@xcanwin/manyoyo 6.2.17 → 6.2.19

package/lib/web/frontend/file-browser.js

@@ -9,6 +9,18 @@
             .replace(/'/g, ''');
     }
 
+    // 双向控制符（RTLO 等）/ 零宽字符可以让文件名视觉上和真实字节完全不一致
+    // （例如 "cod" + U+202E + "exe.txt" 会被浏览器渲染成 "codtxt.exe"），
+    // 展示前统一替换成可见的 \uXXXX 记法，破坏其排版效果并让人一眼看出异常。
+    // 范围：U+200B-U+200F（零宽字符/LRM/RLM）、U+202A-U+202E（嵌入/覆盖方向控制符）、
+    // U+2060-U+2069（零宽连接符/方向隔离符）、U+FEFF（BOM/零宽不换行空格）、U+061C（阿拉伯字母标记）。
+    const SUSPICIOUS_UNICODE_PATTERN = /[\u200B-\u200F\u202A-\u202E\u2060-\u2069\uFEFF\u061C]/g;
+    function sanitizeDisplayText(value) {
+        return String(value == null ? '' : value).replace(SUSPICIOUS_UNICODE_PATTERN, function (ch) {
+            return '\\u' + ch.codePointAt(0).toString(16).toUpperCase().padStart(4, '0');
+        });
+    }
+
     function formatBytes(size) {
         const value = Number(size || 0);
         if (!Number.isFinite(value) || value <= 0) {
@@ -46,6 +58,8 @@
         const parts = [];
         if (entry && entry.kind === 'directory') {
             parts.push('目录');
+        } else if (entry && entry.kind === 'symlink') {
+            parts.push('符号链接');
         } else {
             parts.push(formatBytes(entry && entry.size));
         }
@@ -55,6 +69,16 @@
         return parts.join(' · ');
     }
 
+    function buildEntryTitle(entry) {
+        const basePath = sanitizeDisplayText(entry && (entry.path || entry.name) || '');
+        if (entry && entry.kind === 'symlink') {
+            return entry.symlinkTarget
+                ? `${basePath} → ${sanitizeDisplayText(entry.symlinkTarget)}`
+                : `${basePath}（符号链接目标无法解析，可能已损坏）`;
+        }
+        return basePath;
+    }
+
     function inferLanguageFromPath(filePath) {
         const text = String(filePath || '').toLowerCase();
         if (text.endsWith('.md') || text.endsWith('.markdown')) return 'markdown';
@@ -237,7 +261,7 @@
             state.previewReadOnly = true;
             state.previewDirty = false;
             if (previewTitleNode) {
-                previewTitleNode.textContent = title;
+                previewTitleNode.textContent = sanitizeDisplayText(title);
             }
             if (previewMetaNode) {
                 previewMetaNode.textContent = description;
@@ -282,7 +306,7 @@
                 return;
             }
             if (previewTitleNode) {
-                previewTitleNode.textContent = payload.path || '未命名文件';
+                previewTitleNode.textContent = sanitizeDisplayText(payload.path) || '未命名文件';
             }
             updatePreviewMeta();
             if (!previewBodyNode) {
@@ -366,6 +390,23 @@
             syncSaveButton();
         }
 
+        function openSymlinkEntry(entry) {
+            const safeName = sanitizeDisplayText(entry.name);
+            const message = entry.symlinkTarget
+                ? `"${safeName}" 是符号链接，实际指向：\n${sanitizeDisplayText(entry.symlinkTarget)}\n\n是否继续访问？`
+                : `"${safeName}" 是一个无法解析的符号链接（可能已损坏），是否仍要尝试访问？`;
+            confirmFn(message).then(function (proceed) {
+                if (!proceed) {
+                    return;
+                }
+                if (entry.symlinkTargetKind === 'directory') {
+                    loadDirectory(entry.path);
+                    return;
+                }
+                loadFile(entry.path, entry);
+            });
+        }
+
         function renderList() {
             if (pathNode) {
                 pathNode.value = state.pathDraft || state.currentPath || state.containerPath || '/';
@@ -408,7 +449,7 @@
                 const parentButton = document.createElement('button');
                 parentButton.type = 'button';
                 parentButton.className = 'files-entry files-entry-parent';
-                parentButton.title = state.parentPath;
+                parentButton.title = sanitizeDisplayText(state.parentPath);
                 parentButton.addEventListener('click', function () {
                     loadDirectory(state.parentPath);
                 });
@@ -430,8 +471,12 @@
                 const button = document.createElement('button');
                 button.type = 'button';
                 button.className = 'files-entry' + (state.selectedPath === entry.path ? ' is-active' : '');
-                button.title = String(entry.path || entry.name || '');
+                button.title = buildEntryTitle(entry);
                 button.addEventListener('click', function () {
+                    if (entry.kind === 'symlink') {
+                        openSymlinkEntry(entry);
+                        return;
+                    }
                     if (entry.kind === 'directory') {
                         loadDirectory(entry.path);
                         return;
@@ -440,7 +485,7 @@
                 });
                 button.innerHTML = `
                     <span class="files-entry-name">
-                        <span class="files-entry-title">${escapeHtml(entry.name || entry.path || '未命名')}</span>
+                        <span class="files-entry-title">${escapeHtml(sanitizeDisplayText(entry.name || entry.path || '未命名'))}</span>
                     </span>
                     <span class="files-entry-meta">${escapeHtml(buildEntryMeta(entry))}</span>
                 `;
@@ -749,6 +794,7 @@
     }
 
     window.ManyoyoFileBrowser = {
-        create
+        create,
+        sanitizeDisplayText
     };
 }());

package/lib/web/server.js

@@ -3315,19 +3315,32 @@ try {
                 itemStat = null;
             }
             let kind = 'other';
+            let symlinkTarget = null;
+            let symlinkTargetKind = null;
             if (entry.isDirectory()) {
                 kind = 'directory';
             } else if (entry.isFile()) {
                 kind = 'file';
             } else if (entry.isSymbolicLink()) {
                 kind = 'symlink';
+                try {
+                    const resolvedPath = fs.realpathSync(fullPath);
+                    const resolvedStat = fs.statSync(resolvedPath);
+                    symlinkTarget = resolvedPath;
+                    symlinkTargetKind = resolvedStat.isDirectory() ? 'directory' : 'file';
+                } catch (e) {
+                    symlinkTarget = null;
+                    symlinkTargetKind = null;
+                }
             }
             return {
                 name: entry.name,
                 path: fullPath,
                 kind,
                 size: itemStat && typeof itemStat.size === 'number' ? itemStat.size : 0,
-                mtimeMs: itemStat && typeof itemStat.mtimeMs === 'number' ? Math.floor(itemStat.mtimeMs) : 0
+                mtimeMs: itemStat && typeof itemStat.mtimeMs === 'number' ? Math.floor(itemStat.mtimeMs) : 0,
+                symlinkTarget,
+                symlinkTargetKind
             };
         })
         .sort((a, b) => {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "6.2.17",
+    "version": "6.2.19",
     "imageVersion": "1.9.1-common",
     "playwrightCliVersion": "0.1.18",
     "description": "AI Agent CLI Security Sandbox for Docker and Podman",