koishi-plugin-ban-qrcode 1.2.0 → 1.2.1

package/lib/document.d.ts

@@ -1,3 +1,4 @@
+export declare const DEFAULT_MAX_OFFICE_BYTES: number;
 export interface DocContent {
     title: string;
     text: string;
@@ -17,5 +18,5 @@ export declare function parseTencentDocUrl(url: string): {
 export declare function collectTencentDocUrls(text: string): string[];
 export declare function parseOpendocBody(body: string): DocContent | null;
 export declare function fetchTencentDoc(http: DocHttp, url: string): Promise<DocContent | null>;
-export declare function extractOfficeText(buffer: Buffer, name: string): DocContent | null;
+export declare function extractOfficeText(buffer: Buffer, name: string, maxBytes?: number): DocContent | null;
 export declare function extractReadableText(input: string | Buffer): string;

package/lib/document.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_OFFICE_BYTES = void 0;
 exports.parseTencentDocUrl = parseTencentDocUrl;
 exports.collectTencentDocUrls = collectTencentDocUrls;
 exports.parseOpendocBody = parseOpendocBody;
@@ -12,6 +13,7 @@ const UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
 const DOC_RE = /https?:\/\/(?:docs\.qq\.com|doc\.weixin\.qq\.com)\/(doc|sheet|slide|pdf|form|mind)\/([A-Za-z0-9]+)/i;
 const ZIP_LOCAL = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
 const IMAGE_RE = /https?:\/\/docimg\d+\.docs\.qq\.com\/image\/[A-Za-z0-9_-]+(?:\.(?:jpe?g|png|webp))?/gi;
+exports.DEFAULT_MAX_OFFICE_BYTES = 5 * 1024 * 1024;
 function parseTencentDocUrl(url) {
     const match = DOC_RE.exec(url);
     if (!match)
@@ -83,14 +85,16 @@ async function fetchTencentDoc(http, url) {
     const opendoc = await http.text(opendocUrl, headers);
     return parseOpendocBody(opendoc.body);
 }
-function extractOfficeText(buffer, name) {
+function extractOfficeText(buffer, name, maxBytes = exports.DEFAULT_MAX_OFFICE_BYTES) {
+    if (buffer.length > maxBytes)
+        return null;
     const lower = name.toLowerCase();
     if (lower.endsWith('.txt')) {
         const text = buffer.toString('utf8').trim();
         return text ? { title: name, text, images: [] } : null;
     }
     if (lower.endsWith('.docx')) {
-        const xml = readZipEntry(buffer, 'word/document.xml');
+        const xml = readZipEntry(buffer, 'word/document.xml', maxBytes);
         if (!xml)
             return null;
         const text = xml
@@ -165,7 +169,7 @@ function extractUtf16LeText(buffer) {
         chars.push(run);
     return chars.join('\n');
 }
-function readZipEntry(buffer, suffix) {
+function readZipEntry(buffer, suffix, maxBytes) {
     let offset = 0;
     while (offset < buffer.length) {
         const found = buffer.indexOf(ZIP_LOCAL, offset);
@@ -175,6 +179,7 @@ function readZipEntry(buffer, suffix) {
             return null;
         const method = buffer.readUInt16LE(found + 8);
         const compSize = buffer.readUInt32LE(found + 18);
+        const uncompSize = buffer.readUInt32LE(found + 22);
         const nameLen = buffer.readUInt16LE(found + 26);
         const extraLen = buffer.readUInt16LE(found + 28);
         const nameStart = found + 30;
@@ -183,11 +188,19 @@ function readZipEntry(buffer, suffix) {
             return null;
         const name = buffer.subarray(nameStart, nameStart + nameLen).toString('utf8');
         if (name === suffix || name.endsWith(`/${suffix}`)) {
+            if (uncompSize > 0 && uncompSize <= 0xffff_fffe && uncompSize > maxBytes)
+                return null;
             const data = buffer.subarray(dataStart, dataStart + compSize);
             if (method === 0)
-                return data.toString('utf8');
-            if (method === 8)
-                return (0, node_zlib_1.inflateRawSync)(data).toString('utf8');
+                return data.length > maxBytes ? null : data.toString('utf8');
+            if (method === 8) {
+                try {
+                    return (0, node_zlib_1.inflateRawSync)(data, { maxOutputLength: maxBytes }).toString('utf8');
+                }
+                catch {
+                    return null;
+                }
+            }
         }
         offset = dataStart + Math.max(compSize, 1);
     }

