@cosui/genui-toolkit 1.0.0

package/dist/check/rules/html.js

@@ -0,0 +1,414 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.htmlRule = void 0;
+const parse5 = __importStar(require("parse5"));
+const common_1 = require("./common");
+const ruleId = 'html';
+const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
+const NAVIGATION_TAGS = new Set(['a', 'area']);
+const NAVIGATION_TARGET_TAGS = new Set(['a', 'area', 'base', 'form']);
+const JAVASCRIPT_URL_ATTRIBUTES = new Map([
+    ['a', new Set(['href'])],
+    ['area', new Set(['href'])],
+    ['form', new Set(['action'])],
+]);
+const FORBIDDEN_EMBEDDED_ELEMENTS = new Set([
+    'iframe',
+    'frame',
+    'fencedframe',
+    'object',
+    'embed',
+]);
+const NAVIGATION_TARGETS = new Set(['_top', '_parent', '_blank']);
+/**
+ * 创建所有 HTML 规则共享的解析上下文
+ */
+async function createContext(file) {
+    const source = await (0, common_1.readUtf8)(file);
+    const document = parse5.parse(source, { sourceCodeLocationInfo: true });
+    return {
+        file,
+        document,
+    };
+}
+function getTagName(node) {
+    return (node.tagName ?? '').toLowerCase();
+}
+/**
+ * 深度优先遍历 HTML AST
+ */
+function walk(node, visitor, parentForm) {
+    const ancestorForm = getTagName(node) === 'form' ? node : parentForm;
+    visitor(node, ancestorForm);
+    for (const child of node.childNodes ?? []) {
+        walk(child, visitor, ancestorForm);
+    }
+}
+function getAttributes(node) {
+    return node.attrs ?? [];
+}
+function createAttributeMap(node) {
+    return new Map(getAttributes(node).map(attribute => [
+        attribute.name.toLowerCase(),
+        attribute,
+    ]));
+}
+function getLocation(node, attributeName) {
+    const attributeLocation = attributeName
+        ? node.sourceCodeLocation?.attrs?.[attributeName.toLowerCase()]
+        : undefined;
+    const location = attributeLocation ?? node.sourceCodeLocation;
+    return location?.startLine !== undefined && location.startCol !== undefined
+        ? { line: location.startLine, column: location.startCol }
+        : {};
+}
+function isNavigationUrl(value) {
+    const normalized = value.trim().toLowerCase();
+    return normalized.length > 0
+        && !normalized.startsWith('#')
+        && !normalized.startsWith('?')
+        && !normalized.startsWith('javascript:');
+}
+function getMetaRefreshTarget(value) {
+    const match = /^\s*\d+\s*(?:;(.*))?$/s.exec(value);
+    if (!match?.[1]) {
+        return null;
+    }
+    let target = match[1].trim().replace(/^url\s*=\s*/i, '').trim();
+    const quote = target[0];
+    if (target.length >= 2
+        && ['"', '\''].includes(quote)
+        && target.endsWith(quote)) {
+        target = target.slice(1, -1).trim();
+    }
+    return target || null;
+}
+/**
+ * 禁止使用会改变相对资源路径基准的 base 标签
+ */
+function checkBase(node) {
+    if (getTagName(node) !== 'base') {
+        return null;
+    }
+    return {
+        ...getLocation(node),
+        severity: 'error',
+        message: '请检查并移除<base>标签，改用相对当前文件的资源路径后重新打包上传',
+    };
+}
+/**
+ * 禁止 Meta Refresh 和非锚点页面跳转
+ */
+function checkNavigation(node) {
+    const tagName = getTagName(node);
+    const attributes = createAttributeMap(node);
+    const httpEquiv = attributes.get('http-equiv');
+    const content = attributes.get('content');
+    const refreshTarget = content ? getMetaRefreshTarget(content.value) : null;
+    const isRefresh = tagName === 'meta'
+        && httpEquiv?.value.trim().toLowerCase() === 'refresh'
+        && content
+        && /^\s*\d+\s*(?:;|$)/.test(content.value);
+    if (isRefresh && (!refreshTarget || isNavigationUrl(refreshTarget))) {
+        return {
+            ...getLocation(node, 'http-equiv'),
+            severity: 'error',
+            message: '页面包含自动跳转，请删除 Meta Refresh 并改用页面内锚点',
+        };
+    }
+    const href = attributes.get('href');
+    if (NAVIGATION_TAGS.has(tagName) && href && isNavigationUrl(href.value)) {
+        return {
+            ...getLocation(node, 'href'),
+            severity: 'error',
+            message: '页面包含跳转链接，请删除该链接并改用页面内锚点',
+        };
+    }
+    return null;
+}
+/**
+ * 禁止可能跳出隔离容器或打开新窗口的 target
+ */
+function checkNavigationTarget(node, formsWithSubmitTarget) {
