module-develop-kit 1.0.6 → 1.2.0

package/dist/commonjs-virtual-dir/browser2.js

@@ -0,0 +1,7 @@
+import { getDefaultExportFromCjs as r } from "./_commonjsHelpers.js";
+import { __require as e } from "../vendor/debug/src/browser.js";
+var o = e();
+const i = /* @__PURE__ */ r(o);
+export {
+  i as default
+};

package/dist/commonjs-virtual-dir/index4.js

@@ -1,4 +1,2 @@
-var r = {};
-export {
-  r as __exports
-};
+import { __require as e } from "../vendor/ieee754/index.js";
+e();

package/dist/commonjs-virtual-dir/index5.js

@@ -1,4 +1,4 @@
-var e = { exports: {} };
+var r = {};
 export {
-  e as __module
+  r as __exports
 };

package/dist/commonjs-virtual-dir/index6.js

@@ -1,4 +1,4 @@
-var s = {};
+var e = { exports: {} };
 export {
-  s as __exports
+  e as __module
 };

package/dist/commonjs-virtual-dir/index7.js

@@ -0,0 +1,4 @@
+var e = {};
+export {
+  e as __exports
+};

package/dist/commonjs-virtual-dir/index8.js

@@ -0,0 +1,4 @@
+var s = {};
+export {
+  s as __exports
+};

package/dist/main.d.ts

@@ -1,4 +1,20 @@
 import { Ref } from 'vue';
+import { supportedExtensions } from 'file-type';
+import { supportedMimeTypes } from 'file-type';
+
+/**
+ * 支持的文件类型配置
+ * 基于 file-type 库的 supportedMimeTypes 动态生成
+ */
+export declare const ALLOWED_FILE_TYPES: {
+    readonly image: Set<string>;
+    readonly document: Set<string>;
+    readonly video: Set<string>;
+    readonly audio: Set<string>;
+    readonly archive: Set<string>;
+    readonly font: Set<string>;
+    readonly model: Set<string>;
+};
 
 /**
  * 防重放攻击策略
@@ -23,6 +39,46 @@ export declare const CallLogger: {
     error(message: unknown, ...args: unknown[]): void;
 };
 
+/**
+ * 检测文件真实类型并验证扩展名
+ *
+ * @param file 要检测的文件
+ * @param _allowedExtensions 允许的扩展名列表(不含点),如 ['jpg', 'png']，或者 'jpg,png' 或者 'jpg'
+ * @param options 检测选项
+ * @returns 检测结果
+ */
+export declare function detectFileByExtension(file: File, _allowedExtensions: TMaybeArray<string>, options?: FileDetectionOptions): Promise<FileDetectionResult>;
+
+/**
+ * 检测文件真实类型并验证 MIME 类型
+ *
+ * @param file 要检测的文件
+ * @param _allowedMimes 允许的MIME类型列表 支持单个或者数组。单个支持使用,分割
+ * @param options 检测选项
+ * @returns 检测结果
+ */
+export declare function detectFileByMime(file: File, _allowedMimes: TMaybeArray<string>, options?: FileDetectionOptions): Promise<FileDetectionResult>;
+
+/**
+ * 批量检测文件扩展名
+ *
+ * @param files 要检测的文件列表
+ * @param allowedExtensions 允许的扩展名列表
+ * @param options 检测选项
+ * @returns 检测结果列表
+ */
+export declare function detectionFilesByExtension(files: File[], allowedExtensions: TMaybeArray<string>, options?: FileDetectionOptions): Promise<FileDetectionResult[]>;
+
+/**
+ * 批量检测文件 MIME 类型
+ *
+ * @param files 要检测的文件列表
+ * @param allowedMimes 允许的MIME类型列表
+ * @param options 检测选项
+ * @returns 检测结果列表
+ */
+export declare function detectionFilesByMime(files: File[], allowedMimes: TMaybeArray<string>, options?: FileDetectionOptions): Promise<FileDetectionResult[]>;
+
 export declare enum ECallStatus {
     /**
      * 正在接听中
@@ -106,6 +162,40 @@ export declare interface EventBusProps {
 
 declare type EventFnc = (...args: any) => void;
 
