@waline/vercel 1.32.3 → 1.32.4

package/Dockerfile.source-build-alpine

@@ -0,0 +1,20 @@
+FROM node:lts-alpine AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+WORKDIR /app
+
+RUN apk add --no-cache bash tzdata && \
+    cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
+    echo "Asia/Shanghai" > /etc/timezone && \
+    corepack enable
+
+COPY . .
+
+FROM base AS prod-deps
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --prod
+
+FROM base AS runtime
+ENV NODE_ENV=production
+COPY --from=prod-deps /app /app
+EXPOSE 8360
+CMD ["node", "vanilla.js"]

package/__tests__/xss.spec.js

@@ -60,14 +60,14 @@ Waline is a good framework. :money:
 
   it('Should not autoplay or preload media', () => {
     expect(parser('<audio autoplay preload="auto" src="x">')).toEqual(
-      '<audio src="x" preload="none"></audio>',
+      '<audio preload="none" src="x"></audio>',
     );
     expect(parser('<audio autoplay src="x"></audio>')).toEqual(
       '<p><audio src="x" preload="none"></audio></p>\n',
     );
 
     expect(parser('<video autoplay preload="auto" src="x">')).toEqual(
-      '<video src="x" preload="none"></video>',
+      '<video preload="none" src="x"></video>',
     );
     expect(parser('<video autoplay src="x"></video>')).toEqual(
       '<p><video src="x" preload="none"></video></p>\n',
@@ -83,7 +83,7 @@ Waline is a good framework. :money:
         '<p><a href="https://example.com" rel="opener prefetch">link</a></p>',
       ),
     ).toEqual(
-      '<p><a rel="nofollow noreferrer noopener" href="https://example.com" target="_blank">link</a></p>',
+      '<p><a href="https://example.com" rel="nofollow noreferrer noopener" target="_blank">link</a></p>',
     );
   });
 

package/development.js

@@ -0,0 +1,30 @@
+const path = require('node:path');
+
+require('dotenv').config({
+  path: path.join(__dirname, '../../.env'),
+  quiet: true,
+});
+
+const watcher = require('think-watcher');
+const Application = require('thinkjs');
+
+const instance = new Application({
+  ROOT_PATH: __dirname,
+  APP_PATH: path.join(__dirname, 'src'),
+  proxy: false,
+  watcher: watcher,
+  env: 'development',
+});
+
+instance.run();
+
+let config = {};
+
+try {
+  config = require('./config.js');
+} catch {
+  // do nothing
+}
+for (const k in config) {
+  think.config(k, config[k]);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@waline/vercel",
-  "version": "1.32.3",
+  "version": "1.32.4",
   "description": "vercel server for waline comment system",
   "keywords": [
     "waline",
@@ -14,32 +14,33 @@
   },
   "license": "MIT",
   "author": "lizheming <i@imnerd.org>",
+  "scripts": {
+    "dev": "node development.js 9090"
+  },
   "dependencies": {
-    "@cloudbase/node-sdk": "^3.3.7",
+    "@cloudbase/node-sdk": "^3.10.1",
     "@koa/cors": "^5.0.0",
-    "@mdit/plugin-katex": "0.8.0",
-    "@mdit/plugin-mathjax": "0.4.8",
-    "@mdit/plugin-sub": "0.8.0",
-    "@mdit/plugin-sup": "0.8.0",
+    "@mdit/plugin-katex": "0.23.2-cjs.0",
+    "@mdit/plugin-mathjax": "0.23.2-cjs.0",
+    "@mdit/plugin-sub": "0.22.2-cjs.0",
+    "@mdit/plugin-sup": "0.22.2-cjs.0",
     "akismet": "^2.0.7",
     "deta": "^2.0.0",
-    "dompurify": "^3.2.2",
+    "dompurify": "^3.2.7",
     "dy-node-ip2region": "^1.0.1",
-    "fast-csv": "^5.0.2",
-    "form-data": "^4.0.1",
-    "jsdom": "^25.0.1",
+    "fast-csv": "^5.0.5",
+    "form-data": "^4.0.4",
+    "jsdom": "^27.0.0",
     "jsonwebtoken": "^9.0.2",
-    "katex": "^0.16.11",
     "koa-compose": "^4.1.0",
     "leancloud-storage": "^4.15.2",
     "markdown-it": "^14.1.0",
     "markdown-it-emoji": "^3.0.0",
     "mathjax-full": "^3.2.2",
-    "node-fetch": "^2.7.0",
-    "nodemailer": "^6.9.16",
+    "nodemailer": "^7.0.6",
     "nunjucks": "^3.2.4",
     "phpass": "^0.1.1",
-    "prismjs": "^1.29.0",
+    "prismjs": "^1.30.0",
     "speakeasy": "^2.0.0",
     "think-helper": "^1.1.4",
     "think-logger3": "^1.4.0",
@@ -50,11 +51,15 @@
     "think-model-sqlite": "^1.3.2",
     "think-mongo": "^2.2.1",
     "think-router-rest": "^1.0.5",
-    "thinkjs": "^3.2.15",
-    "ua-parser-js": "^2.0.0"
+    "thinkjs": "4.0.0-alpha.0",
+    "ua-parser-js": "^2.0.5"
+  },
+  "devDependencies": {
+    "dotenv": "17.2.2",
+    "think-watcher": "3.0.4"
   },
   "engines": {
-    "node": ">=16"
+    "node": ">=20"
   },
   "publishConfig": {
     "provenance": true

