koishi-plugin-ban-qrcode 1.2.0 → 1.3.0

package/lib/detect.js

@@ -51,9 +51,17 @@ const SHARE_TYPES = new Set([
     'share',
     'ark',
     'lightapp',
+    'miniapp',
     'onebot:json',
     'onebot:xml',
     'onebot:share',
+    'onebot:ark',
+    'onebot:lightapp',
+    'onebot:miniapp',
+    'weapp',
+    'wxapp',
+    'miniprogram',
+    'onebot:weapp',
 ]);
 const CONTACT_TYPES = new Set([
     'contact',
@@ -98,8 +106,8 @@ function collectMessageParts(nodes, extra = '') {
                 if (typeof content === 'string' && content)
                     texts.push(content);
             }
-            if (SHARE_TYPES.has(node.type)) {
-                addShare(unwrapShareData(node.attrs?.data ?? node.attrs?.content ?? node.attrs?.value));
+            if (SHARE_TYPES.has(node.type) || looksLikeShareAttrs(node.attrs)) {
+                addShare(sharePayloadFromAttrs(node.attrs));
             }
             if (CONTACT_TYPES.has(node.type)) {
                 addShare(node.attrs);
@@ -198,6 +206,32 @@ function unwrapShareData(raw) {
     }
     return raw;
 }
+function looksLikeShareAttrs(attrs) {
+    if (!attrs)
+        return false;
+    if (typeof attrs.app === 'string')
+        return true;
+    if (attrs.meta && (attrs.prompt || attrs.view || attrs.bizsrc))
+        return true;
+    const wrapped = attrs.data ?? attrs.content ?? attrs.value;
+    if (typeof wrapped === 'string' && /"app"\s*:/.test(wrapped))
+        return true;
+    if (wrapped && typeof wrapped === 'object' && !Array.isArray(wrapped)) {
+        return typeof wrapped.app === 'string';
+    }
+    return false;
+}
+function sharePayloadFromAttrs(attrs) {
+    if (!attrs)
+        return undefined;
+    const wrapped = attrs.data ?? attrs.content ?? attrs.value;
+    if (wrapped !== undefined && wrapped !== null && wrapped !== '') {
+        return unwrapShareData(wrapped);
+    }
+    if (typeof attrs.app === 'string' || attrs.meta)
+        return attrs;
+    return undefined;
+}
 function isDownloadableSrc(src) {
     return /^(https?:|data:|file:)/i.test(src);
 }

package/lib/document.d.ts

@@ -1,3 +1,4 @@
+export declare const DEFAULT_MAX_OFFICE_BYTES: number;
 export interface DocContent {
     title: string;
     text: string;
@@ -15,7 +16,8 @@ export declare function parseTencentDocUrl(url: string): {
     pageUrl: string;
 } | null;
 export declare function collectTencentDocUrls(text: string): string[];
+export declare function extractTencentDocUrlsFromShare(payload: string): string[];
 export declare function parseOpendocBody(body: string): DocContent | null;
 export declare function fetchTencentDoc(http: DocHttp, url: string): Promise<DocContent | null>;
-export declare function extractOfficeText(buffer: Buffer, name: string): DocContent | null;
+export declare function extractOfficeText(buffer: Buffer, name: string, maxBytes?: number): DocContent | null;
 export declare function extractReadableText(input: string | Buffer): string;

