fix(missingModelDownload): reject mirror URLs with query or fragment

Author: xingchen-mu

src/platform/missingModel/missingModelDownload.test.ts

@@ -788,6 +788,24 @@ describe('resolveHuggingFaceUrl', () => {
     expect(consoleWarn).toHaveBeenCalled()
   })
 
+  it('ignores a mirror with a query component', () => {
+    mockHuggingFaceMirror.value = 'https://hf-mirror.com?token=abc'
+    const consoleWarn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    expect(
+      resolveHuggingFaceUrl('https://huggingface.co/org/model/resolve/main/x')
+    ).toBe('https://huggingface.co/org/model/resolve/main/x')
+    expect(consoleWarn).toHaveBeenCalled()
+  })
+
+  it('ignores a mirror with a fragment component', () => {
+    mockHuggingFaceMirror.value = 'https://hf-mirror.com#section'
+    const consoleWarn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    expect(
+      resolveHuggingFaceUrl('https://huggingface.co/org/model/resolve/main/x')
+    ).toBe('https://huggingface.co/org/model/resolve/main/x')
+    expect(consoleWarn).toHaveBeenCalled()
+  })
+
   it('leaves non-HuggingFace URLs untouched', () => {
     mockHuggingFaceMirror.value = 'https://hf-mirror.com'
     expect(

src/platform/missingModel/missingModelDownload.ts

@@ -46,8 +46,9 @@ export const HUGGINGFACE_MIRROR_SETTING_ID =
  * users behind networks blocking `huggingface.co` can still use the
  * "Download All missing models" button. Empty/missing setting returns
  * the URL unchanged. Non-HuggingFace URLs are returned unchanged.
- * Mirrors that are not absolute http(s) URLs are ignored and warned
- * about, to avoid producing broken download URLs.
+ * Mirrors that are not absolute http(s) URLs, or that carry a query
+ * or fragment component, are ignored and warned about, to avoid
+ * producing broken download URLs.
  */
 export function resolveHuggingFaceUrl(url: string): string {
   const mirror = useSettingStore()
@@ -64,6 +65,12 @@ export function resolveHuggingFaceUrl(url: string): string {
       )
       return url
     }
+    if (parsed.search || parsed.hash) {
+      console.warn(
+        `[missingModelDownload] Ignoring ${HUGGINGFACE_MIRROR_SETTING_ID}: mirror must not include a query or fragment`
+      )
+      return url
+    }
     return url.replace('https://huggingface.co', mirror)
   } catch {
     console.warn(