package/src/config/adapter.js

@@ -3,11 +3,13 @@ const Mysql = require('think-model-mysql');
 const Mysql2 = require('think-model-mysql2');
 const Postgresql = require('think-model-postgresql');
 
-let Sqlite = class {};
+let Sqlite;
 
 try {
   Sqlite = require('think-model-sqlite');
 } catch (err) {
+  // eslint-disable-next-line @typescript-eslint/no-extraneous-class
+  Sqlite = class {};
   console.log(err);
 }
 

package/src/config/extend.js

@@ -1,4 +1,3 @@
-const fetch = require('node-fetch');
 const Model = require('think-model');
 const Mongo = require('think-mongo');
 

package/src/controller/comment.js

@@ -175,8 +175,8 @@ module.exports = class extends BaseRest {
       think.logger.debug(`Comment initial status is ${data.status}`);
 
       if (data.status === 'approved') {
-        const spam = await akismet(data, this.ctx.serverURL).catch((e) =>
-          console.log(e),
+        const spam = await akismet(data, this.ctx.serverURL).catch((err) =>
+          console.log(err),
         ); // ignore akismet error
 
         if (spam === true) {

package/src/controller/oauth.js

@@ -1,5 +1,4 @@
 const jwt = require('jsonwebtoken');
-const fetch = require('node-fetch');
 
 module.exports = class extends think.Controller {
   constructor(ctx) {
@@ -16,17 +15,12 @@ module.exports = class extends think.Controller {
 
     if (!hasCode) {
       const { serverURL } = this.ctx;
-      const redirectUrl = `${serverURL}/api/oauth?${new URLSearchParams({
-        redirect,
-        type,
-      }).toString()}`;
+      const redirectUrl = think.buildUrl(`${serverURL}/api/oauth`, {redirect, type});
 
-      return this.redirect(
-        `${oauthUrl}/${type}?${new URLSearchParams({
-          redirect: redirectUrl,
-          state: this.ctx.state.token || '',
-        }).toString()}`,
-      );
+      return this.redirect(think.buildUrl(`${oauthUrl}/${type}`, {
+        redirect: redirectUrl, 
+        state: this.ctx.state.token || ''
+      }));
     }
 
     /**
@@ -36,19 +30,16 @@ module.exports = class extends think.Controller {
 
     if (type === 'facebook') {
       const { serverURL } = this.ctx;
-      const redirectUrl = `${serverURL}/api/oauth?${new URLSearchParams({
-        redirect,
-        type,
-      }).toString()}`;
+      const redirectUrl = think.buildUrl(`${serverURL}/api/oauth`, {redirect, type});
 
