1

Author: steve02081504

path/src/git.ps1

@@ -78,16 +78,16 @@ function script:git_fetch_remote_branch($Branch) {
 # Return PR number if target names a GitHub pull request (pr/N, pull/N, #N, or github.com/…/pull/N URL); else $null.
 function script:git_parse_pr_number($Target) {
 	if ([string]::IsNullOrEmpty($Target)) { return $null }
-	if ($Target -match '^(?i)pr/(\d+)$') { return $Matches[1] }
-	if ($Target -match '^(?i)pull/(\d+)$') { return $Matches[1] }
-	if ($Target -match '^#(\d+)$') { return $Matches[1] }
-	if ($Target -match '^https?://github\.com/[^/]+/[^/]+/pull/(\d+)(?:[/?#].*)?$') { return $Matches[1] }
+	if ($Target -match '^(?i)pr/([0-9]+)$') { return $Matches[1] }
+	if ($Target -match '^(?i)pull/([0-9]+)$') { return $Matches[1] }
+	if ($Target -match '^#([0-9]+)$') { return $Matches[1] }
+	if ($Target -match '^https?://github\.com/[^/]+/[^/]+/pull/([0-9]+)(?:[/?#].*)?$') { return $Matches[1] }
 	return $null
 }
 
 # One-shot map of GitHub pull/<n>/head into origin/pr/<n> (does not widen remote.origin.fetch).
 function script:git_fetch_pull_request($Pr) {
-	if ($Pr -notmatch '^\d+$') {
+	if ($Pr -notmatch '^[0-9]+$') {
 		$global:LastExitCode = 1
 		return
 	}

path/test/git.test.mjs

@@ -261,6 +261,7 @@ const INVALID_PR_TARGETS = [
 	'pr/0x1',
 	'pr/12/3',
 	'pr/12a',
+	'pr/١', // Unicode digit — must stay rejected (ASCII [0-9] only)
 	'pull/',
 	'#',
 	'#abc',

src/public/pages/scripts/features/embedCard.mjs

@@ -1,5 +1,6 @@
 import { escapeHtml } from '../lib/escapeHtml.mjs'
 import { memoizePromise } from '../lib/memo.mjs'
+import { isSafeHtmlUrl } from '../lib/sanitizeHtml.mjs'
 
 const TITLE_DISPLAY_MAX = 120
 const DESC_DISPLAY_MAX = 200
@@ -98,14 +99,15 @@ export const unfurl = memoizePromise(url => url, fetchUnfurl, { max: 128, ttlMs:
 export function renderEmbedCardHtml(embed) {
 	if (!embed?.url) return ''
 	const url = String(embed.url)
+	if (!isSafeHtmlUrl(url)) return ''
 	const title = truncateText(embed.title || url, TITLE_DISPLAY_MAX)
 	const description = truncateText(embed.description || '', DESC_DISPLAY_MAX)
 	const siteName = truncateText(embed.siteName || '', 80)
 	const image = String(embed.image || '').trim()
-	const imageHtml = image
+	const imageHtml = image && isSafeHtmlUrl(image)
 		? `<img class="fount-embed-card-thumb" src="${escapeHtml(image)}" alt="" loading="lazy" decoding="async" />`
 		: ''
-	const noImageClass = image ? '' : ' fount-embed-card-no-image'
+	const noImageClass = imageHtml ? '' : ' fount-embed-card-no-image'
 	const descHtml = description
 		? `<div class="fount-embed-card-desc">${escapeHtml(description)}</div>`
 		: ''
@@ -132,6 +134,7 @@ export function renderEmbedCardHtml(embed) {
 export function renderEmbedChipHtml(embed) {
 	if (!embed?.url) return ''
 	const url = String(embed.url)
+	if (!isSafeHtmlUrl(url)) return ''
 	let hostname = ''
 	try { hostname = new URL(url).hostname } catch { /* ignore */ }
 	const title = truncateText(embed.title || hostname || url, TITLE_DISPLAY_MAX)
@@ -149,14 +152,14 @@ export function renderEmbedChipHtml(embed) {
 }
 