package/lib/document.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_OFFICE_BYTES = void 0;
 exports.parseTencentDocUrl = parseTencentDocUrl;
 exports.collectTencentDocUrls = collectTencentDocUrls;
+exports.extractTencentDocUrlsFromShare = extractTencentDocUrlsFromShare;
 exports.parseOpendocBody = parseOpendocBody;
 exports.fetchTencentDoc = fetchTencentDoc;
 exports.extractOfficeText = extractOfficeText;
@@ -9,32 +11,81 @@ exports.extractReadableText = extractReadableText;
 const node_zlib_1 = require("node:zlib");
 const detect_1 = require("./detect");
 const UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36';
-const DOC_RE = /https?:\/\/(?:docs\.qq\.com|doc\.weixin\.qq\.com)\/(doc|sheet|slide|pdf|form|mind)\/([A-Za-z0-9]+)/i;
+const DOC_HOST = '(?:docs\\.qq\\.com|doc\\.weixin\\.qq\\.com)';
+const DOC_KIND = 'doc|sheet|slide|pdf|form|mind|smartsheet|smartpage';
+const DOC_ID = '[A-Za-z0-9][A-Za-z0-9_-]{5,}';
+const DOC_RE = new RegExp(`(?:https?:\\/\\/)?(?:\\/\\/)?${DOC_HOST}\\/(${DOC_KIND})(?:\\/page)?\\/(${DOC_ID})`, 'i');
 const ZIP_LOCAL = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
 const IMAGE_RE = /https?:\/\/docimg\d+\.docs\.qq\.com\/image\/[A-Za-z0-9_-]+(?:\.(?:jpe?g|png|webp))?/gi;
+exports.DEFAULT_MAX_OFFICE_BYTES = 5 * 1024 * 1024;
 function parseTencentDocUrl(url) {
-    const match = DOC_RE.exec(url);
+    const match = DOC_RE.exec(decodePercents((0, detect_1.unescapePayload)(url)));
     if (!match)
         return null;
+    const kind = match[1].toLowerCase();
+    const id = match[2];
+    const path = kind === 'form' ? `form/page/${id}` : `${kind}/${id}`;
     return {
-        kind: match[1],
-        id: match[2],
-        pageUrl: `https://docs.qq.com/${match[1]}/${match[2]}`,
+        kind,
+        id,
+        pageUrl: `https://docs.qq.com/${path}`,
     };
 }
 function collectTencentDocUrls(text) {
     const urls = [];
     const seen = new Set();
-    const re = new RegExp(DOC_RE.source, 'gi');
-    for (const match of (0, detect_1.unescapePayload)(text).matchAll(re)) {
-        const parsed = parseTencentDocUrl(match[0]);
-        if (!parsed || seen.has(parsed.pageUrl))
-            continue;
-        seen.add(parsed.pageUrl);
-        urls.push(parsed.pageUrl);
+    const add = (value) => {
+        const decoded = decodePercents((0, detect_1.unescapePayload)(value));
+        const re = new RegExp(DOC_RE.source, 'gi');
+        for (const match of decoded.matchAll(re)) {
+            const parsed = parseTencentDocUrl(match[0]);
+            if (!parsed || seen.has(parsed.pageUrl))
+                continue;
+            seen.add(parsed.pageUrl);
+            urls.push(parsed.pageUrl);
+        }
+    };
+    add(text);
+    return urls;
+}
+function extractTencentDocUrlsFromShare(payload) {
+    const urls = collectTencentDocUrls(payload);
+    const seen = new Set(urls);
+    const add = (value) => {
+        for (const url of collectTencentDocUrls(value)) {
+            if (seen.has(url))
+                continue;
+            seen.add(url);
+            urls.push(url);
+        }
+    };
+    const raw = (0, detect_1.unescapePayload)(payload);
+    try {
+        walkDocCandidates(JSON.parse(decodePercents(raw)), add);
+    }
+    catch {
+        // not json; still scan xml tags below
+    }
+    for (const match of raw.matchAll(/<(?:url|qqdocurl|pagepath|jumpurl|pcjumpurl)[^>]*>([\s\S]*?)<\//gi)) {
+        add(match[1]);
     }
     return urls;
 }
+function walkDocCandidates(value, add) {
+    if (typeof value === 'string') {
+        add(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            walkDocCandidates(item, add);
+        return;
+    }
+    if (value && typeof value === 'object') {
+        for (const item of Object.values(value))
+            walkDocCandidates(item, add);
+    }
+}
 function parseOpendocBody(body) {
     const data = parseJsonp(body);
     if (!data)
@@ -68,14 +119,37 @@ async function fetchTencentDoc(http, url) {
     const parsed = parseTencentDocUrl(url);
     if (!parsed)
         return null;
-    const page = await http.text(parsed.pageUrl, {
+    const pageUrls = [parsed.pageUrl];
+    if (/doc\.weixin\.qq\.com/i.test(url) || parsed.id.includes('_')) {
+        const weixinPath = parsed.kind === 'form' ? `form/page/${parsed.id}` : `${parsed.kind}/${parsed.id}`;
+        const weixinUrl = `https://doc.weixin.qq.com/${weixinPath}`;
+        if (!pageUrls.includes(weixinUrl))
+            pageUrls.push(weixinUrl);
+    }
+    let lastError;