-      params.state = new URLSearchParams({
+      params.state = think.buildUrl(undefined, {
         redirect: redirectUrl,
         state: this.ctx.state.token || '',
       });
     }
 
     const user = await fetch(
-      `${oauthUrl}/${type}?${new URLSearchParams(params).toString()}`,
+      think.buildUrl(`${oauthUrl}/${type}`, params),
       {
         method: 'GET',
         headers: {
@@ -67,9 +58,7 @@ module.exports = class extends think.Controller {
       const token = jwt.sign(userBySocial[0].email, this.config('jwtKey'));
 
       if (redirect) {
-        return this.redirect(
-          redirect + (redirect.includes('?') ? '&' : '?') + 'token=' + token,
-        );
+        return this.redirect(think.buildUrl(redirect, { token }));
       }
 
       return this.success();

package/src/controller/user.js

@@ -91,10 +91,7 @@ module.exports = class extends BaseRest {
 
     try {
       const notify = this.service('notify', this);
-      const apiUrl =
-        this.ctx.serverURL +
-        '/verification?' +
-        new URLSearchParams({ token, email: data.email }).toString();
+      const apiUrl = think.buildUrl(this.ctx.serverURL + '/verification', { token, email: data.email });
 
       await notify.transporter.sendMail({
         from:
@@ -110,8 +107,8 @@ module.exports = class extends BaseRest {
           { url: apiUrl },
         ),
       });
-    } catch (e) {
-      console.log(e);
+    } catch (err) {
+      console.log(err);
 
       return this.fail(
         this.locale(

package/src/extend/think.js

@@ -83,8 +83,8 @@ module.exports = {
       );
 
       return address.slice(0, depth).join(' ');
-    } catch (e) {
-      console.log(e);
+    } catch (err) {
+      console.log(err);
 
       return '';
     }
@@ -154,4 +154,27 @@ module.exports = {
       )
       .filter((v) => v);
   },
+  buildUrl(path, query = {}) {
+    const notEmptyQuery = {};
+
+    for(const key in query) {
+      if (!query[key]) {
+        continue;
+      }
+      notEmptyQuery[key] = query[key];
+    }
+
+    const notEmptyQueryStr = new URLSearchParams(notEmptyQuery).toString();
+
+    let destUrl = path;
+
+    if (destUrl && notEmptyQueryStr) {
+      destUrl += destUrl.indexOf('?') !== -1 ? '&' : '?';
+    }
+    if (notEmptyQueryStr) {
+      destUrl += notEmptyQueryStr;
+    }
+
+    return destUrl;
+  }
 };

