koishi-plugin-ban-qrcode 1.1.3 → 1.2.1

package/lib/ad-keywords.txt

@@ -0,0 +1,24 @@
+# 一行一个关键词。空行和 # 注释会被忽略。
+# [strong] 命中任意一条即撤回
+# [commerce] 需同时出现床品类用词，且至少命中两条
+
+[strong]
+校园麦芽
+送货到寝
+配送到寝
+送寝
+名额有限
+营业执照
+联系本校的负责人
+联系本校负责人
+整套四五百
+
+[commerce]
+提前预订
+提前预定
+买被子
+购买链接
+质保四年
+厂家直销
+真空包装
+代发到寝

package/lib/ad.d.ts

@@ -1,4 +1,9 @@
 export interface AdHit {
     matches: string[];
 }
+export interface AdKeywordLists {
+    strong: string[];
+    commerce: string[];
+}
+export declare function parseAdKeywords(source: string): AdKeywordLists;
 export declare function detectAdContent(text: string, title?: string, extraKeywords?: readonly string[]): AdHit | null;

package/lib/ad.js

@@ -1,27 +1,30 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAdKeywords = parseAdKeywords;
 exports.detectAdContent = detectAdContent;
-const VERY_STRONG = [
-    '校园麦芽',
-    '送货到寝',
-    '配送到寝',
-    '送寝',
-    '名额有限',
-    '营业执照',
-    '联系本校的负责人',
-    '联系本校负责人',
-    '整套四五百',
-];
-const COMMERCE = [
-    '提前预订',
-    '提前预定',
-    '买被子',
-    '购买链接',
-    '质保四年',
-    '厂家直销',
-    '真空包装',
-    '代发到寝',
-];
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const SECTION = /^\[(strong|commerce)\]$/i;
+function parseAdKeywords(source) {
+    const lists = { strong: [], commerce: [] };
+    let section = 'strong';
+    for (const raw of source.replace(/^\uFEFF/, '').split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const marker = line.match(SECTION);
+        if (marker) {
+            section = marker[1].toLowerCase();
+            continue;
+        }
+        lists[section].push(line);
+    }
+    return lists;
+}
+function loadAdKeywords() {
+    return parseAdKeywords((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, 'ad-keywords.txt'), 'utf8'));
+}
+const { strong: VERY_STRONG, commerce: COMMERCE } = loadAdKeywords();
 const PRODUCT = /被子|床品|四件套|六件套|九件套|被芯|床垫/;
 const SELL = /购买|预订|预定|下单|代购|团购|包邮|厂家|品牌|优惠|联系.{0,8}负责/;
 const CONTACT = /微信|加v|加微|vx[:：]|v信/i;

package/lib/document.d.ts

@@ -1,3 +1,4 @@
+export declare const DEFAULT_MAX_OFFICE_BYTES: number;
 export interface DocContent {
     title: string;
     text: string;
@@ -17,5 +18,5 @@ export declare function parseTencentDocUrl(url: string): {
 export declare function collectTencentDocUrls(text: string): string[];
 export declare function parseOpendocBody(body: string): DocContent | null;
 export declare function fetchTencentDoc(http: DocHttp, url: string): Promise<DocContent | null>;
-export declare function extractOfficeText(buffer: Buffer, name: string): DocContent | null;
+export declare function extractOfficeText(buffer: Buffer, name: string, maxBytes?: number): DocContent | null;
 export declare function extractReadableText(input: string | Buffer): string;