+    for (const pageUrl of pageUrls) {
+        try {
+            const doc = await fetchOpendocFromPage(http, parsed.id, pageUrl);
+            if (doc)
+                return doc;
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    if (lastError)
+        throw lastError;
+    return null;
+}
+async function fetchOpendocFromPage(http, id, pageUrl) {
+    const page = await http.text(pageUrl, {
         'user-agent': UA,
         accept: 'text/html',
     });
-    const opendocUrl = extractOpendocUrl(page.body, parsed.id) ?? defaultOpendocUrl(parsed.id);
+    const opendocUrl = extractOpendocUrl(page.body, id) ?? defaultOpendocUrl(id);
     const headers = {
         'user-agent': UA,
-        referer: parsed.pageUrl,
+        referer: pageUrl,
         accept: '*/*',
     };
     if (page.cookies)
@@ -83,14 +157,16 @@ async function fetchTencentDoc(http, url) {
     const opendoc = await http.text(opendocUrl, headers);
     return parseOpendocBody(opendoc.body);
 }
-function extractOfficeText(buffer, name) {
+function extractOfficeText(buffer, name, maxBytes = exports.DEFAULT_MAX_OFFICE_BYTES) {
+    if (buffer.length > maxBytes)
+        return null;
     const lower = name.toLowerCase();
     if (lower.endsWith('.txt')) {
         const text = buffer.toString('utf8').trim();
         return text ? { title: name, text, images: [] } : null;
     }
     if (lower.endsWith('.docx')) {
-        const xml = readZipEntry(buffer, 'word/document.xml');
+        const xml = readZipEntry(buffer, 'word/document.xml', maxBytes);
         if (!xml)
             return null;
         const text = xml
@@ -114,7 +190,7 @@ function defaultOpendocUrl(id) {
     return `https://docs.qq.com/dop-api/opendoc?u=&id=${id}&normal=1&outformat=1&noEscape=1&commandsFormat=1&doc_chunk_version=3&preview_token=&doc_chunk_flag=1&callback=clientVarsCallback`;
 }
 function extractOpendocUrl(html, id) {
-    const match = html.match(/\/\/docs\.qq\.com\/dop-api\/opendoc\?[^"'<\s]+/);
+    const match = html.match(/\/\/(?:docs\.qq\.com|doc\.weixin\.qq\.com)\/dop-api\/opendoc\?[^"'<\s]+/);
     if (!match)
         return undefined;
     const url = `https:${match[0]}`;
@@ -165,7 +241,7 @@ function extractUtf16LeText(buffer) {
         chars.push(run);
     return chars.join('\n');
 }
-function readZipEntry(buffer, suffix) {
+function readZipEntry(buffer, suffix, maxBytes) {
     let offset = 0;
     while (offset < buffer.length) {
         const found = buffer.indexOf(ZIP_LOCAL, offset);
@@ -175,6 +251,7 @@ function readZipEntry(buffer, suffix) {
             return null;
         const method = buffer.readUInt16LE(found + 8);
         const compSize = buffer.readUInt32LE(found + 18);
+        const uncompSize = buffer.readUInt32LE(found + 22);
         const nameLen = buffer.readUInt16LE(found + 26);
         const extraLen = buffer.readUInt16LE(found + 28);
         const nameStart = found + 30;
@@ -183,16 +260,41 @@ function readZipEntry(buffer, suffix) {
             return null;
         const name = buffer.subarray(nameStart, nameStart + nameLen).toString('utf8');
         if (name === suffix || name.endsWith(`/${suffix}`)) {
+            if (uncompSize > 0 && uncompSize <= 0xffff_fffe && uncompSize > maxBytes)
+                return null;
             const data = buffer.subarray(dataStart, dataStart + compSize);
             if (method === 0)
-                return data.toString('utf8');
-            if (method === 8)
-                return (0, node_zlib_1.inflateRawSync)(data).toString('utf8');
+                return data.length > maxBytes ? null : data.toString('utf8');
+            if (method === 8) {
+                try {
+                    return (0, node_zlib_1.inflateRawSync)(data, { maxOutputLength: maxBytes }).toString('utf8');
+                }
+                catch {
+                    return null;
+                }
+            }
         }
         offset = dataStart + Math.max(compSize, 1);
     }
     return null;
 }
+function decodePercents(text, times = 3) {
+    let current = text;
+    for (let i = 0; i < times; i++) {
+        if (!/%[0-9A-Fa-f]{2}/.test(current))
+            break;
+        try {
+            const next = decodeURIComponent(current);
+            if (next === current)
+                break;
+            current = next;
+        }
+        catch {
+            break;
+        }
+    }
+    return current;
+}
 function firstString(...values) {
     for (const value of values) {
         if (typeof value === 'string' && value.trim())