package/lib/index.d.ts

@@ -14,6 +14,7 @@ export interface Config {
     scanGroupInvite: boolean;
     scanDocs: boolean;
     adKeywords: string[];
+    maxOfficeMb: number;
     debug: boolean;
 }
 export declare const Config: Schema<Config>;

package/lib/index.js

@@ -29,6 +29,7 @@ exports.Config = koishi_1.Schema.object({
     scanGroupInvite: koishi_1.Schema.boolean().default(true).description('拦截邀请 / 推荐群聊 / 群名片分享卡。'),
     scanDocs: koishi_1.Schema.boolean().default(true).description('检查腾讯文档和 Word / 文本附件里的广告。'),
     adKeywords: koishi_1.Schema.array(koishi_1.Schema.string()).role('table').default([]).description('额外广告关键词。命中即撤回。'),
+    maxOfficeMb: koishi_1.Schema.number().min(1).default(5).description('解析 Word / 文本附件的大小上限（MB）。超出则跳过，防止解压占用过多内存。'),
     debug: koishi_1.Schema.boolean().default(true).description('输出调试日志：跳过原因、消息结构、下载/扫码/文档结果。'),
 });
 function apply(ctx, config) {
@@ -146,7 +147,7 @@ function apply(ctx, config) {
             }
             for (const file of officeFiles) {
                 try {
-                    const doc = (0, document_1.extractOfficeText)(await (0, qrcode_1.downloadFile)(ctx.http, { ...file, groupId: guildId }, resolveFile), file.name);
+                    const doc = (0, document_1.extractOfficeText)(await (0, qrcode_1.downloadFile)(ctx.http, { ...file, groupId: guildId }, resolveFile), file.name, Math.floor(config.maxOfficeMb * 1024 * 1024));
                     const ad = doc ? (0, ad_1.detectAdContent)(doc.text, doc.title || file.name, config.adKeywords) : null;
                     if (config.debug)
                         logger.info('office %s ad=%s', file.name, Boolean(ad));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "koishi-plugin-ban-qrcode",
   "description": "检测到群内二维码、拉群卡片或文档广告后自动撤回并禁言",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
   "files": [

package/readme.md

@@ -94,6 +94,7 @@ npm run build
 | `scanGroupInvite` | `boolean` | `true` | 拦截邀请 / 推荐群聊分享卡 |
 | `scanDocs` | `boolean` | `true` | 检查腾讯文档和 Word / 文本附件 |
 | `adKeywords` | `string[]` | `[]` | 额外广告关键词，命中即撤回 |
+| `maxOfficeMb` | `number` | `5` | Word / 文本附件的大小上限（MB），超出则跳过 |
 | `debug` | `boolean` | `true` | 输出调试日志：跳过原因、消息结构、下载 / 扫码 / 文档结果 |
 
 内置词在 `src/ad-keywords.txt`，一行一条。`[strong]` 命中任意一条即撤回；`[commerce]` 要同时出现床品类用词且至少两条。控制台 `adKeywords` 按强匹配叠加。
@@ -278,7 +279,7 @@ Actions 会 `npm ci` → `npm test` → `npm run build` → `npm publish --acces
 
 ## Changelog
 
-当前版本 **1.2.0**：内置广告词改到 `ad-keywords.txt` 维护，控制台 `adKeywords` 仍作额外强匹配。1.1.3 补拦 QQ 群名片。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃。1.1.1 补齐跳过原因日志。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
+当前版本 **1.2.1**：Word / 文本附件默认限制 5MB（`maxOfficeMb`），防止解压占用过多内存。1.2.0 起内置广告词改到 `ad-keywords.txt` 维护。1.1.3 补拦 QQ 群名片。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃。1.1.1 补齐跳过原因日志。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
 
 ## License