+export declare interface FileDetectionOptions {
+    /**
+     * 最大文件大小(字节)
+     */
+    maxSize?: number;
+}
+
+export declare interface FileDetectionResult {
+    /**
+     * 是否通过检测
+     */
+    valid: boolean;
+    /**
+     * 检测到的真实MIME类型
+     */
+    detectedMime?: string;
+    /**
+     * 检测到的文件扩展名
+     */
+    detectedExt?: string;
+    /**
+     * 错误信息
+     */
+    error?: string;
+    /**
+     * 文件声称的MIME类型(来自File对象)
+     */
+    claimedMime?: string;
+    /**
+     * MIME类型是否匹配(真实vs声称)
+     */
+    mimeMatches?: boolean;
+}
+
 /**
  * 安全的解析html内容 防止xss攻击
  * @param input 输入的html内容
@@ -231,6 +321,29 @@ export declare interface ISm4Params {
     key: string;
 }
 
+/**
+ * 检测 URL 是否包含 XSS 攻击
+ * @param url - 需要检测的 URL
+ * @param options - 配置选项
+ * @returns 是否安全
+ */
+export declare function isUrlSafe(url: unknown, options?: UrlSanitizeOptions): boolean;
+
+/**
+ * 便捷方法: 检测是否为文档文件(基于 MIME 类型)
+ */
+export declare function isValidDocument(file: File, maxSize?: number): Promise<FileDetectionResult>;
+
+/**
+ * 便捷方法: 检测是否为图片文件(基于 MIME 类型)
+ */
+export declare function isValidImage(file: File, maxSize?: number): Promise<FileDetectionResult>;
+
+/**
+ * 便捷方法: 检测是否为视频文件(基于 MIME 类型)
+ */
+export declare function isValidVideo(file: File, maxSize?: number): Promise<FileDetectionResult>;
+
 /**
  * 请求数据加密
  * @param publicKey 公钥
@@ -254,6 +367,22 @@ export declare function responseDataEncryption<T>(stepCb: (_headers: {
     [EHeaderKey.publicKey]: string;
 }) => Promise<IResponseDataEncryptionStep>): Promise<T>;
 
+/**
+ * 消毒 URL，返回安全的 URL 或替代 URL
+ * @param url - 需要消毒的 URL
+ * @param options - 配置选项
+ * @returns 安全的 URL
+ */
+export declare function sanitizeUrl(url: unknown, options?: UrlSanitizeOptions): string;
+
+/**
+ * 批量消毒 URL 列表
+ * @param urls - URL 列表
+ * @param options - 配置选项
+ * @returns 消毒后的 URL 列表
+ */
+export declare function sanitizeUrls(urls: string[], options?: UrlSanitizeOptions): string[];
+
 /**
  * sip code对应的的状态，优先处理 code 对应的提示文案，如果不存在则按照 causes 状态去处理
  */
@@ -314,16 +443,48 @@ declare interface SipAccount {
  */
 export declare const startNoDebugger: () => void;
 
+export { supportedExtensions }
+
+export { supportedMimeTypes }
+
 export declare type TData = _TData | _TData[];
 
 declare type _TData = null | undefined | number | string | Record<string, any>;
 
+export declare type TMaybeArray<T> = T[] | T;
+
 export declare type TNullable<T> = T | null;
 
 export declare type TObj<K extends keyof any = string, T = any> = Record<K, T>;
 
 export declare type TUndefinable<T> = T | undefined;
 
+/**
+ * URL XSS 防护工具
+ * 用于检测和拦截包含 XSS 攻击的 URL
+ */
+/**
+ * URL 消毒选项
+ */
+export declare interface UrlSanitizeOptions {
+    /**
+     * 是否允许相对路径 URL，默认 true
+     */
+    allowRelative?: boolean;
+    /**
+     * 额外的安全协议
+     */
+    extraSafeProtocols?: string[];
+    /**
+     * 当检测到 XSS 时的替代 URL，默认 '#'
+     */
+    fallbackUrl?: string;
+    /**
+     * 是否严格模式，严格模式下只允许 http/https，默认 false
+     */
+    strictMode?: boolean;
+}
+
 /**
  * 打电话
  * FIXME： callBack 为什么存在？zyy 中通过 useCall 拿到的变量无法实现响应式，所以通过 callback 的方式更新外部依赖。

