taro-uno-ui 0.9.0-beta

package/src/utils/index.ts

@@ -0,0 +1,115 @@
+/**
+ * 工具函数库统一导出文件
+ * 提供所有工具函数的统一访问入口
+ */
+
+// ==================== 导入已存在的工具函数 ====================
+
+// 导入安全工具函数
+import * as xssProtection from './security/xss-protection';
+import * as apiSecurity from './security/api-security';
+import { httpClient as defaultHttpClient } from './network/http-client';
+
+// 导入类型工具函数
+import {
+  deepEqual,
+} from './typeHelpers';
+
+
+// ==================== 创建命名空间和工具类 ====================
+
+/** 平台检测工具类 */
+export class PlatformDetector {
+  private static cache: Map<string, unknown> = new Map();
+
+  static is(platform: string): boolean {
+    return process.env['TARO_ENV'] === platform;
+  }
+
+  static isMiniProgram(): boolean {
+    return this.is('weapp') || this.is('alipay') || this.is('swan') || this.is('tt') || this.is('qq') || this.is('jd');
+  }
+
+  static isH5(): boolean {
+    return this.is('h5');
+  }
+
+  static isRN(): boolean {
+    return this.is('rn');
+  }
+
+  static getPlatform(): string {
+    return process.env['TARO_ENV'] || 'unknown';
+  }
+
+  static isMobile(): boolean {
+    return this.isMiniProgram() || this.isH5() && window.innerWidth < 768;
+  }
+
+  static getPlatformInfo(): { platform: string; isMiniProgram: boolean; isH5: boolean; isRN: boolean; env: string } {
+    const platform = this.getPlatform();
+    if (this.cache.has(platform)) {
+      return this.cache.get(platform) as {
+        platform: string;
+        isMiniProgram: boolean;
+        isH5: boolean;
+        isRN: boolean;
+        env: string;
+      };
+    }
+
+    const info = {
+      platform,
+      isMiniProgram: this.isMiniProgram(),
+      isH5: this.isH5(),
+      isRN: this.isRN(),
+      env: process.env['NODE_ENV'] || 'development'
+    };
+
+    this.cache.set(platform, info);
+    return info;
+  }
+
+  static clearCache(): void {
+    this.cache.clear();
+  }
+}
+
+// 类名工具函数
+export const cn = (...classes: Array<string | undefined | null | false>): string => {
+  return classes.filter(Boolean).join(' ');
+};
+
+// 便捷访问实例
+export { PlatformDetector as platform };
+
+// ==================== 通用工具函数 ====================
+
+/** 通用工具函数 */
+export const utils = {
+  // 安全工具
+  security: {
+    ...xssProtection,
+    api: apiSecurity,
+  },
+  network: {
+    httpClient: defaultHttpClient,
+  },
+
+  // 平台工具
+  platform: PlatformDetector,
+
+  // 类型工具
+  types: {
+    deepEqual,
+  },
+
+  // 工具函数快捷访问
+  cn,
+};
+
+// ==================== 默认导出 ====================
+
+export default utils;
+
+// platform已通过export { PlatformDetector as platform }导出

