📅 TeleBox 日报 - 2026-05-01

📊 今日提交统计
• 总提交数: 62
• TeleBox: 6 次提交
• TeleBox_Plugins: 56 次提交

🔌 插件更新
• admin_board: escape dynamic user display and comment text in HTML output
• aff: escape preview content and error messages in HTML responses
• autodelcmd: escape rule params, response text, and error messages in HTML
• autorepeat: add htmlEscape helper and escape group titles in HTML output
• bgp: escape command output in <blockquote> HTML blocks
• bs: escape entity names and usernames in formatEntity() HTML output
• da: escape task chatName, statusText, and recent errors in HTML messages
• dbdj: escape entity names and usernames in formatEntity() HTML output
• dc: escape user firstName/title and error strings in HTML messages
• deepwiki: escape AI answer content and config values in HTML output
• eat: escape <名称> placeholder in help text
• eatgif: escape sticker name in HTML output
• epic: escape game.url in <a href> attribute
• fadian: escape <名字> placeholder in help text
• git_PR: escape repo names, PR numbers, and list content in HTML output
• gt: escape import error, original preview, translated text, and display error
• help: use formatted TeleBox display version
• ids: escape link URLs, info values, and username display in HTML output
• ip: escape <IP地址> and <域名> placeholders in help text
• isalive: escape username, lastOnlineDateTime, and lastMessageTime in HTML
• jupai: add htmlEscape helper and escape error messages in HTML responses
• keyword: escape task key, firstName, and taskList content in HTML output
• kitt: add htmlEscape/codeTag helpers, escape task IDs and command blocks
• komari: escape <节点名> and <URL> placeholders in help text
• listusernames: escape title, chatType, and username in HTML output
• lottery: escape warehouse names, prize text, winner display, and keywords
• manage_admin: escape entity username, target, error, and rank text in HTML
• mode: add htmlEscape helper, escape list.join() content in <code> blocks
• music_bot: add htmlEscape helper, escape keyword and bot name in HTML
• netease: add htmlEscape helper, escape error messages and keyword in HTML
• news: validate URL before <a href>, escape URL attribute and title
• nezha: escape server name and country flag in HTML status output
• ntp: escape server/IP/error/hint/command/stdout in HTML contexts
• openlist: add htmlEscape/codeTag/preTag, escape stdout in <pre> and errors
• oxost: escape debug hex/header JSON strings in <code> blocks
• parsehub: escape reasonText and detailed error text in HTML messages
• ping: escape IP/域名 placeholder in description
• pmcaptcha:
- add htmlEscape/codeTag/attrEscape, escape help prefix, prompts, user names, config values
- Merge remote-tracking branch 'origin/main' into fix/pmcaptcha-help-text
• qr: escape <文本> placeholder and result text in HTML output
• rate: add codeTag helper, escape dynamic symbol/type/error content in HTML
• save: escape dynamic message-link display text and forwarded content in HTML
• search: escape <add
• sendLog: fix uninterpolated template string and escape placeholders
• service: escape <服务名> placeholder in help text
• shift: escape usernames, exported base64 payload, and action text in HTML
• soutu: escape googleUrl, yandexUrl, and pluginName in HTML output
• speedlink: escape <别名>, <密码>, <私钥路径> and other placeholders
• speedtest: escape server config, network status, and test result fields
• ssh: escape keyType, keyPreview, hostname, ipAddress, command output in HTML
• status: replace fullwidth angle brackets with HTML entities in help text
• subinfo: escape URLs and TXT fallback previews in HTML output
• sum: add htmlEscape/codeTag/attrEscape, escape task IDs, prompts, chat display, result messages
• tpm: escape dynamic content in Telegram HTML parseMode
• trace: escape <词> placeholder in help text
• tts: add Telegram htmlEscape/codeTag separate from SSML, escape voice/filte

_... 消息过长已截断_