From 3b660203dd4ee0e576b05d97786c38463789f745 Mon Sep 17 00:00:00 2001
From: ZhangYonghao <837684951@qq.com>
Date: Sat, 21 Mar 2026 21:27:20 +0800
Subject: [PATCH] =?UTF-8?q?fix:=E4=BF=AE=E5=A4=8D=E6=8E=A5=E5=8F=A3?=
 =?UTF-8?q?=E8=B0=83=E7=94=A8=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                   | 17 +++++++++++++++--
 backend/.env                |  2 +-
 backend/.env.example        |  2 +-
 backend/app/routers/html.py | 19 +++++++++++++------
 backend/app/schemas.py      |  7 +++++++
 5 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index d3157e3..f56f62e 100644
--- a/README.md
+++ b/README.md
@@ -123,7 +123,7 @@
 
 ## 内容限制和安全规则
 
-默认开启安全拦截，以下内容会被拒绝：
+当 `ALLOW_UNSAFE_HTML=false` 时，默认开启安全拦截，以下内容会被拒绝：
 
 - `<script>`
 - `<iframe>`
@@ -136,6 +136,19 @@
 
 这是为了避免智能体把任意动态脚本直接挂到线上域名下。
 
+当前项目默认配置已经改为 `ALLOW_UNSAFE_HTML=true`，也就是：
+
+- 不再拦截 `<script>`、`<link>` 等标签
+- 返回 HTML 时不再附加严格的 CSP 头
+- 适合需要 JavaScript 动态展示的页面
+
+这意味着安全风险将由你们自己兜底，建议至少做到：
+
+- 独立子域名部署
+- 不挂载登录态 Cookie
+- 不与主站后台同域
+- 对智能体输出做额外审核
+
 ### 推荐约束
 
 - 推荐把生成 HTML 的访问域名单独隔离，例如 `html.example.com`
@@ -201,7 +214,7 @@ NEXT_PUBLIC_API_BASE_URL=http://localhost:8000
 | `MAX_RETENTION_DAYS` | integer | `30` | 最大允许保留天数 |
 | `MAX_HTML_LENGTH` | integer | `200000` | 单次 HTML 最大字节数 |
 | `API_KEY` | string | 空 | 非空时启用 `X-API-Key` 鉴权 |
-| `ALLOW_UNSAFE_HTML` | boolean | `false` | 是否关闭 HTML 安全拦截，不建议生产开启 |
+| `ALLOW_UNSAFE_HTML` | boolean | `true` | 是否关闭 HTML 安全拦截；当前默认开启，便于执行 JS |
 
 ## 给腾讯云智能体的最小参数说明
 
diff --git a/backend/.env b/backend/.env
index 4424c19..3214aae 100644
--- a/backend/.env
+++ b/backend/.env
@@ -7,4 +7,4 @@ DEFAULT_RETENTION_DAYS=7
 MAX_RETENTION_DAYS=30
 MAX_HTML_LENGTH=200000
 API_KEY=""
-ALLOW_UNSAFE_HTML=false
+ALLOW_UNSAFE_HTML=true
diff --git a/backend/.env.example b/backend/.env.example
index 4424c19..3214aae 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -7,4 +7,4 @@ DEFAULT_RETENTION_DAYS=7
 MAX_RETENTION_DAYS=30
 MAX_HTML_LENGTH=200000
 API_KEY=""
-ALLOW_UNSAFE_HTML=false
+ALLOW_UNSAFE_HTML=true
diff --git a/backend/app/routers/html.py b/backend/app/routers/html.py
index 2693e35..d5b3618 100644
--- a/backend/app/routers/html.py
+++ b/backend/app/routers/html.py
@@ -49,6 +49,18 @@ CONTENT_SECURITY_POLICY = "; ".join(
 )
 
 
+def build_response_headers() -> dict[str, str]:
+    headers = {
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "no-referrer",
+        "Cache-Control": "public, max-age=300",
+    }
+    if not settings.allow_unsafe_html:
+        headers["Content-Security-Policy"] = CONTENT_SECURITY_POLICY
+
+    return headers
+
+
 def require_api_key(x_api_key: str | None = Header(default=None, alias="X-API-Key")) -> None:
     if not settings.api_key:
         return
@@ -316,10 +328,5 @@ def get_html_content(unique_id: str, db: Session = Depends(get_db)) -> FileRespo
     return FileResponse(
         path=file_path,
         media_type="text/html",
-        headers={
-            "Content-Security-Policy": CONTENT_SECURITY_POLICY,
-            "X-Content-Type-Options": "nosniff",
-            "Referrer-Policy": "no-referrer",
-            "Cache-Control": "public, max-age=300",
-        },
+        headers=build_response_headers(),
     )
diff --git a/backend/app/schemas.py b/backend/app/schemas.py
index ed0d86e..f2df9bd 100644
--- a/backend/app/schemas.py
+++ b/backend/app/schemas.py
@@ -33,6 +33,13 @@ class HTMLGenerateRequest(BaseModel):
 
     @root_validator(pre=True)
     def normalize_aliases(cls, values: dict) -> dict:
+        if isinstance(values.get("body"), dict):
+            merged_values = dict(values["body"])
+            for key, value in values.items():
+                if key != "body" and key not in merged_values:
+                    merged_values[key] = value
+            values = merged_values
+
         alias_map = {
             "html": "html_content",
             "content": "html_content",