package/src/utils/inputValidator.ts

@@ -0,0 +1,261 @@
+/**
+ * 输入验证工具
+ * 提供常见的输入验证功能，防止安全漏洞
+ */
+
+interface ValidationResult {
+  isValid: boolean;
+  errors: string[];
+  sanitized?: string | Record<string, any> | undefined;
+}
+
+interface ValidationRule {
+  required?: boolean;
+  minLength?: number;
+  maxLength?: number;
+  pattern?: RegExp;
+  custom?: (value: string) => boolean;
+  sanitize?: boolean;
+}
+
+class InputValidator {
+  /**
+   * 验证字符串输入
+   * @param value 输入值
+   * @param rules 验证规则
+   * @returns 验证结果
+   */
+  validateString(value: string, rules: ValidationRule): ValidationResult {
+    const errors: string[] = [];
+    let sanitized = value;
+
+    // 检查必填
+    if (rules.required && (!value || value.trim() === '')) {
+      errors.push('此字段为必填项');
+    }
+
+    // 如果没有值且不是必填，直接返回有效
+    if (!value && !rules.required) {
+      return { isValid: true, errors: [] };
+    }
+
+    // 检查最小长度
+    if (rules.minLength && value.length < rules.minLength) {
+      errors.push(`长度不能少于 ${rules.minLength} 个字符`);
+    }
+
+    // 检查最大长度
+    if (rules.maxLength && value.length > rules.maxLength) {
+      errors.push(`长度不能超过 ${rules.maxLength} 个字符`);
+    }
+
+    // 检查正则表达式
+    if (rules.pattern && !rules.pattern.test(value)) {
+      errors.push('格式不正确');
+    }
+
+    // 自定义验证
+    if (rules.custom && !rules.custom(value)) {
+      errors.push('自定义验证失败');
+    }
+
+    // 清理输入
+    if (rules.sanitize) {
+      sanitized = this.sanitizeString(value);
+    }
+
+    return {
+      isValid: errors.length === 0,
+      errors,
+      sanitized
+    };
+  }
+
+  /**
+   * 验证邮箱地址
+   * @param email 邮箱地址
+   * @returns 验证结果
+   */
+  validateEmail(email: string): ValidationResult {
+    const emailPattern = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+    return this.validateString(email, {
+      required: true,
+      pattern: emailPattern,
+      sanitize: true
+    });
+  }
+
+  /**
+   * 验证手机号码
+   * @param phone 手机号码
+   * @param countryCode 国家代码 (默认 'CN')
+   * @returns 验证结果
+   */
+  validatePhone(phone: string, countryCode: 'CN' | 'US' | 'GB' | 'JP' | 'KR' = 'CN'): ValidationResult {
+    let phonePattern: RegExp;
+    switch (countryCode) {
+      case 'CN':
+        phonePattern = /^1[3-9]\d{9}$/; // 中国大陆手机号
+        break;
+      case 'US':
+        phonePattern = /^\+?1[2-9]\d{2}[2-9](?!11)\d{6}$/; // 美国手机号
+        break;
+      case 'GB':
+        phonePattern = /^\+?44[7-9]\d{9}$/; // 英国手机号
+        break;
+      case 'JP':
+        phonePattern = /^\+?81[0-9]{10}$/; // 日本手机号
+        break;
+      case 'KR':
+        phonePattern = /^\+?82[1-9]\d{7,8}$/; // 韩国手机号
+        break;
+      default:
+        phonePattern = /^1[3-9]\d{9}$/; // 默认中国
+    }
+    return this.validateString(phone, {
+      required: true,
+      pattern: phonePattern,
+      sanitize: true
+    });
+  }
+
+  /**
+   * 验证URL
+   * @param url URL地址
+   * @returns 验证结果
+   */
+  validateURL(url: string): ValidationResult {
+    try {
+      // 尝试创建URL对象
+      new URL(url);
+
+      // 验证协议
+      const allowedProtocols = ['http:', 'https:'];
+      const urlObj = new URL(url);
+
+      if (!allowedProtocols.includes(urlObj.protocol)) {
+        return {
+          isValid: false,
+          errors: ['只支持 http 和 https 协议']
+        };
+      }
+
+      return {
+        isValid: true,