package/src/locales/zh-TW.json

@@ -13,7 +13,7 @@
   "Comment too fast": "評論太快啦，請慢點！",
   "Registration confirm mail send failed, please {%- if isAdmin -%}check your mail configuration{%- else -%}check your email address and contact administrator{%- endif -%}.": "註冊確認郵件發送失敗，{%- if isAdmin -%}檢查一下網站的郵件相關配置{% else %}確認你的郵箱輸入無誤後聯繫管理員{%- endif -%}。",
   "MAIL_SUBJECT": "{{parent.nick | safe}}，『{{site.name | safe}}』上的評論收到回復",
-  "MAIL_TEMPLATE": "<div style='border-top:2px solid #12ADDB;box-shadow:0 1px 3px #AAAAAA;line-height:180%;padding:0 15px 12px;margin:50px auto;font-size:12px;'> <h2 style='border-bottom:1px solid #DDD;font-size:14px;font-weight:normal;padding:13px 0 10px 8px;'> 您在<a style='text-decoration:none;color: #12ADDB;' href='{{site.url}}' target='_blank'>{{site.name}}</a>上的品論有新的回復 </h2>{{parent.nick}}同學，您層發表評論： <div style='padding:0 12px 0 12px;margin-top:18px'> <div style='background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;'>{{parent.comment | safe}}</div><p><strong>{{self.nick}}</strong>回復說：</p><div style='background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;'>{{self.comment | safe}}</div><p>您可以點擊<a style='text-decoration:none; color:#12addb' href='{{site.postUrl}}' target='_blank'>查看回復的完整內容</a>，歡迎再次光臨<a style='text-decoration:none; color:#12addb' href='{{site.url}}' target='_blank'>{{site.name}}</a>。</p><br/> </div></div>",
+  "MAIL_TEMPLATE": "<div style='border-top:2px solid #12ADDB;box-shadow:0 1px 3px #AAAAAA;line-height:180%;padding:0 15px 12px;margin:50px auto;font-size:12px;'> <h2 style='border-bottom:1px solid #DDD;font-size:14px;font-weight:normal;padding:13px 0 10px 8px;'> 您在<a style='text-decoration:none;color: #12ADDB;' href='{{site.url}}' target='_blank'>{{site.name}}</a>上的評論有新的回復 </h2>{{parent.nick}}同學，您層發表評論： <div style='padding:0 12px 0 12px;margin-top:18px'> <div style='background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;'>{{parent.comment | safe}}</div><p><strong>{{self.nick}}</strong>回復說：</p><div style='background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;'>{{self.comment | safe}}</div><p>您可以點擊<a style='text-decoration:none; color:#12addb' href='{{site.postUrl}}' target='_blank'>查看回復的完整內容</a>，歡迎再次光臨<a style='text-decoration:none; color:#12addb' href='{{site.url}}' target='_blank'>{{site.name}}</a>。</p><br/> </div></div>",
   "MAIL_SUBJECT_ADMIN": "{{site.name | safe}} 上有新評論了",
   "MAIL_TEMPLATE_ADMIN": "<div style='border-top:2px solid #12ADDB;box-shadow:0 1px 3px #AAAAAA;line-height:180%;padding:0 15px 12px;margin:50px auto;font-size:12px;'> <h2 style='border-bottom:1px solid #DDD;font-size:14px;font-weight:normal;padding:13px 0 10px 8px;'> 您在<a style='text-decoration:none;color: #12ADDB;' href='{{site.url}}' target='_blank'>{{site.name}}</a>上的文章有新評論了 </h2> <p><strong>{{self.nick}}</strong>回復說：</p><div style='background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;'>{{self.comment | safe}}</div><p>您可以點擊<a style='text-decoration:none; color:#12addb' href='{{site.postUrl}}' target='_blank'>查看回復的完整內容</a></p><br/> </div>"
 }

package/src/logic/base.js

@@ -2,7 +2,6 @@ const path = require('node:path');
 const qs = require('node:querystring');
 
 const jwt = require('jsonwebtoken');
-const fetch = require('node-fetch');
 const helper = require('think-helper');
 
 module.exports = class extends think.Logic {
@@ -15,9 +14,21 @@ module.exports = class extends think.Logic {
 
   async __before() {
     const referrer = this.ctx.referrer(true);
+    let origin = this.ctx.origin;
+
+    if (origin) {
+      try {
+        const parsedOrigin = new URL(origin);
+
+        origin = parsedOrigin.hostname;
+      } catch (e) {
+        console.error('Invalid origin format:', origin, e);
+      }
+    }
+
     let { secureDomains } = this.config();
 
-    if (secureDomains && referrer && this.ctx.host.indexOf(referrer) !== 0) {
+    if (secureDomains) {
       secureDomains = think.isArray(secureDomains)
         ? secureDomains
         : [secureDomains];
@@ -31,13 +42,41 @@ module.exports = class extends think.Logic {
         'graph.qq.com',
       );
 