+    const tagName = getTagName(node);
+    if (!NAVIGATION_TARGET_TAGS.has(tagName)) {
+        return null;
+    }
+    const attributes = createAttributeMap(node);
+    const target = attributes.get('target');
+    if (!target || !NAVIGATION_TARGETS.has(target.value.trim().toLowerCase())) {
+        return null;
+    }
+    if ((tagName === 'a' || tagName === 'area') && !attributes.get('href')?.value.trim()) {
+        return null;
+    }
+    if (tagName === 'form' && !formsWithSubmitTarget.has(node)) {
+        return null;
+    }
+    return {
+        ...getLocation(node, 'target'),
+        severity: 'error',
+        message: `链接使用了 target="${target.value.trim()}"，请移除该属性`,
+    };
+}
+/**
+ * 禁止导航和资源属性中的 javascript: 链接
+ */
+function checkJavascriptUrl(node) {
+    if (node.namespaceURI === SVG_NAMESPACE) {
+        return null;
+    }
+    const supportedAttributes = JAVASCRIPT_URL_ATTRIBUTES.get(getTagName(node));
+    if (!supportedAttributes) {
+        return null;
+    }
+    for (const attribute of getAttributes(node)) {
+        if (supportedAttributes.has(attribute.name.toLowerCase())
+            && attribute.value.trim().toLowerCase().startsWith('javascript:')) {
+            return {
+                ...getLocation(node, attribute.name),
+                severity: 'error',
+                message: '链接使用了 javascript: 协议，请改用普通链接并通过 JavaScript 事件监听处理',
+            };
+        }
+    }
+    return null;
+}
+/**
+ * 禁止创建子页面、插件或其他嵌入式执行环境
+ */
+function checkEmbeddedElement(node) {
+    const tagName = getTagName(node);
+    if (node.namespaceURI !== HTML_NAMESPACE || !FORBIDDEN_EMBEDDED_ELEMENTS.has(tagName)) {
+        return null;
+    }
+    return {
+        ...getLocation(node),
+        severity: 'error',
+        message: `页面包含 <${tagName}> 标签，请移除该标签并将内容直接放到当前页面`,
+    };
+}
+/**
+ * 禁止检查 onclick、onload 等行内事件属性
+ */
+function checkInlineHandler(node) {
+    if (node.namespaceURI === SVG_NAMESPACE) {
+        return null;
+    }
+    for (const attribute of getAttributes(node)) {
+        if ((0, common_1.isInlineHandlerAttribute)(attribute.name, getTagName(node))) {
+            return {
+                ...getLocation(node, attribute.name),
+                severity: 'error',
+                message: '页面包含 onclick 等行内事件，请改用 JavaScript 事件监听',
+            };
+        }
+    }
+    return null;
+}
+/**
+ * 检查 HTML 文件中的内联 SVG；独立 .svg 文件由 svgRule 检查
+ * 禁止 SVG 脚本、行内事件和 JavaScript URI
+ */
+function checkSvgActiveContent(node) {
+    if (node.namespaceURI !== SVG_NAMESPACE) {
+        return null;
+    }
+    if (getTagName(node) === 'script') {
+        return {
+            ...getLocation(node),
+            severity: 'error',
+            message: 'SVG 中包含 script 脚本，请删除该脚本',
+        };
+    }
+    for (const attribute of getAttributes(node)) {
+        const name = attribute.name.toLowerCase();
+        const isJavascriptUrl = ['href', 'xlink:href'].includes(name)
+            && attribute.value.trim().toLowerCase().startsWith('javascript:');
+        if (isJavascriptUrl || (0, common_1.isInlineHandlerAttribute)(name, getTagName(node))) {
+            return {
+                ...getLocation(node, attribute.name),
+                severity: 'error',
+                message: 'SVG 中包含行内事件或 javascript: 链接，请删除相关内容',
+            };
+        }
+    }
+    return null;
+}
+/**
+ * 禁止 form 提交
+ */
+function checkFormAction(node, formOwner) {
+    const attributes = createAttributeMap(node);
+    const tagName = getTagName(node);
+    if (tagName === 'form'
+        && attributes.has('action')
+        && attributes.get('method')?.value.trim().toLowerCase() !== 'dialog') {
+        return {
+            ...getLocation(node, 'action'),
+            severity: 'error',
+            message: '表单设置了提交地址，请阻止默认提交并改为在当前页面处理数据',
+        };
+    }
+    const type = attributes.get('type')?.value.trim().toLowerCase() ?? '';
+    const isSubmitControl = tagName === 'button' && (!type || type === 'submit')
+        || tagName === 'input' && ['submit', 'image'].includes(type);
+    if (formOwner
+        && isSubmitControl
+        && attributes.has('formaction')
+        && attributes.get('formmethod')?.value.trim().toLowerCase() !== 'dialog') {
