@qmuse/qmuse-cli 1.0.5 → 1.0.6

package/README.md

@@ -46,6 +46,8 @@ qmuse import /path/to/react-project --space-id <spaceId>
 
 导入遵循项目根目录的 `.gitignore`，自动排除依赖目录、构建产物和 `.env*` 等文件。检测到私钥或凭证时会停止导入，请按提示处理后重试。
 
+新建和更新导入都会检查 HTML、JSX/TSX 等源码中能静态识别的 iframe `src`，拒绝 `/game/index.html`、`./page.html`、`../page.html`、`page.html` 等相对地址，并提示文件和行号。请将内嵌页面内容并入 React 应用，或使用完整的 HTTPS 地址。该检查不保证识别运行时计算或赋值的地址。
+
 导入失败时，按终端提示处理；如果生成了 `.qmuse/last-import-error.json`，可查看该文件定位问题。修复后重新执行导入命令。
 
 ### 更新已有应用

package/dist/import/iframe.js

@@ -0,0 +1,119 @@
+import ts from 'typescript';
+const SOURCE_EXTENSIONS = /\.(?:[cm]?[jt]s|[jt]sx|html?)$/iu;
+export function inspectsIframeSources(filename) {
+    return SOURCE_EXTENSIONS.test(filename) && !filename.endsWith('.d.ts');
+}
+function staticText(node) {
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+        return node.text;
+    if (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node)) {
+        return staticText(node.expression);
+    }
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        const left = staticText(node.left);
+        const right = staticText(node.right);
+        if (left !== undefined && right !== undefined)
+            return left + right;
+    }
+    if (ts.isTemplateExpression(node)) {
+        let value = node.head.text;
+        for (const span of node.templateSpans) {
+            const part = staticText(span.expression);
+            if (part === undefined)
+                return undefined;
+            value += part + span.literal.text;
+        }
+        return value;
+    }
+    return undefined;
+}
+// Decode URL-relevant HTML entities before deciding whether an address is absolute.
+function decodeHtml(value) {
+    return value.replace(/&(?:#(x[\da-f]+|\d+)|([a-z]+));/giu, (entity, numeric, name) => {
+        if (numeric) {
+            const code = numeric[0].toLowerCase() === 'x'
+                ? Number.parseInt(numeric.slice(1), 16) : Number(numeric);
+            return code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : entity;
+        }
+        return { colon: ':', sol: '/', period: '.', amp: '&', quot: '"', apos: "'" }[name.toLowerCase()] ?? entity;
+    });
+}
+/** Reject statically identifiable relative iframe URLs, including origin-root paths. */
+export function assertNoRelativeIframeSources(content, filename) {
+    const check = (value, offset) => {
+        const address = value.trim();
+        // Network-path references (//host/path) do not point into the published app.
+        if (/^[a-z][a-z\d+.-]*:/iu.test(address) || address.startsWith('//'))
+            return;
+        const line = content.slice(0, offset).split('\n').length;
+        throw new Error(`iframe 使用相对地址，拒绝导入：${filename}:${line}，src=${JSON.stringify(address)}。`
+            + '发布后该路径可能返回 404，请将页面内容并入 React 应用，或改用完整的 https:// 地址。');
+    };
+    const inspectHtml = (html, baseOffset) => {
+        // Preserve offsets while excluding HTML comments. Consume whole tags so an
+        // iframe-looking string inside another tag's quoted attribute is not a tag.
+        const visible = html.replace(/<!--[\s\S]*?(?:-->|$)/gu, match => ' '.repeat(match.length));
+        const tags = /<([a-z][\w:-]*)\b((?:[^>"']|"[^"]*"|'[^']*')*)>/giu;
+        for (const tag of visible.matchAll(tags)) {
+            if (tag[1].toLowerCase() !== 'iframe')
+                continue;
+            const attributes = /([^\s=/'"<>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/gu;
+            for (const attribute of tag[2].matchAll(attributes)) {
+                if (attribute[1].toLowerCase() !== 'src')
+                    continue;
+                const value = attribute[2] ?? attribute[3] ?? attribute[4];
+                if (value !== undefined)
+                    check(decodeHtml(value), baseOffset + tag.index);
+            }
+        }
+    };
+    if (/\.html?$/iu.test(filename)) {
+        inspectHtml(content, 0);
+        return;
+    }
+    if (!/iframe/iu.test(content))
+        return;
+    const source = ts.createSourceFile(filename, content, ts.ScriptTarget.Latest, true, /\.[jt]sx$/iu.test(filename) ? ts.ScriptKind.TSX
+        : /\.[cm]?ts$/iu.test(filename) ? ts.ScriptKind.TS : ts.ScriptKind.JS);
+    const visit = (node) => {
+        if ((ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node))
+            && node.tagName.getText(source) === 'iframe') {
+            for (const attribute of node.attributes.properties) {
+                if (!ts.isJsxAttribute(attribute) || attribute.name.getText(source) !== 'src')
+                    continue;
+                const initializer = attribute.initializer;
+                if (initializer && ts.isStringLiteral(initializer)) {
+                    check(decodeHtml(initializer.text), initializer.getStart(source));
+                }
+                else if (initializer && ts.isJsxExpression(initializer) && initializer.expression) {
+                    const value = staticText(initializer.expression);
+                    if (value !== undefined)
+                        check(value, initializer.getStart(source));
+                }
+            }
+        }
+        if (ts.isCallExpression(node)
+            && (node.expression.getText(source) === 'React.createElement'
+                || node.expression.getText(source) === 'createElement')
+            && node.arguments[0] && staticText(node.arguments[0]) === 'iframe'
+            && node.arguments[1] && ts.isObjectLiteralExpression(node.arguments[1])) {
+            for (const property of node.arguments[1].properties) {
+                if (!ts.isPropertyAssignment(property))
+                    continue;
+                const name = ts.isStringLiteral(property.name) ? property.name.text : property.name.getText(source);
+                if (name !== 'src')
+                    continue;
+                const value = staticText(property.initializer);
+                if (value !== undefined)
+                    check(value, property.initializer.getStart(source));
+            }
+        }
+        // Also cover HTML passed to innerHTML / dangerouslySetInnerHTML and templates.
+        if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+            if (/<iframe\b/iu.test(node.text))
+                inspectHtml(node.text, node.getStart(source));
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+}