package/dist/main.js

@@ -1,21 +1,37 @@
-import { useCall as e } from "./src/outside-call/index.js";
-import { antiReplyAttackStrategy as a, requestDataEncryption as E, responseDataEncryption as p } from "./src/shield/crypto/index.js";
-import { htmlSanitize as l } from "./src/shield/html-sanitize.js";
-import { startNoDebugger as n } from "./src/shield/no-debugger.js";
-import { EventBus as s } from "./src/utils/eventBus.js";
-import { CallLogger as _ } from "./src/outside-call/utils.js";
-import { ECallStatus as i, EMIT_EVENT_NAME as u, SIP_CODE_MESSAGE as C, SIP_ERROR_CAUSES as y } from "./src/outside-call/constants.js";
+import { useCall as o } from "./src/outside-call/index.js";
+import { antiReplyAttackStrategy as i, requestDataEncryption as s, responseDataEncryption as a } from "./src/shield/crypto/index.js";
+import { ALLOWED_FILE_TYPES as p, detectFileByExtension as E, detectFileByMime as l, detectionFilesByExtension as m, detectionFilesByMime as x, isValidDocument as f, isValidImage as S, isValidVideo as d } from "./src/shield/file-detection.js";
+import { htmlSanitize as c } from "./src/shield/html-sanitize.js";
+import { startNoDebugger as _ } from "./src/shield/no-debugger.js";
+import { isUrlSafe as D, sanitizeUrl as M, sanitizeUrls as A } from "./src/shield/url-sanitize.js";
+import { EventBus as C } from "./src/utils/eventBus.js";
+import { CallLogger as I } from "./src/outside-call/utils.js";
+import { ECallStatus as L, EMIT_EVENT_NAME as R, SIP_CODE_MESSAGE as T, SIP_ERROR_CAUSES as U } from "./src/outside-call/constants.js";
+import { supportedExtensions as N, supportedMimeTypes as O } from "./vendor/file-type/source/index.js";
 export {
-  _ as CallLogger,
-  i as ECallStatus,
-  u as EMIT_EVENT_NAME,
-  s as EventBus,
-  C as SIP_CODE_MESSAGE,
-  y as SIP_ERROR_CAUSES,
-  a as antiReplyAttackStrategy,
-  l as htmlSanitize,
-  E as requestDataEncryption,
-  p as responseDataEncryption,
-  n as startNoDebugger,
-  e as useCall
+  p as ALLOWED_FILE_TYPES,
+  I as CallLogger,
+  L as ECallStatus,
+  R as EMIT_EVENT_NAME,
+  C as EventBus,
+  T as SIP_CODE_MESSAGE,
+  U as SIP_ERROR_CAUSES,
+  i as antiReplyAttackStrategy,
+  E as detectFileByExtension,
+  l as detectFileByMime,
+  m as detectionFilesByExtension,
+  x as detectionFilesByMime,
+  c as htmlSanitize,
+  D as isUrlSafe,
+  f as isValidDocument,
+  S as isValidImage,
+  d as isValidVideo,
+  s as requestDataEncryption,
+  a as responseDataEncryption,
+  M as sanitizeUrl,
+  A as sanitizeUrls,
+  _ as startNoDebugger,
+  N as supportedExtensions,
+  O as supportedMimeTypes,
+  o as useCall
 };