+        return {
+            ...getLocation(node, 'formaction'),
+            severity: 'error',
+            message: '提交按钮设置了 formaction，请删除该属性并在当前页面处理数据',
+        };
+    }
+    return null;
+}
+function checkDownload(node) {
+    const attributes = createAttributeMap(node);
+    if (getTagName(node) !== 'a'
+        || !attributes.has('download')
+        || !attributes.get('href')?.value.trim()) {
+        return null;
+    }
+    return {
+        ...getLocation(node, 'download'),
+        severity: 'error',
+        message: '链接使用了 download 属性，请删除该属性并改为在页面内展示内容',
+    };
+}
+function checkManifest(node) {
+    const attributes = createAttributeMap(node);
+    const rel = new Set((attributes.get('rel')?.value ?? '').toLowerCase().split(/\s+/));
+    if (getTagName(node) !== 'link'
+        || !rel.has('manifest')
+        || !attributes.get('href')?.value.trim()) {
+        return null;
+    }
+    return {
+        ...getLocation(node, 'rel'),
+        severity: 'warning',
+        message: '页面引用了 manifest 应用清单，请删除该链接',
+    };
+}
+/**
+ * HTML 规则统一入口
+ *
+ * HTML 文件只读取、解析一次，随后按顺序执行所有 HTML 规则
+ */
+async function checkHtmlRules(file) {
+    const context = await createContext(file);
+    const problems = [];
+    const elementsById = new Map();
+    walk(context.document, node => {
+        const id = createAttributeMap(node).get('id')?.value;
+        if (id && !elementsById.has(id)) {
+            elementsById.set(id, node);
+        }
+    });
+    const getFormOwner = (node, ancestorForm) => {
+        const formId = createAttributeMap(node).get('form');
+        const associatedElement = formId ? elementsById.get(formId.value) : ancestorForm;
+        return getTagName(associatedElement ?? {}) === 'form' ? associatedElement : undefined;
+    };
+    const formsWithSubmitTarget = new Set();
+    walk(context.document, (node, ancestorForm) => {
+        const attributes = createAttributeMap(node);
+        const tagName = getTagName(node);
+        if (tagName === 'form'
+            && attributes.has('action')
+            && attributes.get('method')?.value.trim().toLowerCase() !== 'dialog') {
+            formsWithSubmitTarget.add(node);
+        }
+        const type = attributes.get('type')?.value.trim().toLowerCase() ?? '';
+        const isSubmitControl = tagName === 'button' && (!type || type === 'submit')
+            || tagName === 'input' && ['submit', 'image'].includes(type);
+        if (isSubmitControl
+            && attributes.has('formaction')
+            && attributes.get('formmethod')?.value.trim().toLowerCase() !== 'dialog') {
+            const owner = getFormOwner(node, ancestorForm);
+            if (owner) {
+                formsWithSubmitTarget.add(owner);
+            }
+        }
+    });
+    const checks = [
+        checkBase,
+        checkNavigation,
+        checkJavascriptUrl,
+        checkEmbeddedElement,
+        checkInlineHandler,
+        checkSvgActiveContent,
+        checkDownload,
+        checkManifest,
+    ];
+    walk(context.document, (node, ancestorForm) => {
+        const targetProblem = checkNavigationTarget(node, formsWithSubmitTarget);
+        if (targetProblem) {
+            problems.push(targetProblem);
+        }
+        const formOwner = getFormOwner(node, ancestorForm);
+        const formProblem = checkFormAction(node, formOwner);
+        if (formProblem) {
+            problems.push(formProblem);
+        }
+        for (const check of checks) {
+            const problem = check(node);
+            if (problem) {
+                problems.push(problem);
+            }
+        }
+    });
+    return (0, common_1.toDiagnostics)(ruleId, problems.map(problem => ({
+        ...problem,
+        file: context.file.name,
+    })));
+}
+exports.htmlRule = {
+    id: ruleId,
+    async check({ artifact }) {
+        const diagnostics = [];
+        for (const file of artifact.files.values()) {
+            if (file.path.toLowerCase().endsWith('.html')) {
+                diagnostics.push(...await checkHtmlRules((0, common_1.toFile)(file)));
+            }
+        }
+        return diagnostics;
+    },
+};
+//# sourceMappingURL=html.js.map