package/dist/import/preflight.js

@@ -3,6 +3,7 @@ import { createReadStream } from 'node:fs';
 import { lstat, readFile, readdir } from 'node:fs/promises';
 import path from 'node:path';
 import ignore from 'ignore';
+import { assertNoRelativeIframeSources, inspectsIframeSources } from './iframe.js';
 const IGNORED_DIRECTORIES = new Set([
     '.git', '.agents', '.local', '.qmuse', '.muse-tmp', 'node_modules', 'dist', 'build', '.vite', '.turbo',
 ]);
@@ -203,6 +204,9 @@ export async function preflightImport(directory) {
         sourceHash.update('\0');
         await updateHashFromFile(sourceHash, file.absolutePath);
         sourceHash.update('\0');
+        if (inspectsIframeSources(file.relativePath)) {
+            assertNoRelativeIframeSources(await readFile(file.absolutePath, 'utf8'), file.relativePath);
+        }
         if (TEXT_EXTENSIONS.has(path.extname(file.relativePath).toLowerCase()) &&
             file.sizeBytes <= MAX_INSPECT_TEXT_BYTES) {
             const content = await readFile(file.absolutePath, 'utf8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qmuse/qmuse-cli",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "将本地 React 项目安全导入 QMuse 的命令行客户端",
   "type": "module",
   "bin": {
@@ -23,6 +23,7 @@
     "ignore": "^7.0.8",
     "open": "^11.0.4",
     "semver": "7.7.4",
+    "typescript": "^5.9.3",
     "yazl": "^3.3.1"
   },
   "files": [
@@ -38,7 +39,6 @@
     "@types/semver": "7.7.1",
     "@types/yazl": "^3.3.1",
     "tsx": "^4.19.2",
-    "typescript": "^5.9.3",
     "vite": "7.3.6"
   },
   "license": "MIT",