@lobehub/chat 1.129.2 → 1.129.4

package/src/features/PluginStore/InstalledList/List/Item/Action.tsx

@@ -7,6 +7,7 @@ import { Flexbox } from 'react-layout-kit';
 
 import PluginDetailModal from '@/features/PluginDetailModal';
 import { useAgentStore } from '@/store/agent';
+import { agentSelectors } from '@/store/agent/selectors';
 import { useServerConfigStore } from '@/store/serverConfig';
 import { pluginHelpers, useToolStore } from '@/store/tool';
 import { pluginSelectors, pluginStoreSelectors } from '@/store/tool/selectors';
@@ -36,7 +37,10 @@ const Actions = memo<ActionsProps>(({ identifier, type, isMCP }) => {
   const { t } = useTranslation('plugin');
   const [open, setOpen] = useState(false);
   const plugin = useToolStore(pluginSelectors.getToolManifestById(identifier));
-  const togglePlugin = useAgentStore((s) => s.togglePlugin);
+  const [togglePlugin, isPluginEnabledInAgent] = useAgentStore((s) => [
+    s.togglePlugin,
+    agentSelectors.currentAgentPlugins(s).includes(identifier),
+  ]);
   const { modal } = App.useApp();
   const [tab, setTab] = useState('info');
   const hasSettings = pluginHelpers.isSettingSchemaNonEmpty(plugin?.settings);
@@ -90,7 +94,13 @@ const Actions = memo<ActionsProps>(({ identifier, type, isMCP }) => {
                       modal.confirm({
                         centered: true,
                         okButtonProps: { danger: true },
-                        onOk: async () => unInstallPlugin(identifier),
+                        onOk: async () => {
+                          // If plugin is enabled in current agent, disable it first
+                          if (isPluginEnabledInAgent) {
+                            await togglePlugin(identifier, false);
+                          }
+                          await unInstallPlugin(identifier);
+                        },
                         title: t('store.actions.confirmUninstall'),
                         type: 'error',
                       });

package/src/features/PluginStore/McpList/List/Action.tsx

@@ -6,6 +6,7 @@ import { useTranslation } from 'react-i18next';
 import { Flexbox } from 'react-layout-kit';
 
 import { useAgentStore } from '@/store/agent';
+import { agentSelectors } from '@/store/agent/selectors';
 import { useToolStore } from '@/store/tool';
 import { mcpStoreSelectors, pluginSelectors } from '@/store/tool/selectors';
 
@@ -24,7 +25,10 @@ const Actions = memo<ActionsProps>(({ identifier }) => {
     ]);
 
   const { t } = useTranslation('plugin');
-  const togglePlugin = useAgentStore((s) => s.togglePlugin);
+  const [togglePlugin, isPluginEnabledInAgent] = useAgentStore((s) => [
+    s.togglePlugin,
+    agentSelectors.currentAgentPlugins(s).includes(identifier),
+  ]);
   const { modal } = App.useApp();
 
   return (
@@ -42,7 +46,13 @@ const Actions = memo<ActionsProps>(({ identifier }) => {
                   modal.confirm({
                     centered: true,
                     okButtonProps: { danger: true },
-                    onOk: async () => unInstallPlugin(identifier),
+                    onOk: async () => {
+                      // If plugin is enabled in current agent, disable it first
+                      if (isPluginEnabledInAgent) {
+                        await togglePlugin(identifier, false);
+                      }
+                      await unInstallPlugin(identifier);
+                    },
                     title: t('store.actions.confirmUninstall'),
                     type: 'error',
                   });

package/src/features/PluginStore/PluginList/List/Action.tsx

@@ -6,6 +6,7 @@ import { useTranslation } from 'react-i18next';
 import { Flexbox } from 'react-layout-kit';
 
 import { useAgentStore } from '@/store/agent';
+import { agentSelectors } from '@/store/agent/selectors';
 import { useToolStore } from '@/store/tool';
 import { pluginSelectors, pluginStoreSelectors } from '@/store/tool/selectors';
 