package/dist/check/rules/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../src/check/rules/html.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AACjC,qCAAmF;AAiCnF,MAAM,MAAM,GAAG,MAAM,CAAC;AACtB,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACtE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAsB;IAC3D,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxB,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3B,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IACxC,QAAQ;IACR,OAAO;IACP,aAAa;IACb,QAAQ;IACR,OAAO;CACV,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,IAAU;IACnC,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAQ,EAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC,sBAAsB,EAAE,IAAI,EAAC,CAAwB,CAAC;IAE7F,OAAO;QACH,IAAI;QACJ,QAAQ;KACX,CAAC;AACN,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAC9B,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,IAAI,CACT,IAAc,EACd,OAA0D,EAC1D,UAAqB;IAErB,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACrE,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAE5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACjC,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAc;IACtC,OAAO,IAAI,GAAG,CACV,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE;QAC5B,SAAS;KACZ,CAAC,CACL,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,aAAsB;IACvD,MAAM,iBAAiB,GAAG,aAAa;QACnC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,CAAC,kBAAkB,CAAC;IAC9D,OAAO,QAAQ,EAAE,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;QACvE,CAAC,CAAC,EAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAC;QACvD,CAAC,CAAC,EAAE,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC;WACrB,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;WAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;WAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;WACf,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;WAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3B,CAAC;QACC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,IAAc;IAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,GAAG,WAAW,CAAC,IAAI,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,qCAAqC;KACjD,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAAc;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,SAAS,GAAG,OAAO,KAAK,MAAM;WAC7B,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,SAAS;WACnD,OAAO;WACP,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO;YACH,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;YAClC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,oCAAoC;SAChD,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO;YACH,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;YAC5B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,yBAAyB;SACrC,CAAC;IACN,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC1B,IAAc,EACd,qBAA4C;IAE5C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC9B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,iBAAiB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU;KAC1D,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAc;IACtC,IAAI,IAAI,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;eAClD,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EACnE,CAAC;YACC,OAAO;gBACH,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;gBACpC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,mDAAmD;aAC/D,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAc;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,GAAG,WAAW,CAAC,IAAI,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,SAAS,OAAO,yBAAyB;KACrD,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAc;IACtC,IAAI,IAAI,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,IAAA,iCAAwB,EAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACH,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;gBACpC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,wCAAwC;aACpD,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAc;IACzC,IAAI,IAAI,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO;YACH,GAAG,WAAW,CAAC,IAAI,CAAC;YACpB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,0BAA0B;SACtC,CAAC;IACN,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;eACtD,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAEtE,IAAI,eAAe,IAAI,IAAA,iCAAwB,EAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO;gBACH,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;gBACpC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,qCAAqC;aACjD,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAAc,EAAE,SAAoB;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,MAAM;WACf,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;WACxB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,EACtE,CAAC;QACC,OAAO;YACH,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC9B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,+BAA+B;SAC3C,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACtE,MAAM,eAAe,GAAG,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC;WACrE,OAAO,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,SAAS;WACN,eAAe;WACf,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;WAC5B,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,EAC1E,CAAC;QACC,OAAO;YACH,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;YAClC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,qCAAqC;SACjD,CAAC;IACN,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACjC,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,GAAG;WACrB,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;WAC3B,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAC1C,CAAC;QACC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO;QACH,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC;QAChC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,qCAAqC;KACjD,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACjC,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM;WACxB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;WACpB,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAC1C,CAAC;QACC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO;QACH,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,4BAA4B;KACxC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,IAAU;IACpC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE;QAC1B,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QACrD,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,CAAC,IAAc,EAAE,YAAuB,EAAwB,EAAE;QACnF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QACjF,OAAO,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAY,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE;QAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,MAAM;eACf,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;eACxB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,EACtE,CAAC;YACC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACtE,MAAM,eAAe,GAAG,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC;eACrE,OAAO,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,eAAe;eACZ,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;eAC5B,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,EAC1E,CAAC;YACC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC/C,IAAI,KAAK,EAAE,CAAC;gBACR,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG;QACX,SAAS;QACT,eAAe;QACf,kBAAkB;QAClB,oBAAoB;QACpB,kBAAkB;QAClB,qBAAqB;QACrB,aAAa;QACb,aAAa;KAChB,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE;QAC1C,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACzE,IAAI,aAAa,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAA,sBAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClD,GAAG,OAAO;QACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;KAC1B,CAAC,CAAC,CAAC,CAAC;AACT,CAAC;AAEY,QAAA,QAAQ,GAAS;IAC1B,EAAE,EAAE,MAAM;IACV,KAAK,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAC;QAClB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,cAAc,CAAC,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC;IACvB,CAAC;CACJ,CAAC"}