package/dist/src/shield/file-detection.js

@@ -0,0 +1,143 @@
+import { supportedMimeTypes as l, fileTypeFromStream as y } from "../../vendor/file-type/source/index.js";
+import { supportedExtensions as z } from "../../vendor/file-type/source/index.js";
+function d(e) {
+  const t = /* @__PURE__ */ new Set();
+  for (const r of l)
+    r.startsWith(`${e}/`) && t.add(r);
+  return t;
+}
+const f = {
+  // 图片类型 - 从 supportedMimeTypes 中过滤 image/*
+  image: d("image"),
+  // 文档类型 - 包含常见办公文档
+  document: /* @__PURE__ */ new Set([
+    ...Array.from(l).filter(
+      (e) => e.includes("pdf") || e.includes("msword") || e.includes("officedocument") || e.includes("ms-excel") || e.includes("ms-powerpoint") || e.includes("opendocument") || e === "text/plain"
+    )
+  ]),
+  // 视频类型 - 从 supportedMimeTypes 中过滤 video/*
+  video: d("video"),
+  // 音频类型 - 从 supportedMimeTypes 中过滤 audio/*
+  audio: d("audio"),
+  // 压缩文件
+  archive: /* @__PURE__ */ new Set([
+    ...Array.from(l).filter(
+      (e) => e.includes("zip") || e.includes("rar") || e.includes("7z") || e.includes("tar") || e.includes("gzip") || e.includes("compress")
+    )
+  ]),
+  // 字体文件
+  font: d("font"),
+  // 模型文件
+  model: d("model")
+};
+function M(e, t) {
+  return t.some((r) => {
+    const i = r.trim();
+    if (!i)
+      return !1;
+    if (i === e)
+      return !0;
+    if (i.endsWith("/*")) {
+      const n = i.slice(0, i.indexOf("/"));
+      return e.startsWith(`${n}/`);
+    }
+    return !1;
+  });
+}
+async function p(e, t) {
+  const { maxSize: r } = t;
+  if (r && e.size > r)
+    return {
+      valid: !1,
+      error: `上传文件大小不能超过 ${(r / 1024 / 1024).toFixed(2)}MB`,
+      claimedMime: e.type
+    };
+  const i = await y(e.stream());
+  if (!i)
+    return {
+      valid: !1,
+      error: "无法检测文件类型,可能是不支持的格式或文件已损坏",
+      claimedMime: e.type
+    };
+  const n = i.mime, o = i.ext, c = e.type, s = n === c;
+  return !s && c && console.warn("文件MIME类型不匹配", {
+    claimed: c,
+    detected: n,
+    fileName: e.name
+  }), {
+    detectedMime: n,
+    detectedExt: o,
+    claimedMime: c,
+    mimeMatches: s
+  };
+}
+async function u(e, t, r = {}) {
+  const i = await p(e, r);
+  if ("valid" in i && !i.valid)
+    return i;
+  const { detectedMime: n, detectedExt: o, claimedMime: c, mimeMatches: s } = i, m = Array.isArray(t) ? t : t.split(",");
+  return !n || !M(n, m) ? {
+    valid: !1,
+    error: `不支持的文件类型: ${n || "未知"}`,
+    detectedMime: n,
+    detectedExt: o,
+    claimedMime: c,
+    mimeMatches: s
+  } : {
+    valid: !0,
+    detectedMime: n,
+    detectedExt: o,
+    claimedMime: c,
+    mimeMatches: s
+  };
+}
+async function v(e, t, r = {}) {
+  const i = await p(e, r);
+  if ("valid" in i && !i.valid)
+    return i;
+  const { detectedMime: n, detectedExt: o, claimedMime: c, mimeMatches: s } = i, m = Array.isArray(t) ? t : t.split(",").map((a) => a.trim());
+  return !o || !m.some((a) => o === a || `.${o}` === a) ? {
+    valid: !1,
+    error: `不支持的文件扩展名: .${o || "未知"}`,
+    detectedMime: n,
+    detectedExt: o,
+    claimedMime: c,
+    mimeMatches: s
+  } : {
+    valid: !0,
+    detectedMime: n,
+    detectedExt: o,
+    claimedMime: c,
+    mimeMatches: s
+  };
+}
+function A(e, t, r = {}) {
+  return Promise.all(e.map((i) => u(i, t, r)));
+}
+function g(e, t, r = {}) {
+  return Promise.all(e.map((i) => v(i, t, r)));
+}
+function E(e, t) {
+  const r = Array.from(f.image);
+  return u(e, r, { maxSize: t });
+}
+function w(e, t) {
+  const r = Array.from(f.document);
+  return u(e, r, { maxSize: t });
+}
+function F(e, t) {
+  const r = Array.from(f.video);
+  return u(e, r, { maxSize: t });
+}
+export {
+  f as ALLOWED_FILE_TYPES,
+  v as detectFileByExtension,
+  u as detectFileByMime,
+  g as detectionFilesByExtension,
+  A as detectionFilesByMime,
+  w as isValidDocument,
+  E as isValidImage,
+  F as isValidVideo,
+  z as supportedExtensions,
+  l as supportedMimeTypes
+};