 /**
- * @param {HTMLElement} el 占位链接
+ * @param {HTMLElement} element 占位链接
  * @returns {Promise<void>}
  */
-async function hydrateOne(el) {
-	const mode = el.getAttribute(ATTR)
+async function hydrateOne(element) {
+	const mode = element.getAttribute(ATTR)
 	if (!mode) return
-	el.removeAttribute(ATTR)
-	const url = el.getAttribute('href') || el.href
+	element.removeAttribute(ATTR)
+	const url = element.getAttribute('href') || element.href
 	if (!url) return
 	let meta
 	try {
@@ -173,16 +176,16 @@ async function hydrateOne(el) {
 	wrap.innerHTML = html
 	const replacement = wrap.firstElementChild
 	if (mode === 'card') {
-		const parent = el.parentElement
-		if (parent?.tagName === 'P' && [...parent.childNodes].every(n =>
-			n === el || (n.nodeType === Node.TEXT_NODE && !n.textContent?.trim()),
+		const parent = element.parentElement
+		if (parent?.tagName === 'P' && [...parent.childNodes].every(childNode =>
+			childNode === element || (childNode.nodeType === Node.TEXT_NODE && !childNode.textContent?.trim()),
 		))
 			parent.replaceWith(replacement)
 		else
-			el.replaceWith(replacement)
+			element.replaceWith(replacement)
 		return
 	}
-	el.replaceWith(replacement)
+	element.replaceWith(replacement)
 }
 
 /**
@@ -192,7 +195,7 @@ async function hydrateOne(el) {
 function hydrateIn(root) {
 	const list = root instanceof Element && root.hasAttribute(ATTR) ? [root] : []
 	list.push(...root.querySelectorAll(`[${ATTR}]`))
-	for (const el of list) void hydrateOne(/** @type {HTMLElement} */ el)
+	for (const element of list) void hydrateOne(/** @type {HTMLElement} */ element)
 }
 
 let observerStarted = false

src/public/parts/shells/chat/public/src/groupMode.mjs

@@ -24,12 +24,11 @@ export function attachOffscreenEmbedGuard(root) {
 
 	const observer = new IntersectionObserver(
 		(entries) => {
-			for (const entry of entries) {
+			for (const entry of entries)
 				if (entry.isIntersecting)
 					entry.target.querySelectorAll('iframe[data-suspended-src],video[data-suspended-src]').forEach(resume)
 				else
 					entry.target.querySelectorAll('iframe[src],video[src]').forEach(suspend)
-			}
 		},
 		{ root: null, rootMargin: '120px 0px', threshold: 0 },
 	)
@@ -45,13 +44,23 @@ export function attachOffscreenEmbedGuard(root) {
  */
 export function attachUntrustedMarkdownOffscreenGuard(bubble, { onReveal }) {
 	const observer = new IntersectionObserver(
-		(entries) => {
+		async (entries) => {
 			for (const entry of entries) {
 				if (entry.isIntersecting) continue
-				if (bubble.dataset.mdHydrated !== '1' || bubble.querySelector('.markdown-reveal-button')) continue
+				if (
+					bubble.dataset.mdHydrated !== '1'
+					|| bubble.dataset.mdMounting === '1'
+					|| bubble.querySelector('.markdown-reveal-button')
+				) continue
+				bubble.dataset.mdMounting = '1'
 				bubble.dataset.mdStash = bubble.innerHTML
 				bubble.replaceChildren()
-				void mountMdRevealButton(bubble, onReveal)
+				try {
+					await mountMdRevealButton(bubble, onReveal)
+				}
+				finally {
+					delete bubble.dataset.mdMounting
+				}
 			}
 		},
 		{ root: null, rootMargin: '80px 0px', threshold: 0 },

src/scripts/test/node/launch.mjs

@@ -548,7 +548,6 @@ async function launchNodeOnce(options = {}) {
 
 		await finishListenHold()
 
-		const denoBin = Deno.execPath()
 		let captureEnabled = false
 		let startupOutput = ''
 		let capturedOutput = ''
@@ -568,7 +567,7 @@ async function launchNodeOnce(options = {}) {
 		}
 
 		// stderr 始终 pipe：否则 EADDRINUSE 走 inherit 进不了 startupOutput，换口重试无法识别。
-		child = spawn(denoBin, workerArgs, {
+		child = spawn(Deno.execPath(), workerArgs, {
 			cwd: REPO_ROOT,
 			stdio: ['ignore', 'pipe', 'pipe'],
 			env: {

src/scripts/test/schedule_heap_snapshot_analysis.mjs

@@ -12,9 +12,8 @@ const ANALYZE_SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'tools/anal
  * @param {string} snapshotPath 快照绝对路径
  */
 export function scheduleHeapSnapshotAnalysis(snapshotPath) {
-	const deno = Deno.execPath()
 	const reportPath = `${snapshotPath}.analysis.txt`
-	spawn(deno, [
+	spawn(Deno.execPath(), [
 		'run', '--allow-read', '--allow-write',
 		'--v8-flags=--max-old-space-size=12288',
 		'-c', join(REPO_ROOT, 'deno.json'),