWith('http://mp.weixin.qq.com') || intermediateLocation.startsWith('https://mp.weixin.qq.com'))) {
+                            if (intermediateLocation && (intermediateLocation.startsWith('http://mp.weixin.qq.com/') || intermediateLocation.startsWith('https://mp.weixin.qq.com/'))) {
                                 realLink = intermediateLocation;
                             } else {
                                 // logger.warn(`Could not resolve final WeChat link for title "${title}" (wechatId: ${wechatId}) after intermediate redirect`);
@@ -116,7 +116,7 @@ async function fetchAndParsePage(wechatId: string): Promise<SogouItemInternal[]>
             }
         }
 
-        const isWeChatLink = realLink.startsWith('http://mp.weixin.qq.com') || realLink.startsWith('https://mp.weixin.qq.com');
+        const isWeChatLink = realLink.startsWith('http://mp.weixin.qq.com/') || realLink.startsWith('https://mp.weixin.qq.com/');
         const author = $li.find('span.all-time-y2').text().trim();
 
         return {

lib/routes/wikipedia/current-events.ts

@@ -1,3 +1,5 @@
+import sanitizeHtml from 'sanitize-html';
+
 import { config } from '@/config';
 import type { Route } from '@/types';
 import cache from '@/utils/cache';
@@ -219,8 +221,8 @@ function processListsAndLines(html: string): string {
 }
 
 function stripComments(html: string): string {
-    // Remove HTML comments
-    return html.replaceAll(/<!--[\s\S]*?-->/g, '');
+    // Remove HTML comments and unsafe tags
+    return sanitizeHtml(html);
 }
 
 // Wiki markup to HTML converter with proper list handling