@@ -22,7 +23,10 @@ const Actions = memo<ActionsProps>(({ identifier }) => {
   ]);
 
   const { t } = useTranslation('plugin');
-  const togglePlugin = useAgentStore((s) => s.togglePlugin);
+  const [togglePlugin, isPluginEnabledInAgent] = useAgentStore((s) => [
+    s.togglePlugin,
+    agentSelectors.currentAgentPlugins(s).includes(identifier),
+  ]);
   const { modal } = App.useApp();
 
   return (
@@ -40,7 +44,13 @@ const Actions = memo<ActionsProps>(({ identifier }) => {
                   modal.confirm({
                     centered: true,
                     okButtonProps: { danger: true },
-                    onOk: async () => unInstallPlugin(identifier),
+                    onOk: async () => {
+                      // If plugin is enabled in current agent, disable it first
+                      if (isPluginEnabledInAgent) {
+                        await togglePlugin(identifier, false);
+                      }
+                      await unInstallPlugin(identifier);
+                    },
                     title: t('store.actions.confirmUninstall'),
                     type: 'error',
                   });

package/src/features/Portal/Artifacts/Body/Renderer/SVG.tsx

@@ -1,15 +1,16 @@
+import { copyImageToClipboard, sanitizeSVGContent } from '@lobechat/utils/client';
 import { Button, Dropdown, Tooltip } from '@lobehub/ui';
 import { App, Space } from 'antd';
 import { css, cx } from 'antd-style';
 import { CopyIcon, DownloadIcon } from 'lucide-react';
 import { domToPng } from 'modern-screenshot';
+import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Center, Flexbox } from 'react-layout-kit';
 
 import { BRANDING_NAME } from '@/const/branding';
 import { useChatStore } from '@/store/chat';
 import { chatPortalSelectors } from '@/store/chat/selectors';
-import { copyImageToClipboard } from '@/utils/clipboard';
 
 const svgContainer = css`
   width: 100%;
@@ -36,6 +37,9 @@ const SVGRenderer = ({ content }: SVGRendererProps) => {
   const { t } = useTranslation('portal');
   const { message } = App.useApp();
 
+  // Sanitize SVG content to prevent XSS attacks
+  const sanitizedContent = useMemo(() => sanitizeSVGContent(content), [content]);
+
   const generatePng = async () => {
     return domToPng(document.querySelector(`#${DOM_ID}`) as HTMLDivElement, {
       features: {
@@ -50,7 +54,7 @@ const SVGRenderer = ({ content }: SVGRendererProps) => {
     let dataUrl = '';
     if (type === 'png') dataUrl = await generatePng();
     else if (type === 'svg') {
-      const blob = new Blob([content], { type: 'image/svg+xml' });
+      const blob = new Blob([sanitizedContent], { type: 'image/svg+xml' });
 
       dataUrl = URL.createObjectURL(blob);
     }
@@ -73,7 +77,7 @@ const SVGRenderer = ({ content }: SVGRendererProps) => {
     >
       <Center
         className={cx(svgContainer)}
-        dangerouslySetInnerHTML={{ __html: content }}
+        dangerouslySetInnerHTML={{ __html: sanitizedContent }}
         id={DOM_ID}
       />
       <Flexbox className={cx(actions)}>

package/src/server/modules/EdgeConfig/index.ts

@@ -2,16 +2,7 @@ import { EdgeConfigClient, createClient } from '@vercel/edge-config';
 
 import { appEnv } from '@/envs/app';
 
-const EdgeConfigKeys = {
-  /**
-   * Assistant whitelist
-   */
-  AssistantBlacklist: 'assistant_blacklist',
-  /**
-   * Assistant whitelist
-   */
-  AssistantWhitelist: 'assistant_whitelist',
-};
+import { EdgeConfigData } from './types';
 
 export class EdgeConfig {
   get client(): EdgeConfigClient {
@@ -30,14 +21,7 @@ export class EdgeConfig {
 
   getAgentRestrictions = async () => {
     const { assistant_blacklist: blacklist, assistant_whitelist: whitelist } =
-      await this.client.getAll([
-        EdgeConfigKeys.AssistantWhitelist,
-        EdgeConfigKeys.AssistantBlacklist,
-      ]);
-
-    return { blacklist, whitelist } as {
-      blacklist: string[] | undefined;
-      whitelist: string[] | undefined;
-    };
+      await this.client.getAll<EdgeConfigData>(['assistant_whitelist', 'assistant_blacklist']);
+    return { blacklist, whitelist };
   };
 }

package/src/server/modules/EdgeConfig/types.ts

@@ -0,0 +1,9 @@
+/* eslint-disable sort-keys-fix/sort-keys-fix, typescript-sort-keys/interface */
+
+/**
+ * EdgeConfig 完整配置类型
+ */
+export interface EdgeConfigData {
+  assistant_blacklist?: string[];
+  assistant_whitelist?: string[];
+}