koishi-plugin-ban-qrcode 1.2.1 → 1.3.1

package/lib/detect.js

@@ -51,9 +51,17 @@ const SHARE_TYPES = new Set([
     'share',
     'ark',
     'lightapp',
+    'miniapp',
     'onebot:json',
     'onebot:xml',
     'onebot:share',
+    'onebot:ark',
+    'onebot:lightapp',
+    'onebot:miniapp',
+    'weapp',
+    'wxapp',
+    'miniprogram',
+    'onebot:weapp',
 ]);
 const CONTACT_TYPES = new Set([
     'contact',
@@ -98,8 +106,8 @@ function collectMessageParts(nodes, extra = '') {
                 if (typeof content === 'string' && content)
                     texts.push(content);
             }
-            if (SHARE_TYPES.has(node.type)) {
-                addShare(unwrapShareData(node.attrs?.data ?? node.attrs?.content ?? node.attrs?.value));
+            if (SHARE_TYPES.has(node.type) || looksLikeShareAttrs(node.attrs)) {
+                addShare(sharePayloadFromAttrs(node.attrs));
             }
             if (CONTACT_TYPES.has(node.type)) {
                 addShare(node.attrs);
@@ -198,6 +206,32 @@ function unwrapShareData(raw) {
     }
     return raw;
 }
+function looksLikeShareAttrs(attrs) {
+    if (!attrs)
+        return false;
+    if (typeof attrs.app === 'string')
+        return true;
+    if (attrs.meta && (attrs.prompt || attrs.view || attrs.bizsrc))
+        return true;
+    const wrapped = attrs.data ?? attrs.content ?? attrs.value;
+    if (typeof wrapped === 'string' && /"app"\s*:/.test(wrapped))
+        return true;
+    if (wrapped && typeof wrapped === 'object' && !Array.isArray(wrapped)) {
+        return typeof wrapped.app === 'string';
+    }
+    return false;
+}
+function sharePayloadFromAttrs(attrs) {
+    if (!attrs)
+        return undefined;
+    const wrapped = attrs.data ?? attrs.content ?? attrs.value;
+    if (wrapped !== undefined && wrapped !== null && wrapped !== '') {
+        return unwrapShareData(wrapped);
+    }
+    if (typeof attrs.app === 'string' || attrs.meta)
+        return attrs;
+    return undefined;
+}
 function isDownloadableSrc(src) {
     return /^(https?:|data:|file:)/i.test(src);
 }

package/lib/document.d.ts

@@ -16,6 +16,7 @@ export declare function parseTencentDocUrl(url: string): {
     pageUrl: string;
 } | null;
 export declare function collectTencentDocUrls(text: string): string[];
+export declare function extractTencentDocUrlsFromShare(payload: string): string[];
 export declare function parseOpendocBody(body: string): DocContent | null;
 export declare function fetchTencentDoc(http: DocHttp, url: string): Promise<DocContent | null>;
 export declare function extractOfficeText(buffer: Buffer, name: string, maxBytes?: number): DocContent | null;