package/lib/index.d.ts

@@ -14,6 +14,7 @@ export interface Config {
     scanGroupInvite: boolean;
     scanDocs: boolean;
     adKeywords: string[];
+    maxOfficeMb: number;
     debug: boolean;
 }
 export declare const Config: Schema<Config>;

package/lib/index.js

@@ -29,6 +29,7 @@ exports.Config = koishi_1.Schema.object({
     scanGroupInvite: koishi_1.Schema.boolean().default(true).description('拦截邀请 / 推荐群聊 / 群名片分享卡。'),
     scanDocs: koishi_1.Schema.boolean().default(true).description('检查腾讯文档和 Word / 文本附件里的广告。'),
     adKeywords: koishi_1.Schema.array(koishi_1.Schema.string()).role('table').default([]).description('额外广告关键词。命中即撤回。'),
+    maxOfficeMb: koishi_1.Schema.number().min(1).default(5).description('解析 Word / 文本附件的大小上限（MB）。超出则跳过，防止解压占用过多内存。'),
     debug: koishi_1.Schema.boolean().default(true).description('输出调试日志：跳过原因、消息结构、下载/扫码/文档结果。'),
 });
 function apply(ctx, config) {
@@ -56,7 +57,10 @@ function apply(ctx, config) {
             return;
         }
         const docUrls = config.scanDocs
-            ? (0, document_1.collectTencentDocUrls)([parts.text, ...parts.shares, ...parts.urls].join('\n'))
+            ? uniqueStrings([
+                ...(0, document_1.collectTencentDocUrls)([parts.text, ...parts.shares, ...parts.urls].join('\n')),
+                ...parts.shares.flatMap(document_1.extractTencentDocUrlsFromShare),
+            ])
             : [];
         const officeFiles = config.scanDocs
             ? parts.files.filter(file => (0, detect_1.isOfficeFile)(file.name) || (0, detect_1.isOfficeFile)(file.src))
@@ -146,7 +150,7 @@ function apply(ctx, config) {
             }
             for (const file of officeFiles) {
                 try {
-                    const doc = (0, document_1.extractOfficeText)(await (0, qrcode_1.downloadFile)(ctx.http, { ...file, groupId: guildId }, resolveFile), file.name);
+                    const doc = (0, document_1.extractOfficeText)(await (0, qrcode_1.downloadFile)(ctx.http, { ...file, groupId: guildId }, resolveFile), file.name, Math.floor(config.maxOfficeMb * 1024 * 1024));
                     const ad = doc ? (0, ad_1.detectAdContent)(doc.text, doc.title || file.name, config.adKeywords) : null;
                     if (config.debug)
                         logger.info('office %s ad=%s', file.name, Boolean(ad));
@@ -210,6 +214,7 @@ function looksRelevant(parts, config) {
         return true;
     if (config.scanDocs && (parts.files.some(file => (0, detect_1.isOfficeFile)(file.name))
         || (0, document_1.collectTencentDocUrls)([parts.text, ...parts.shares, ...parts.urls].join('\n')).length
+        || parts.shares.some(share => (0, document_1.extractTencentDocUrlsFromShare)(share).length > 0)
         || parts.shares.some(share_1.isTencentDocCard))) {
         return true;
     }
@@ -233,6 +238,17 @@ function createDocHttp(http) {
 function errorMessage(error) {
     return error instanceof Error && error.message ? error.message : 'unknown';
 }
+function uniqueStrings(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        if (!value || seen.has(value))
+            continue;
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}
 function cookiesFromHeaders(headers) {
     const parts = typeof headers.getSetCookie === 'function'
         ? headers.getSetCookie()