package/dist/check/rules/index.d.ts

@@ -0,0 +1,6 @@
+import type { Rule } from '../types';
+/**
+ * 产物诊断规则注册表
+ */
+export declare const rules: Rule[];
+//# sourceMappingURL=index.d.ts.map

package/dist/check/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/check/rules/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,UAAU,CAAC;AAEnC;;GAEG;AACH,eAAO,MAAM,KAAK,EAAE,IAAI,EAmDvB,CAAC"}

package/dist/check/rules/index.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rules = void 0;
+const artifact_1 = require("./artifact");
+const file_1 = require("./file");
+const html_1 = require("./html");
+const javascript_1 = require("./javascript");
+const svg_1 = require("./svg");
+/**
+ * 产物诊断规则注册表
+ */
+exports.rules = [
+    /**
+     * 拦截：
+     * 1、禁止不支持的 HTML/ZIP 格式，避免发布服务无法识别产物；
+     * 2、禁止缺少根 index.html，避免产物无法启动或加载；
+     * 3、禁止包含不支持的文件类型，避免产物无法启动或加载；
+     * 4、禁止超过体积上限，避免处理和发布时消耗异常资源。
+     */
+    artifact_1.artifactRule,
+    /**
+     * 拦截：
+     * 1、禁止绝对路径、路径穿越、反斜杠和 NUL 路径，避免解包越出产物根目录；
+     * 2、禁止隐藏文件、软链接、设备文件和加密条目，避免携带不可控内容；
+     * 3、禁止确定的编码和语法解析错误，避免文件无法被发布服务加载。
+     */
+    file_1.fileRule,
+    /**
+     * 拦截：
+     * 1、禁止 base 标签，避免改写资源路径基准；
+     * 2、禁止静态可确认的页面外跳，避免 iframe 离开当前产物并加载未经审核页面；
+     * 3、禁止 iframe、frame、fencedframe、object、embed 和 SVG 活跃内容，
+     *    避免创建未经审核的子页面、插件或脚本执行入口。
+     *
+     * 提醒：
+     * 1、禁止行内事件、JavaScript URI、表单、下载、manifest 和越界导航。
+     *    但仅做提醒，因为 script-src-attr、form-action、manifest CSP 和 sandbox 可以拦截。
+     */
+    html_1.htmlRule,
+    /**
+     * 拦截：
+     * 1、禁止 SVG 脚本、行内事件和 JavaScript URI，避免通过 SVG 执行未纳入审核的代码。
+     */
+    svg_1.svgRule,
+    /**
+     * 拦截：
+     * 1、禁止 JavaScript 语法错误，避免脚本无法执行；
+     * 2、禁止静态 location 外跳，避免 iframe 加载未经审核页面；
+     * 3、禁止 eval、Function、字符串定时器和明确的脚本或嵌入式环境写入、创建，
+     *    避免执行未纳入审核的代码；
+     * 4、禁止 RTCPeerConnection，避免绕过普通连接限制建立产物外通信。
+     *
+     * 提醒：
+     * 1、禁止 Worker、SharedWorker、ServiceWorker 和 window.open，
+     *   仅做提醒，因为 worker-src CSP 和 sandbox 可以拦截这些运行时入口。
+     */
+    javascript_1.javascriptRule,
+];
+//# sourceMappingURL=index.js.map

package/dist/check/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/check/rules/index.ts"],"names":[],"mappings":";;;AAAA,yCAAwC;AACxC,iCAAgC;AAChC,iCAAgC;AAChC,6CAA4C;AAC5C,+BAA8B;AAG9B;;GAEG;AACU,QAAA,KAAK,GAAW;IAEzB;;;;;;OAMG;IACH,uBAAY;IAEZ;;;;;OAKG;IACH,eAAQ;IAER;;;;;;;;;;OAUG;IACH,eAAQ;IAER;;;OAGG;IACH,aAAO;IAEP;;;;;;;;;;;OAWG;IACH,2BAAc;CACjB,CAAC"}

package/dist/check/rules/javascript.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../types';
+export declare const javascriptRule: Rule;
+//# sourceMappingURL=javascript.d.ts.map

package/dist/check/rules/javascript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.d.ts","sourceRoot":"","sources":["../../../src/check/rules/javascript.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAA2B,IAAI,EAAC,MAAM,UAAU,CAAC;AAwkB7D,eAAO,MAAM,cAAc,EAAE,IAyB5B,CAAC"}