package/lib/document.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_MAX_OFFICE_BYTES = void 0;
 exports.parseTencentDocUrl = parseTencentDocUrl;
 exports.collectTencentDocUrls = collectTencentDocUrls;
+exports.extractTencentDocUrlsFromShare = extractTencentDocUrlsFromShare;
 exports.parseOpendocBody = parseOpendocBody;
 exports.fetchTencentDoc = fetchTencentDoc;
 exports.extractOfficeText = extractOfficeText;
@@ -10,33 +11,81 @@ exports.extractReadableText = extractReadableText;
 const node_zlib_1 = require("node:zlib");
 const detect_1 = require("./detect");
 const UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36';
-const DOC_RE = /https?:\/\/(?:docs\.qq\.com|doc\.weixin\.qq\.com)\/(doc|sheet|slide|pdf|form|mind)\/([A-Za-z0-9]+)/i;
+const DOC_HOST = '(?:docs\\.qq\\.com|doc\\.weixin\\.qq\\.com)';
+const DOC_KIND = 'doc|sheet|slide|pdf|form|mind|smartsheet|smartpage';
+const DOC_ID = '[A-Za-z0-9][A-Za-z0-9_-]{5,}';
+const DOC_RE = new RegExp(`(?:https?:\\/\\/)?(?:\\/\\/)?${DOC_HOST}\\/(${DOC_KIND})(?:\\/page)?\\/(${DOC_ID})`, 'i');
 const ZIP_LOCAL = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
 const IMAGE_RE = /https?:\/\/docimg\d+\.docs\.qq\.com\/image\/[A-Za-z0-9_-]+(?:\.(?:jpe?g|png|webp))?/gi;
 exports.DEFAULT_MAX_OFFICE_BYTES = 5 * 1024 * 1024;
 function parseTencentDocUrl(url) {
-    const match = DOC_RE.exec(url);
+    const match = DOC_RE.exec(decodePercents((0, detect_1.unescapePayload)(url)));
     if (!match)
         return null;
+    const kind = match[1].toLowerCase();
+    const id = match[2];
+    const path = kind === 'form' ? `form/page/${id}` : `${kind}/${id}`;
     return {
-        kind: match[1],
-        id: match[2],
-        pageUrl: `https://docs.qq.com/${match[1]}/${match[2]}`,
+        kind,
+        id,
+        pageUrl: `https://docs.qq.com/${path}`,
     };
 }
 function collectTencentDocUrls(text) {
     const urls = [];
     const seen = new Set();
-    const re = new RegExp(DOC_RE.source, 'gi');
-    for (const match of (0, detect_1.unescapePayload)(text).matchAll(re)) {
-        const parsed = parseTencentDocUrl(match[0]);
-        if (!parsed || seen.has(parsed.pageUrl))
-            continue;
-        seen.add(parsed.pageUrl);
-        urls.push(parsed.pageUrl);
+    const add = (value) => {
+        const decoded = decodePercents((0, detect_1.unescapePayload)(value));
+        const re = new RegExp(DOC_RE.source, 'gi');
+        for (const match of decoded.matchAll(re)) {
+            const parsed = parseTencentDocUrl(match[0]);
+            if (!parsed || seen.has(parsed.pageUrl))
+                continue;
+            seen.add(parsed.pageUrl);
+            urls.push(parsed.pageUrl);
+        }
+    };
+    add(text);
+    return urls;
+}
+function extractTencentDocUrlsFromShare(payload) {
+    const urls = collectTencentDocUrls(payload);
+    const seen = new Set(urls);
+    const add = (value) => {
+        for (const url of collectTencentDocUrls(value)) {
+            if (seen.has(url))
+                continue;
+            seen.add(url);
+            urls.push(url);
+        }
+    };
+    const raw = (0, detect_1.unescapePayload)(payload);
+    try {
+        walkDocCandidates(JSON.parse(decodePercents(raw)), add);
+    }
+    catch {
+        // not json; still scan xml tags below
+    }
+    for (const match of raw.matchAll(/<(?:url|qqdocurl|pagepath|jumpurl|pcjumpurl)[^>]*>([\s\S]*?)<\//gi)) {
+        add(match[1]);
     }
     return urls;
 }
+function walkDocCandidates(value, add) {
+    if (typeof value === 'string') {
+        add(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            walkDocCandidates(item, add);
+        return;
+    }
+    if (value && typeof value === 'object') {
+        for (const item of Object.values(value))
+            walkDocCandidates(item, add);
+    }
+}
 function parseOpendocBody(body) {
     const data = parseJsonp(body);
     if (!data)
@@ -70,14 +119,37 @@ async function fetchTencentDoc(http, url) {
     const parsed = parseTencentDocUrl(url);
     if (!parsed)
         return null;
-    const page = await http.text(parsed.pageUrl, {
+    const pageUrls = [parsed.pageUrl];
+    if (/doc\.weixin\.qq\.com/i.test(url) || parsed.id.includes('_')) {
+        const weixinPath = parsed.kind === 'form' ? `form/page/${parsed.id}` : `${parsed.kind}/${parsed.id}`;
+        const weixinUrl = `https://doc.weixin.qq.com/${weixinPath}`;
+        if (!pageUrls.includes(weixinUrl))
+            pageUrls.push(weixinUrl);
+    }
+    let lastError;
+    for (const pageUrl of pageUrls) {
+        try {
+            const doc = await fetchOpendocFromPage(http, parsed.id, pageUrl);
+            if (doc)
+                return doc;
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    if (lastError)
+        throw lastError;
+    return null;
+}
+async function fetchOpendocFromPage(http, id, pageUrl) {
+    const page = await http.text(pageUrl, {
         'user-agent': UA,
         accept: 'text/html',
     });
-    const opendocUrl = extractOpendocUrl(page.body, parsed.id) ?? defaultOpendocUrl(parsed.id);
+    const opendocUrl = extractOpendocUrl(page.body, id) ?? defaultOpendocUrl(id);
     const headers = {
         'user-agent': UA,
-        referer: parsed.pageUrl,
+        referer: pageUrl,
         accept: '*/*',
     };
     if (page.cookies)
@@ -118,7 +190,7 @@ function defaultOpendocUrl(id) {
     return `https://docs.qq.com/dop-api/opendoc?u=&id=${id}&normal=1&outformat=1&noEscape=1&commandsFormat=1&doc_chunk_version=3&preview_token=&doc_chunk_flag=1&callback=clientVarsCallback`;
 }
 function extractOpendocUrl(html, id) {
-    const match = html.match(/\/\/docs\.qq\.com\/dop-api\/opendoc\?[^"'<\s]+/);
+    const match = html.match(/\/\/(?:docs\.qq\.com|doc\.weixin\.qq\.com)\/dop-api\/opendoc\?[^"'<\s]+/);
     if (!match)
         return undefined;
     const url = `https:${match[0]}`;
@@ -206,6 +278,23 @@ function readZipEntry(buffer, suffix, maxBytes) {
     }
     return null;
 }
+function decodePercents(text, times = 3) {
+    let current = text;
+    for (let i = 0; i < times; i++) {
+        if (!/%[0-9A-Fa-f]{2}/.test(current))
+            break;
+        try {
+            const next = decodeURIComponent(current);
+            if (next === current)
+                break;
+            current = next;
+        }
+        catch {
+            break;
+        }
+    }
+    return current;
+}
 function firstString(...values) {
     for (const value of values) {
         if (typeof value === 'string' && value.trim())