package/lib/document.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_OFFICE_BYTES = void 0;
 exports.parseTencentDocUrl = parseTencentDocUrl;
 exports.collectTencentDocUrls = collectTencentDocUrls;
 exports.parseOpendocBody = parseOpendocBody;
@@ -12,6 +13,7 @@ const UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
 const DOC_RE = /https?:\/\/(?:docs\.qq\.com|doc\.weixin\.qq\.com)\/(doc|sheet|slide|pdf|form|mind)\/([A-Za-z0-9]+)/i;
 const ZIP_LOCAL = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
 const IMAGE_RE = /https?:\/\/docimg\d+\.docs\.qq\.com\/image\/[A-Za-z0-9_-]+(?:\.(?:jpe?g|png|webp))?/gi;
+exports.DEFAULT_MAX_OFFICE_BYTES = 5 * 1024 * 1024;
 function parseTencentDocUrl(url) {
     const match = DOC_RE.exec(url);
     if (!match)
@@ -83,14 +85,16 @@ async function fetchTencentDoc(http, url) {
     const opendoc = await http.text(opendocUrl, headers);
     return parseOpendocBody(opendoc.body);
 }
-function extractOfficeText(buffer, name) {
+function extractOfficeText(buffer, name, maxBytes = exports.DEFAULT_MAX_OFFICE_BYTES) {
+    if (buffer.length > maxBytes)
+        return null;
     const lower = name.toLowerCase();
     if (lower.endsWith('.txt')) {
         const text = buffer.toString('utf8').trim();
         return text ? { title: name, text, images: [] } : null;
     }
     if (lower.endsWith('.docx')) {
-        const xml = readZipEntry(buffer, 'word/document.xml');
+        const xml = readZipEntry(buffer, 'word/document.xml', maxBytes);
         if (!xml)
             return null;
         const text = xml
@@ -165,7 +169,7 @@ function extractUtf16LeText(buffer) {
         chars.push(run);
     return chars.join('\n');
 }
-function readZipEntry(buffer, suffix) {
+function readZipEntry(buffer, suffix, maxBytes) {
     let offset = 0;
     while (offset < buffer.length) {
         const found = buffer.indexOf(ZIP_LOCAL, offset);
@@ -175,6 +179,7 @@ function readZipEntry(buffer, suffix) {
             return null;
         const method = buffer.readUInt16LE(found + 8);
         const compSize = buffer.readUInt32LE(found + 18);
+        const uncompSize = buffer.readUInt32LE(found + 22);
         const nameLen = buffer.readUInt16LE(found + 26);
         const extraLen = buffer.readUInt16LE(found + 28);
         const nameStart = found + 30;
@@ -183,11 +188,19 @@ function readZipEntry(buffer, suffix) {
             return null;
         const name = buffer.subarray(nameStart, nameStart + nameLen).toString('utf8');
         if (name === suffix || name.endsWith(`/${suffix}`)) {
+            if (uncompSize > 0 && uncompSize <= 0xffff_fffe && uncompSize > maxBytes)
+                return null;
             const data = buffer.subarray(dataStart, dataStart + compSize);
             if (method === 0)
-                return data.toString('utf8');
-            if (method === 8)
-                return (0, node_zlib_1.inflateRawSync)(data).toString('utf8');
+                return data.length > maxBytes ? null : data.toString('utf8');
+            if (method === 8) {
+                try {
+                    return (0, node_zlib_1.inflateRawSync)(data, { maxOutputLength: maxBytes }).toString('utf8');
+                }
+                catch {
+                    return null;
+                }
+            }
         }
         offset = dataStart + Math.max(compSize, 1);
     }

package/lib/index.d.ts

@@ -14,6 +14,7 @@ export interface Config {
     scanGroupInvite: boolean;
     scanDocs: boolean;
     adKeywords: string[];
+    maxOfficeMb: number;
     debug: boolean;
 }
 export declare const Config: Schema<Config>;

package/lib/index.js

@@ -29,6 +29,7 @@ exports.Config = koishi_1.Schema.object({
     scanGroupInvite: koishi_1.Schema.boolean().default(true).description('拦截邀请 / 推荐群聊 / 群名片分享卡。'),
     scanDocs: koishi_1.Schema.boolean().default(true).description('检查腾讯文档和 Word / 文本附件里的广告。'),
     adKeywords: koishi_1.Schema.array(koishi_1.Schema.string()).role('table').default([]).description('额外广告关键词。命中即撤回。'),
+    maxOfficeMb: koishi_1.Schema.number().min(1).default(5).description('解析 Word / 文本附件的大小上限（MB）。超出则跳过，防止解压占用过多内存。'),
     debug: koishi_1.Schema.boolean().default(true).description('输出调试日志：跳过原因、消息结构、下载/扫码/文档结果。'),
 });
 function apply(ctx, config) {
@@ -146,7 +147,7 @@ function apply(ctx, config) {
             }
             for (const file of officeFiles) {
                 try {
-                    const doc = (0, document_1.extractOfficeText)(await (0, qrcode_1.downloadFile)(ctx.http, { ...file, groupId: guildId }, resolveFile), file.name);
+                    const doc = (0, document_1.extractOfficeText)(await (0, qrcode_1.downloadFile)(ctx.http, { ...file, groupId: guildId }, resolveFile), file.name, Math.floor(config.maxOfficeMb * 1024 * 1024));
                     const ad = doc ? (0, ad_1.detectAdContent)(doc.text, doc.title || file.name, config.adKeywords) : null;
                     if (config.debug)
                         logger.info('office %s ad=%s', file.name, Boolean(ad));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "koishi-plugin-ban-qrcode",
   "description": "检测到群内二维码、拉群卡片或文档广告后自动撤回并禁言",
-  "version": "1.1.3",
+  "version": "1.2.1",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
   "files": [
@@ -21,7 +21,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc -b",
+    "build": "tsc -b && node -e \"require('fs').copyFileSync('src/ad-keywords.txt', 'lib/ad-keywords.txt')\"",
     "test": "tsx --test tests/*.spec.ts"
   },
   "keywords": [