-      const match = secureDomains.some((domain) =>
+      // 转换可能的正则表达式字符串为正则表达式对象
+      secureDomains = secureDomains
+        .map((domain) => {
+          // 如果是正则表达式字符串，创建一个 RegExp 对象
+          if (
+            typeof domain === 'string' &&
+            domain.startsWith('/') &&
+            domain.endsWith('/')
+          ) {
+            try {
+              return new RegExp(domain.slice(1, -1)); // 去掉斜杠并创建 RegExp 对象
+            } catch (e) {
+              console.error(
+                'Invalid regex pattern in secureDomains:',
+                domain,
+                e,
+              );
+
+              return null;
+            }
+          }
+
+          return domain;
+        })
+        .filter(Boolean); // 过滤掉无效的正则表达式
+
+      // 有 referrer 检查 referrer，没有则检查 origin
+      const checking = referrer ? referrer : origin;
+      const isSafe = secureDomains.some((domain) =>
         think.isFunction(domain.test)
-          ? domain.test(referrer)
-          : domain === referrer,
+          ? domain.test(checking)
+          : domain === checking,
       );
 
-      if (!match) {
+      if (!isSafe) {
         return this.ctx.throw(403);
       }
     }

package/src/service/markdown/mathjax.js

@@ -8,56 +8,48 @@ const { SVG } = require('mathjax-full/js/output/svg.js');
 const { inlineTeX, blockTeX } = require('./mathCommon');
 const { escapeHtml } = require('./utils');
 
-// set MathJax as the renderer
-class MathToSvg {
-  constructor() {
-    const adaptor = liteAdaptor();
-
-    RegisterHTMLHandler(adaptor);
+const mathjaxPlugin = (md) => {
+  const adaptor = liteAdaptor();
 
-    const packages = AllPackages.sort();
-    const tex = new TeX({ packages });
-    const svg = new SVG({ fontCache: 'none' });
+  RegisterHTMLHandler(adaptor);
 
-    this.adaptor = adaptor;
-    this.texToNode = mathjax.document('', { InputJax: tex, OutputJax: svg });
+  const packages = AllPackages.sort();
+  const tex = new TeX({ packages });
+  const svg = new SVG({ fontCache: 'none' });
 
-    this.inline = function (tex) {
-      const node = this.texToNode.convert(tex, { display: false });
-      let svg = this.adaptor.innerHTML(node);
+  const texToNode = mathjax.document('', { InputJax: tex, OutputJax: svg });
 
-      if (svg.includes('data-mml-node="merror"')) {
-        const errorTitle = svg.match(/<title>(.*?)<\/title>/)[1];
+  const inline = (tex) => {
+    const node = texToNode.convert(tex, { display: false });
+    let svg = adaptor.innerHTML(node);
 
-        svg = `<span class='mathjax-error' title='${escapeHtml(
-          errorTitle,
-        )}'>${escapeHtml(tex)}</span>`;
-      }
+    if (svg.includes('data-mml-node="merror"')) {
+      const errorTitle = svg.match(/<title>(.*?)<\/title>/)[1];
 
-      return svg;
-    };
+      svg = `<span class='mathjax-error' title='${escapeHtml(
+        errorTitle,
+      )}'>${escapeHtml(tex)}</span>`;
+    }
 
-    this.block = function (tex) {
-      const node = this.texToNode.convert(tex, { display: true });
-      let svg = this.adaptor.innerHTML(node);
+    return svg;
+  };
 
-      if (svg.includes('data-mml-node="merror"')) {
-        const errorTitle = svg.match(/<title>(.*?)<\/title>/)[1];
+  const block = (tex) => {
+    const node = texToNode.convert(tex, { display: true });
+    let svg = adaptor.innerHTML(node);
 
-        svg = `<p class='mathjax-block mathjax-error' title='${escapeHtml(
-          errorTitle,
-        )}'>${escapeHtml(tex)}</p>`;
-      } else {
-        svg = svg.replace(/(width=".*?")/, 'width="100%"');
-      }
+    if (svg.includes('data-mml-node="merror"')) {
+      const errorTitle = svg.match(/<title>(.*?)<\/title>/)[1];
 