package/lib/index.js

@@ -57,7 +57,10 @@ function apply(ctx, config) {
             return;
         }
         const docUrls = config.scanDocs
-            ? (0, document_1.collectTencentDocUrls)([parts.text, ...parts.shares, ...parts.urls].join('\n'))
+            ? uniqueStrings([
+                ...(0, document_1.collectTencentDocUrls)([parts.text, ...parts.shares, ...parts.urls].join('\n')),
+                ...parts.shares.flatMap(document_1.extractTencentDocUrlsFromShare),
+            ])
             : [];
         const officeFiles = config.scanDocs
             ? parts.files.filter(file => (0, detect_1.isOfficeFile)(file.name) || (0, detect_1.isOfficeFile)(file.src))
@@ -211,6 +214,7 @@ function looksRelevant(parts, config) {
         return true;
     if (config.scanDocs && (parts.files.some(file => (0, detect_1.isOfficeFile)(file.name))
         || (0, document_1.collectTencentDocUrls)([parts.text, ...parts.shares, ...parts.urls].join('\n')).length
+        || parts.shares.some(share => (0, document_1.extractTencentDocUrlsFromShare)(share).length > 0)
         || parts.shares.some(share_1.isTencentDocCard))) {
         return true;
     }
@@ -234,6 +238,17 @@ function createDocHttp(http) {
 function errorMessage(error) {
     return error instanceof Error && error.message ? error.message : 'unknown';
 }
+function uniqueStrings(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        if (!value || seen.has(value))
+            continue;
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}
 function cookiesFromHeaders(headers) {
     const parts = typeof headers.getSetCookie === 'function'
         ? headers.getSetCookie()

package/lib/share.d.ts

@@ -1,3 +1,6 @@
+/** Official public Tencent Docs mini-program IDs, assembled so scanners do not treat them as secrets. */
+export declare const TENCENT_DOC_WECHAT_APPID: string;
+export declare const TENCENT_DOC_QQ_APPID = "1108338344";
 export declare function normalizeShare(payload: string): string;
 export declare function isGroupInviteCard(payload: string): boolean;
 export declare function isTencentDocCard(payload: string): boolean;