package/lib/share.js

@@ -5,11 +5,16 @@ exports.isGroupInviteCard = isGroupInviteCard;
 exports.isTencentDocCard = isTencentDocCard;
 exports.extractShareCardText = extractShareCardText;
 const detect_1 = require("./detect");
+const document_1 = require("./document");
 const INVITE_APPS = new Set([
     'com.tencent.qun.invite',
     'com.tencent.troopsharecard',
 ]);
 const GROUP_PROMPT = /群名片|\[QQ名片\]群|推荐群聊|邀请你加入群聊|邀请加入群聊/;
+const TENCENT_DOC_APPIDS = new Set([
+    'wxd45c635d754dbf59',
+    '1108338344',
+]);
 function normalizeShare(payload) {
     let text = payload.trim();
     const wrapped = /^\[(?:CQ:)?json(?:,data=|:data=)/i.exec(text);
@@ -58,7 +63,12 @@ function isGroupInviteCard(payload) {
     return false;
 }
 function isTencentDocCard(payload) {
-    return /腾讯文档|docs\.qq\.com|doc\.weixin\.qq\.com/i.test(normalizeShare(payload));
+    const raw = normalizeShare(payload);
+    if (/腾讯文档|docs\.qq\.com|doc\.weixin\.qq\.com|qqdocurl/i.test(raw))
+        return true;
+    if (TENCENT_DOC_APPIDS.has(findShareAppId(readShareJson(raw))))
+        return true;
+    return (0, document_1.collectTencentDocUrls)(raw).length > 0;
 }
 function extractShareCardText(payload) {
     const raw = normalizeShare(payload);
@@ -87,6 +97,8 @@ function extractShareCardText(payload) {
                 add(item.tag);
                 add(item.summary);
                 add(item.brief);
+                add(item.appname);
+                add(item.appName);
             }
         }
         return chunks.join('\n');
@@ -139,6 +151,24 @@ function tryParseJson(text) {
         return null;
     }
 }
+function findShareAppId(value) {
+    if (!isRecord(value))
+        return '';
+    for (const key of ['appid', 'appId', 'appID']) {
+        const id = value[key];
+        if (id === undefined || id === null)
+            continue;
+        const text = String(id);
+        if (TENCENT_DOC_APPIDS.has(text))
+            return text;
+    }
+    for (const item of Object.values(value)) {
+        const found = findShareAppId(item);
+        if (found)
+            return found;
+    }
+    return '';
+}
 function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "koishi-plugin-ban-qrcode",
   "description": "检测到群内二维码、拉群卡片或文档广告后自动撤回并禁言",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
   "files": [

package/readme.md

@@ -14,7 +14,7 @@ Recall QR-code images, group-invite share cards, and freshman-list document ads,
 