+        errors: [],
+        sanitized: url
+      };
+    } catch (e) {
+      return {
+        isValid: false,
+        errors: ['无效的URL地址']
+      };
+    }
+  }
+
+  /**
+   * 验证数字
+   * @param value 输入值
+   * @param min 最小值
+   * @param max 最大值
+   * @returns 验证结果
+   */
+  validateNumber(value: string, min?: number, max?: number): ValidationResult {
+    const errors: string[] = [];
+    const num = parseFloat(value);
+
+    if (isNaN(num)) {
+      errors.push('请输入有效的数字');
+      return { isValid: false, errors };
+    }
+
+    if (min !== undefined && num < min) {
+      errors.push(`不能小于 ${min}`);
+    }
+
+    if (max !== undefined && num > max) {
+      errors.push(`不能大于 ${max}`);
+    }
+
+    return {
+      isValid: errors.length === 0,
+      errors
+    };
+  }
+
+  /**
+   * 清理字符串输入
+   * @param value 输入值
+   * @returns 清理后的值
+   */
+  private sanitizeString(value: string): string {
+    // 移除首尾空格
+    let sanitized = value.trim();
+
+    // 移除控制字符
+    sanitized = sanitized.replace(/[\x00-\x1F\x7F]/g, '');
+
+    // 替换多个连续空格为单个空格
+    sanitized = sanitized.replace(/\s+/g, ' ');
+
+    return sanitized;
+  }
+
+  /**
+   * 验证对象的所有属性
+   * @param obj 输入对象
+   * @param rules 验证规则映射
+   * @returns 验证结果
+   */
+  validateObject(obj: Record<string, any>, rules: Record<string, ValidationRule>): ValidationResult {
+    const errors: string[] = [];
+    const sanitized: Record<string, any> = {};
+
+    for (const key in rules) {
+      if (rules.hasOwnProperty(key)) {
+        const value = obj[key];
+        const rule = rules[key];
+
+        if (typeof value === 'string') {
+          const result = this.validateString(value, rule || {});
+          if (!result.isValid) {
+            errors.push(...result.errors.map(err => `${key}: ${err}`));
+          }
+          if (result.sanitized !== undefined) {
+            sanitized[key] = result.sanitized;
+          } else {
+            sanitized[key] = value;
+          }
+        } else if (typeof value === 'number') {
+          const strValue = String(value);
+          const result = this.validateNumber(strValue, rule?.minLength, rule?.maxLength);
+          if (!result.isValid) {
+            errors.push(...result.errors.map(err => `${key}: ${err}`));
+          }
+          sanitized[key] = value;
+        } else {
+          sanitized[key] = value;
+        }
+      }
+    }
+
+    return {
+      isValid: errors.length === 0,
+      errors,
+      sanitized: Object.keys(sanitized).length > 0 ? sanitized : undefined
+    };
+  }
+}
+
+// 创建单例实例
+const inputValidator = new InputValidator();
+
+// 导出便捷方法
+export const validateString = (value: string, rules: ValidationRule) => inputValidator.validateString(value, rules);
+export const validateEmail = (email: string) => inputValidator.validateEmail(email);
+export const validatePhone = (phone: string, countryCode: 'CN' | 'US' | 'GB' | 'JP' | 'KR' = 'CN') => inputValidator.validatePhone(phone, countryCode);
+export const validateURL = (url: string) => inputValidator.validateURL(url);
+export const validateNumber = (value: string, min?: number, max?: number) => inputValidator.validateNumber(value, min, max);
+export const validateObject = (obj: Record<string, any>, rules: Record<string, ValidationRule>) => inputValidator.validateObject(obj, rules);
+
+export default inputValidator;