package/readme.md

@@ -94,13 +94,16 @@ npm run build
 | `scanGroupInvite` | `boolean` | `true` | 拦截邀请 / 推荐群聊分享卡 |
 | `scanDocs` | `boolean` | `true` | 检查腾讯文档和 Word / 文本附件 |
 | `adKeywords` | `string[]` | `[]` | 额外广告关键词，命中即撤回 |
+| `maxOfficeMb` | `number` | `5` | Word / 文本附件的大小上限（MB），超出则跳过 |
 | `debug` | `boolean` | `true` | 输出调试日志：跳过原因、消息结构、下载 / 扫码 / 文档结果 |
 
+内置词在 `src/ad-keywords.txt`，一行一条。`[strong]` 命中任意一条即撤回；`[commerce]` 要同时出现床品类用词且至少两条。控制台 `adKeywords` 按强匹配叠加。
+
 默认提示按原因变化，例如：`检测到拉群卡片，已撤回并禁言 60 秒。` / `检测到文档广告，已撤回并禁言 60 秒。`
 
 ## API Reference
 
-插件入口导出 `name`、`inject`、`Config`、`apply`。判定与扫码编排在 `src/detect.ts`，拉群卡在 `src/share.ts`，文档广告在 `src/ad.ts` / `src/document.ts`，下载和解码在 `src/qrcode.ts`。
+插件入口导出 `name`、`inject`、`Config`、`apply`。判定与扫码编排在 `src/detect.ts`，拉群卡在 `src/share.ts`，文档广告在 `src/ad.ts` / `src/ad-keywords.txt` / `src/document.ts`，下载和解码在 `src/qrcode.ts`。内置广告词在 `ad-keywords.txt` 里一行一条；控制台 `adKeywords` 仍是额外覆盖。
 
 ### `collectImageSrcs(nodes)`
 
@@ -122,12 +125,13 @@ npm run build
 
 ```
 src/
-├── index.ts      # 插件入口：监听群消息，撤回 / 禁言 / 提示
-├── detect.ts     # 收集图片 / 卡片 / 文件、是否处理、提示语
-├── share.ts      # 识别 QQ 拉群分享卡
-├── ad.ts         # 识别文档里的卖货文案
-├── document.ts   # 拉腾讯文档、抽出 Word / 文本
-└── qrcode.ts     # 下载图片、解码二维码
+├── index.ts           # 插件入口：监听群消息，撤回 / 禁言 / 提示
+├── detect.ts          # 收集图片 / 卡片 / 文件、是否处理、提示语
+├── share.ts           # 识别 QQ 拉群分享卡
+├── ad.ts              # 识别文档里的卖货文案
+├── ad-keywords.txt    # 内置广告关键词，一行一条
+├── document.ts        # 拉腾讯文档、抽出 Word / 文本
+└── qrcode.ts          # 下载图片、解码二维码
 tests/
 ├── detect.spec.ts
 ├── share.spec.ts
@@ -275,7 +279,7 @@ Actions 会 `npm ci` → `npm test` → `npm run build` → `npm publish --acces
 
 ## Changelog
 
-当前版本 **1.1.3**：补拦 QQ 群名片（`source=sharecard` 的 contact.lua 卡、OneBot `contact` 段）。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃，扫码失败不再跳过腾讯文档检测。1.1.1 补齐跳过原因日志，并用 `http.file` / OneBot `get_image` 与微信扫码器提高检出率。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
+当前版本 **1.2.1**：Word / 文本附件默认限制 5MB（`maxOfficeMb`），防止解压占用过多内存。1.2.0 起内置广告词改到 `ad-keywords.txt` 维护。1.1.3 补拦 QQ 群名片。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃。1.1.1 补齐跳过原因日志。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
 
 ## License