package/dist/src/shield/url-sanitize.js

@@ -0,0 +1,59 @@
+const i = ["http:", "https:", "mailto:", "tel:", "sms:", "ftp:", "ftps:"], o = [
+  // eslint-disable-next-line no-script-url
+  "javascript:",
+  "data:",
+  "vbscript:",
+  "file:",
+  "about:",
+  "blob:"
+];
+function l(t) {
+  return t.replace(/[​-‍]/g, "").replace(/\s+/g, "").trim();
+}
+function n(t) {
+  const e = t.toLowerCase();
+  return [
+    /javascript:/i,
+    /data:text\/html/i,
+    /vbscript:/i,
+    /on\w+\s*=/i,
+    // HTML 事件处理器，如 onclick=, onload=
+    /<script/i,
+    /&#/i,
+    // HTML 实体编码
+    /%6a%61%76%61%73%63%72%69%70%74/i,
+    // URL 编码的 javascript
+    /\\u006a\\u0061\\u0076\\u0061/i
+    // Unicode 编码
+  ].some((s) => s.test(e) || s.test(t));
+}
+function c(t, e = {}) {
+  if (!t || typeof t != "string")
+    return !1;
+  const r = t.trim();
+  if (!r)
+    return !1;
+  if (r.startsWith("/") || r.startsWith("./") || r.startsWith("../"))
+    return e.allowRelative === !1 ? !1 : !n(r);
+  const s = l(r);
+  if (n(s))
+    return !1;
+  try {
+    const a = new URL(s, "http://example.com").protocol.toLowerCase();
+    return e.strictMode ? a === "http:" || a === "https:" : o.includes(a) ? !1 : [...i, ...e.extraSafeProtocols || []].includes(a);
+  } catch {
+    return !1;
+  }
+}
+function f(t, e = {}) {
+  const r = e.fallbackUrl || "#";
+  return c(t, e) ? t.trim() : r;
+}
+function m(t, e = {}) {
+  return t.map((r) => f(r, e));
+}
+export {
+  c as isUrlSafe,
+  f as sanitizeUrl,
+  m as sanitizeUrls
+};

