@sovovs/bycli 2.1.14 → 2.1.16

package/clis/weixin/_wechat/markdown.js

@@ -22,8 +22,21 @@ export function wechatArticleToMarkdown({ html, title, accountName, author, publ
     .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
     .replace(/"/g, '&quot;').replace(/'/g, '&#39;')
     .replace(/([\\`*_[\]{}()#+.!|>~-])/g, '\\$1');
+  // A URL must not go through `safe()`: escaping `. _ - ( ) #` and entity-encoding
+  // `&` corrupts the link so it can no longer be copied or followed. Rendered as an
+  // autolink it only needs whitespace and control characters dropped, `<`/`>`
+  // percent-encoded so the autolink cannot be closed early, and an http(s) scheme
+  // allowlist to reject `javascript:` and other hostile schemes.
+  const safeUrl = value => {
+    const raw = [...String(value || '')]
+      .filter(char => char > ' ' && char.codePointAt(0) !== 127)
+      .join('');
+    if (!/^https?:\/\//i.test(raw)) return '';
+    return raw.replace(/</g, '%3C').replace(/>/g, '%3E');
+  };
+  const articleUrl = safeUrl(url);
   const metadata = [accountName && `> 公众号: ${safe(accountName)}`, author && `> 作者: ${safe(author)}`,
     publishedAt && `> 发布时间: ${safe(publishedAt)}`, digest && `> 摘要: ${safe(digest)}`,
-    url && `> 原文链接: ${safe(url)}`].filter(Boolean);
+    articleUrl && `> 原文链接: <${articleUrl}>`].filter(Boolean);
   return [`# ${safe(title || 'Untitled')}`, ...metadata, '', '---', '', markdown, ''].join('\n');
 }

package/dist/src/download/article-download.js

@@ -212,6 +212,13 @@ function convertToMarkdown(contentHtml, codeBlocks, configure, cleanSelectors, s
     md = md.replace(/^[ \t]*[-·][ \t]*$/gm, '');
     md = md.replace(/^[ \t]+$/gm, '');
     md = md.replace(/[ \t]+$/gm, '');
+    // Bare-text URLs in adjacent inline nodes (WeChat renders each on its own
+    // visual line but emits no separator) fuse into one unusable string like
+    // `https://a/Xhttps://b/Y`. Split consecutive bare URLs onto their own lines.
+    // A URL whose own query carries another URL (`?next=https://…`, common in
+    // redirect wrappers) must stay intact, so skip breaks that follow a query or
+    // path delimiter. Markdown destinations are already bounded by `()`/`<>`.
+    md = md.replace(/(https?:\/\/[^\s<>()[\]]*?)(?=https?:\/\/)/gi, (match) => (/[=?&/:,;-]$/.test(match) ? match : `${match}\n`));
     md = md.replace(/\n{3,}/g, '\n\n');
     return md;
 }
@@ -329,13 +336,20 @@ export async function downloadArticle(data, options) {
     // Shape: `# Title\n[> meta\n...]\n---\n\n<markdown>` — exactly one blank
     // line separates every section, so we never produce ≥3 consecutive newlines.
     const headerValue = (value) => secureMarkdown ? escapeMarkdownText(value) : value;
+    // The source URL must not go through escapeMarkdownText: escaping `. _ - ( ) #`
+    // and entity-encoding `&` leaves a link that can no longer be copied or
+    // followed. safeHttpUrl already allowlists http(s) and percent-encodes `<`/`>`
+    // via URL normalization, so the autolink cannot be closed early; an empty
+    // return means a hostile or malformed URL and the line is dropped entirely.
+    const headerUrl = (value) => secureMarkdown ? safeHttpUrl(value) : value;
     const headerLines = [`# ${headerValue(data.title)}`];
     if (data.author)
         headerLines.push(`> ${labels.author}: ${headerValue(data.author)}`);
     if (data.publishTime)
         headerLines.push(`> ${labels.publishTime}: ${headerValue(data.publishTime)}`);
-    if (data.sourceUrl)
-        headerLines.push(`> ${labels.sourceUrl}: ${headerValue(data.sourceUrl)}`);
+    const sourceUrl = data.sourceUrl ? headerUrl(data.sourceUrl) : '';
+    if (sourceUrl)
+        headerLines.push(`> ${labels.sourceUrl}: <${sourceUrl}>`);
     const frontmatter = headerLines.join('\n') + '\n\n---\n\n';
     const fullContent = frontmatter + markdown;
     const size = Buffer.byteLength(fullContent, 'utf-8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sovovs/bycli",
-  "version": "2.1.14",
+  "version": "2.1.16",
   "publishConfig": {
     "access": "public"
   },