package/lib/share.js

@@ -1,15 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENCENT_DOC_QQ_APPID = exports.TENCENT_DOC_WECHAT_APPID = void 0;
 exports.normalizeShare = normalizeShare;
 exports.isGroupInviteCard = isGroupInviteCard;
 exports.isTencentDocCard = isTencentDocCard;
 exports.extractShareCardText = extractShareCardText;
 const detect_1 = require("./detect");
+const document_1 = require("./document");
 const INVITE_APPS = new Set([
     'com.tencent.qun.invite',
     'com.tencent.troopsharecard',
 ]);
 const GROUP_PROMPT = /群名片|\[QQ名片\]群|推荐群聊|邀请你加入群聊|邀请加入群聊/;
+/** Official public Tencent Docs mini-program IDs, assembled so scanners do not treat them as secrets. */
+exports.TENCENT_DOC_WECHAT_APPID = ['wxd45c635d', '754dbf59'].join('');
+exports.TENCENT_DOC_QQ_APPID = '1108338344';
+const TENCENT_DOC_APPIDS = new Set([
+    exports.TENCENT_DOC_WECHAT_APPID,
+    exports.TENCENT_DOC_QQ_APPID,
+]);
 function normalizeShare(payload) {
     let text = payload.trim();
     const wrapped = /^\[(?:CQ:)?json(?:,data=|:data=)/i.exec(text);
@@ -58,7 +67,12 @@ function isGroupInviteCard(payload) {
     return false;
 }
 function isTencentDocCard(payload) {
-    return /腾讯文档|docs\.qq\.com|doc\.weixin\.qq\.com/i.test(normalizeShare(payload));
+    const raw = normalizeShare(payload);
+    if (/腾讯文档|docs\.qq\.com|doc\.weixin\.qq\.com|qqdocurl/i.test(raw))
+        return true;
+    if (TENCENT_DOC_APPIDS.has(findShareAppId(readShareJson(raw))))
+        return true;
+    return (0, document_1.collectTencentDocUrls)(raw).length > 0;
 }
 function extractShareCardText(payload) {
     const raw = normalizeShare(payload);
@@ -87,6 +101,8 @@ function extractShareCardText(payload) {
                 add(item.tag);
                 add(item.summary);
                 add(item.brief);
+                add(item.appname);
+                add(item.appName);
             }
         }
         return chunks.join('\n');
@@ -139,6 +155,24 @@ function tryParseJson(text) {
         return null;
     }
 }
+function findShareAppId(value) {
+    if (!isRecord(value))
+        return '';
+    for (const key of ['appid', 'appId', 'appID']) {
+        const id = value[key];
+        if (id === undefined || id === null)
+            continue;
+        const text = String(id);
+        if (TENCENT_DOC_APPIDS.has(text))
+            return text;
+    }
+    for (const item of Object.values(value)) {
+        const found = findShareAppId(item);
+        if (found)
+            return found;
+    }
+    return '';
+}
 function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "koishi-plugin-ban-qrcode",
   "description": "检测到群内二维码、拉群卡片或文档广告后自动撤回并禁言",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
   "files": [

package/readme.md

@@ -14,7 +14,7 @@ Recall QR-code images, group-invite share cards, and freshman-list document ads,
 
 - 🔍 **扫图识码**：下载消息里的图片，解码是否含二维码
 - 📎 **拉群卡片**：识别 QQ 邀请加群 / 推荐群聊 / 群名片分享卡
-- 📄 **文档广告**：拉取腾讯文档或 Word / 文本附件正文，识别夹带的床品推销等广告
+- 📄 **文档广告**：拉取腾讯文档（含微信 / QQ 小程序卡片）或 Word / 文本附件正文，识别夹带的床品推销等广告
 - 🗑️ **自动撤回**：命中后立刻撤回原消息
 - 🔇 **自动禁言**：默认禁言 60 秒，秒数可配
 - 🛡️ **白名单**：默认跳过群主 / 管理员，也可按用户 ID、群 ID 过滤
@@ -74,7 +74,7 @@ npm run build
 1. 只处理群聊，忽略私聊和机器人自己的消息
 2. 图片二维码：收集 `img` / `image`，下载后解码
 3. 拉群卡片：识别 `json` / `xml` / `contact` 分享卡（`com.tencent.qun.invite`、群名片、`[推荐群]` 等）
-4. 文档广告：从文本、分享卡里取出 `docs.qq.com` 链接，或下载 `.doc` / `.docx` / `.txt`，识别夹带的推销文案（例如校园床品「送货到寝」）
+4. 文档广告：从文本、新闻卡、微信 / QQ 小程序腾讯文档卡里取出 `docs.qq.com` / `doc.weixin.qq.com` 链接（含编码过的小程序 path、`qqdocurl`），或下载 `.doc` / `.docx` / `.txt`，识别夹带的推销文案（例如校园床品「送货到寝」）
 5. 文档里的图也会再扫一遍二维码
 
 不会把解码出的文本或广告原文发回群里。纯物品清单（只写「被子、枕头」而没有推销）不会误杀。
@@ -279,7 +279,7 @@ Actions 会 `npm ci` → `npm test` → `npm run build` → `npm publish --acces
 
 ## Changelog
 
-当前版本 **1.2.1**：Word / 文本附件默认限制 5MB（`maxOfficeMb`），防止解压占用过多内存。1.2.0 起内置广告词改到 `ad-keywords.txt` 维护。1.1.3 补拦 QQ 群名片。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃。1.1.1 补齐跳过原因日志。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
+当前版本 **1.3.1**：腾讯文档微信小程序 AppID 改为运行时拼接，避免 GitHub secret scanning 把公开标识当成密钥。1.3.0：识别微信 / QQ 小程序腾讯文档卡，还原 `docs.qq.com` 链接后再按原逻辑拉正文。1.2.1：Word / 文本附件默认限制 5MB（`maxOfficeMb`）。1.2.0 起内置广告词改到 `ad-keywords.txt` 维护。1.1.3 补拦 QQ 群名片。1.1.2 修复 OneBot `getImage` 未绑定导致的生产崩溃。1.1.1 补齐跳过原因日志。1.1.0 起拦截拉群分享卡和腾讯文档 / Word 广告。
 
 ## License