package/dist/vendor/@borewit/text-codec/lib/index.js

@@ -0,0 +1,181 @@
+const g = {
+  128: "€",
+  130: "‚",
+  131: "ƒ",
+  132: "„",
+  133: "…",
+  134: "†",
+  135: "‡",
+  136: "ˆ",
+  137: "‰",
+  138: "Š",
+  139: "‹",
+  140: "Œ",
+  142: "Ž",
+  145: "‘",
+  146: "’",
+  147: "“",
+  148: "”",
+  149: "•",
+  150: "–",
+  151: "—",
+  152: "˜",
+  153: "™",
+  154: "š",
+  155: "›",
+  156: "œ",
+  158: "ž",
+  159: "Ÿ"
+};
+for (const [e, o] of Object.entries(g))
+  ;
+let a;
+function w() {
+  if (!(typeof globalThis.TextDecoder > "u"))
+    return a ?? (a = new globalThis.TextDecoder("utf-8"));
+}
+const d = 32 * 1024, r = 65533;
+function L(e, o = "utf-8") {
+  switch (o.toLowerCase()) {
+    case "utf-8":
+    case "utf8": {
+      const n = w();
+      return n ? n.decode(e) : T(e);
+    }
+    case "utf-16le":
+      return E(e);
+    case "us-ascii":
+    case "ascii":
+      return m(e);
+    case "latin1":
+    case "iso-8859-1":
+      return v(e);
+    case "windows-1252":
+      return D(e);
+    default:
+      throw new RangeError(`Encoding '${o}' not supported`);
+  }
+}
+function s(e, o) {
+  o.length !== 0 && (e.push(String.fromCharCode.apply(null, o)), o.length = 0);
+}
+function i(e, o, n) {
+  o.push(n), o.length >= d && s(e, o);
+}
+function j(e, o, n) {
+  if (n <= 65535) {
+    i(e, o, n);
+    return;
+  }
+  n -= 65536, i(e, o, 55296 + (n >> 10)), i(e, o, 56320 + (n & 1023));
+}
+function T(e) {
+  const o = [], n = [];
+  let t = 0;
+  for (e.length >= 3 && e[0] === 239 && e[1] === 187 && e[2] === 191 && (t = 3); t < e.length; ) {
+    const f = e[t];
+    if (f <= 127) {
+      i(o, n, f), t++;
+      continue;
+    }
+    if (f < 194 || f > 244) {
+      i(o, n, r), t++;
+      continue;
+    }
+    if (f <= 223) {
+      if (t + 1 >= e.length) {
+        i(o, n, r), t++;
+        continue;
+      }
+      const u = e[t + 1];
+      if ((u & 192) !== 128) {
+        i(o, n, r), t++;
+        continue;
+      }
+      const l = (f & 31) << 6 | u & 63;
+      i(o, n, l), t += 2;
+      continue;
+    }
+    if (f <= 239) {
+      if (t + 2 >= e.length) {
+        i(o, n, r), t++;
+        continue;
+      }
+      const u = e[t + 1], l = e[t + 2];
+      if (!((u & 192) === 128 && (l & 192) === 128 && !(f === 224 && u < 160) && // overlong
+      !(f === 237 && u >= 160))) {
+        i(o, n, r), t++;
+        continue;
+      }
+      const C = (f & 15) << 12 | (u & 63) << 6 | l & 63;
+      i(o, n, C), t += 3;
+      continue;
+    }
+    if (t + 3 >= e.length) {
+      i(o, n, r), t++;
+      continue;
+    }
+    const c = e[t + 1], x = e[t + 2], h = e[t + 3];
+    if (!((c & 192) === 128 && (x & 192) === 128 && (h & 192) === 128 && !(f === 240 && c < 144) && // overlong
+    !(f === 244 && c > 143))) {
+      i(o, n, r), t++;
+      continue;
+    }
+    const p = (f & 7) << 18 | (c & 63) << 12 | (x & 63) << 6 | h & 63;
+    j(o, n, p), t += 4;
+  }
+  return s(o, n), o.join("");
+}
+function E(e) {
+  const o = [], n = [], t = e.length;
+  let f = 0;
+  for (; f + 1 < t; ) {
+    const c = e[f] | e[f + 1] << 8;
+    if (f += 2, c >= 55296 && c <= 56319) {
+      if (f + 1 < t) {
+        const x = e[f] | e[f + 1] << 8;
+        x >= 56320 && x <= 57343 ? (i(o, n, c), i(o, n, x), f += 2) : i(o, n, r);
+      } else
+        i(o, n, r);
+      continue;
+    }
+    if (c >= 56320 && c <= 57343) {
+      i(o, n, r);
+      continue;
+    }
+    i(o, n, c);
+  }
+  return f < t && i(o, n, r), s(o, n), o.join("");
+}
+function m(e) {
+  const o = [];
+  for (let n = 0; n < e.length; n += d) {
+    const t = Math.min(e.length, n + d), f = new Array(t - n);
+    for (let c = n, x = 0; c < t; c++, x++)
+      f[x] = e[c] & 127;
+    o.push(String.fromCharCode.apply(null, f));
+  }
+  return o.join("");
+}
+function v(e) {
+  const o = [];
+  for (let n = 0; n < e.length; n += d) {
+    const t = Math.min(e.length, n + d), f = new Array(t - n);
+    for (let c = n, x = 0; c < t; c++, x++)
+      f[x] = e[c];
+    o.push(String.fromCharCode.apply(null, f));
+  }
+  return o.join("");
+}
+function D(e) {
+  const o = [];
+  let n = "";
+  for (let t = 0; t < e.length; t++) {
+    const f = e[t], c = f >= 128 && f <= 159 ? g[f] : void 0;
+    n += c ?? String.fromCharCode(f), n.length >= d && (o.push(n), n = "");
+  }
+  return n && o.push(n), o.join("");
+}
+export {
+  L as textDecode
+};