-      return svg;
-    };
-  }
-}
+      svg = `<p class='mathjax-block mathjax-error' title='${escapeHtml(
+        errorTitle,
+      )}'>${escapeHtml(tex)}</p>`;
+    } else {
+      svg = svg.replace(/(width=".*?")/, 'width="100%"');
+    }
 
-const mathjaxPlugin = (md) => {
-  const mathToSvg = new MathToSvg();
+    return svg;
+  };
 
   md.inline.ruler.after('escape', 'inlineTeX', inlineTeX);
 
@@ -66,11 +58,10 @@ const mathjaxPlugin = (md) => {
     alt: ['paragraph', 'reference', 'blockquote', 'list'],
   });
 
-  md.renderer.rules.inlineTeX = (tokens, idx) =>
-    mathToSvg.inline(tokens[idx].content);
+  md.renderer.rules.inlineTeX = (tokens, idx) => inline(tokens[idx].content);
 
   md.renderer.rules.blockTeX = (tokens, idx) =>
-    `${mathToSvg.block(tokens[idx].content)}\n`;
+    `${block(tokens[idx].content)}\n`;
 };
 
 module.exports = {

package/src/service/notify.js

@@ -1,7 +1,6 @@
 const crypto = require('node:crypto');
 
 const FormData = require('form-data');
-const fetch = require('node-fetch');
 const nodemailer = require('nodemailer');
 const nunjucks = require('nunjucks');
 

package/src/service/storage/deta.js

@@ -213,9 +213,10 @@ module.exports = class extends Base {
 
       fieldMap.add('objectId');
       data.forEach((item) => {
-        for (const k in item) {
-          if (!fieldMap.has(k)) {
-            delete item[k];
+        for (const key in item) {
+          if (!fieldMap.has(key)) {
+            // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+            delete item[key];
           }
         }
       });

package/src/service/storage/github.js

@@ -1,7 +1,6 @@
 const path = require('node:path');
 
 const { parseString, writeToString } = require('fast-csv');
-const fetch = require('node-fetch');
 
 const Base = require('./base.js');
 

package/src/service/storage/postgresql.js

@@ -51,6 +51,7 @@ module.exports = class extends MySQL {
           val instanceof Date
             ? think.datetime(val, 'YYYY-MM-DD HH:mm:ss')
             : val;
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
         delete data[key];
       });
 

package/src/service/markdown/katex.js

@@ -1,50 +0,0 @@
-const katex = require('katex');
-
-const { inlineTeX, blockTeX } = require('./mathCommon.js');
-const { escapeHtml } = require('./utils.js');
-
-// set KaTeX as the renderer for markdown-it-simplemath
-const katexInline = (tex, options) => {
-  options.displayMode = false;
-  try {
-    return katex.renderToString(tex, options);
-  } catch (error) {
-    if (options.throwOnError) console.warn(error);
-
-    return `<span class='katex-error' title='${escapeHtml(
-      error.toString(),
-    )}'>${escapeHtml(tex)}</span>`;
-  }
-};
-
-const katexBlock = (tex, options) => {
-  options.displayMode = true;
-  try {
-    return `<p class='katex-block'>${katex.renderToString(tex, options)}</p>`;
-  } catch (error) {
-    if (options.throwOnError) console.warn(error);
-
-    return `<p class='katex-block katex-error' title='${escapeHtml(
-      error.toString(),
-    )}'>${escapeHtml(tex)}</p>`;
-  }
-};
-
-const katexPlugin = (md, options = { throwOnError: false }) => {
-  md.inline.ruler.after('escape', 'inlineTeX', inlineTeX);
-
-  // It’s a workaround here because types issue
-  md.block.ruler.after('blockquote', 'blockTeX', blockTeX, {
-    alt: ['paragraph', 'reference', 'blockquote', 'list'],
-  });
-
-  md.renderer.rules.inlineTeX = (tokens, idx) =>
-    katexInline(tokens[idx].content, options);
-
-  md.renderer.rules.blockTeX = (tokens, idx) =>
-    `${katexBlock(tokens[idx].content, options)}\n`;
-};
-
-module.exports = {
-  katexPlugin,
-};