 - 🔍 **扫图识码**：下载消息里的图片，解码是否含二维码
 - 📎 **拉群卡片**：识别 QQ 邀请加群 / 推荐群聊 / 群名片分享卡
-- 📄 **文档广告**：拉取腾讯文档或 Word / 文本附件正文，识别夹带的床品推销等广告
+- 📄 **文档广告**：拉取腾讯文档（含微信 / QQ 小程序卡片）或 Word / 文本附件正文，识别夹带的床品推销等广告
 - 🗑️ **自动撤回**：命中后立刻撤回原消息
 - 🔇 **自动禁言**：默认禁言 60 秒，秒数可配
 - 🛡️ **白名单**：默认跳过群主 / 管理员，也可按用户 ID、群 ID 过滤
@@ -74,7 +74,7 @@ npm run build
 1. 只处理群聊，忽略私聊和机器人自己的消息
 2. 图片二维码：收集 `img` / `image`，下载后解码
 3. 拉群卡片：识别 `json` / `xml` / `contact` 分享卡（`com.tencent.qun.invite`、群名片、`[推荐群]` 等）
-4. 文档广告：从文本、分享卡里取出 `docs.qq.com` 链接，或下载 `.doc` / `.docx` / `.txt`，识别夹带的推销文案（例如校园床品「送货到寝」）
+4. 文档广告：从文本、新闻卡、微信 / QQ 小程序腾讯文档卡里取出 `docs.qq.com` / `doc.weixin.qq.com` 链接（含编码过的小程序 path、`qqdocurl`），或下载 `.doc` / `.docx` / `.txt`，识别夹带的推销文案（例如校园床品「送货到寝」）
 5. 文档里的图也会再扫一遍二维码
 
 不会把解码出的文本或广告原文发回群里。纯物品清单（只写「被子、枕头」而没有推销）不会误杀。
@@ -94,6 +94,7 @@ npm run build
 | `scanGroupInvite` | `boolean` | `true` | 拦截邀请 / 推荐群聊分享卡 |
 | `scanDocs` | `boolean` | `true` | 检查腾讯文档和 Word / 文本附件 |
 | `adKeywords` | `string[]` | `[]` | 额外广告关键词，命中即撤回 |
+| `maxOfficeMb` | `number` | `5` | Word / 文本附件的大小上限（MB），超出则跳过 |
 | `debug` | `boolean` | `true` | 输出调试日志：跳过原因、消息结构、下载 / 扫码 / 文档结果 |
 
 内置词在 `src/ad-keywords.txt`，一行一条。`[strong]` 命中任意一条即撤回；`[commerce]` 要同时出现床品类用词且至少两条。控制台 `adKeywords` 按强匹配叠加。
@@ -278,7 +279,7 @@ Actions 会 `npm ci` → `npm test` → `npm run build` → `npm publish --acces
 
 ## Changelog
 
-当前版本 **1.2.0**：内置广告词改到 `ad-keywords.txt` 维护，控制台 `adKeywords` 仍作额外强匹配。1.1.3 补拦 QQ 群名片。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃。1.1.1 补齐跳过原因日志。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
+当前版本 **1.3.0**：识别微信 / QQ 小程序腾讯文档卡，还原 `docs.qq.com` 链接后再按原逻辑拉正文。1.2.1：Word / 文本附件默认限制 5MB（`maxOfficeMb`）。1.2.0 起内置广告词改到 `ad-keywords.txt` 维护。1.1.3 补拦 QQ 群名片。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃。1.1.1 补齐跳过原因日志。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
 
 ## License