package/src/utils/network/http-client.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it, vi } from 'vitest';
+import { HttpClient } from './http-client';
+
+describe('HttpClient', () => {
+  it('builds GET request and parses json', async () => {
+    const client = new HttpClient({ baseUrl: 'https://example.com' });
+    const mock = vi.spyOn(global, 'fetch' as any).mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: new Headers({ 'content-type': 'application/json' }),
+      json: async () => ({ ok: true }),
+      text: async () => ''
+    } as any);
+    const res = await client.get('/api/test', { params: { q: 'x' } });
+    expect(res).toEqual({ ok: true });
+    mock.mockRestore();
+  });
+});

package/src/utils/network/http-client.ts

@@ -0,0 +1,151 @@
+import { createApiInterceptor, buildSecureHeaders, isSecureUrl, secureRetry } from '@/utils/security/api-security';
+import { ErrorHandlingManager } from '@/utils/error-handler';
+
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+
+export interface RequestOptions {
+  method?: HttpMethod;
+  headers?: Record<string, string>;
+  params?: Record<string, any>;
+  data?: any;
+  timeout?: number;
+  retries?: number;
+  retryDelay?: number;
+  baseUrl?: string;
+}
+
+export interface HttpClientConfig {
+  baseUrl?: string;
+  headers?: Record<string, string>;
+}
+
+interface RequestConfig {
+  method: HttpMethod;
+  url: string;
+  headers: Record<string, string>;
+  data?: any;
+}
+
+interface ResponseData {
+  status: number;
+  ok: boolean;
+  headers: Headers;
+  data: any;
+}
+
+type RequestInterceptor = (config: RequestConfig) => RequestConfig;
+type ResponseInterceptor = (response: ResponseData) => ResponseData;
+
+export class HttpClient {
+  private baseUrl: string;
+  private defaultHeaders: Record<string, string>;
+  private errorManager = ErrorHandlingManager.getInstance();
+  private security = createApiInterceptor();
+  private requestInterceptors: RequestInterceptor[] = [];
+  private responseInterceptors: ResponseInterceptor[] = [];
+
+  constructor(config: HttpClientConfig = {}) {
+    this.baseUrl = config.baseUrl || '';
+    this.defaultHeaders = config.headers || {};
+  }
+
+  addRequestInterceptor(interceptor: RequestInterceptor) {
+    this.requestInterceptors.push(interceptor);
+  }
+
+  addResponseInterceptor(interceptor: ResponseInterceptor) {
+    this.responseInterceptors.push(interceptor);
+  }
+
+  async request<T>(url: string, options: RequestOptions = {}): Promise<T> {
+    const method = (options.method || 'GET').toUpperCase() as HttpMethod;
+    const base = options.baseUrl ?? this.baseUrl;
+    const fullUrl = this.buildUrl(base, url, options.params);
+    if (!isSecureUrl(fullUrl)) {
+      throw this.errorManager.createAuthorizationError('insecure_url');
+    }
+
+    const headers = {
+      ...this.defaultHeaders,
+      ...(options.headers || {}),
+      ...buildSecureHeaders(method, fullUrl, options.data)
+    };
+
+    let config: RequestConfig = { method, url: fullUrl, headers, data: options.data };
+    config = this.security.request.execute(config);
+    for (const it of this.requestInterceptors) config = it(config);
+
+    const doFetch = async () => {
+      const controller = new AbortController();
+      const timeout = options.timeout ?? 15000;
+      const timer = setTimeout(() => controller.abort(), timeout);
+      try {
+        const resp = await fetch(config.url, {
+          method: config.method,
+          headers: config.headers,
+          body: config.method === 'GET' ? null : JSON.stringify(config.data ?? {}),
+          signal: controller.signal
+        });
+        const wrapped = { status: resp.status, ok: resp.ok, headers: resp.headers, data: await this.parseBody(resp) };
+        let processed = this.security.response.execute(wrapped);
+        for (const it of this.responseInterceptors) processed = it(processed);
+        if (!resp.ok) {
+          const err = new Error(`HTTP ${resp.status}`);
+          this.errorManager.handleError(err);
+          throw err;
+        }
+        return processed.data as T;
+      } finally {
+        clearTimeout(timer);
+      }
+    };
+
+    const retries = options.retries ?? (method === 'GET' ? 3 : 0);
+    const retryDelay = options.retryDelay ?? 500;
+    return await secureRetry(doFetch, retries, retryDelay);
+  }
+
+  get<T>(url: string, options: Omit<RequestOptions, 'method' | 'data'> = {}): Promise<T> {
+    return this.request<T>(url, { ...options, method: 'GET' });
+  }
+
+  post<T>(url: string, data?: any, options: Omit<RequestOptions, 'method' | 'data'> = {}): Promise<T> {
+    return this.request<T>(url, { ...options, method: 'POST', data });
+  }
+
+  put<T>(url: string, data?: any, options: Omit<RequestOptions, 'method' | 'data'> = {}): Promise<T> {
+    return this.request<T>(url, { ...options, method: 'PUT', data });
+  }
+
+  patch<T>(url: string, data?: any, options: Omit<RequestOptions, 'method' | 'data'> = {}): Promise<T> {
+    return this.request<T>(url, { ...options, method: 'PATCH', data });
+  }
+
+  delete<T>(url: string, options: Omit<RequestOptions, 'method' | 'data'> = {}): Promise<T> {
+    return this.request<T>(url, { ...options, method: 'DELETE' });
+  }
+
+  private buildUrl(base: string, url: string, params?: Record<string, any>): string {
+    const root = base ? base.replace(/\/$/, '') : '';
+    const path = url.startsWith('http') ? url : `${root}${url.startsWith('/') ? url : `/${url}`}`;
+    if (!params || Object.keys(params).length === 0) return path;
+    const usp = new URLSearchParams();
+    Object.entries(params).forEach(([k, v]) => {
+      if (v === undefined || v === null) return;
+      if (Array.isArray(v)) v.forEach(x => usp.append(k, String(x)));
+      else usp.append(k, String(v));
+    });
+    const sep = path.includes('?') ? '&' : '?';
+    return `${path}${sep}${usp.toString()}`;
+  }
+
+  private async parseBody(resp: Response): Promise<any> {
+    const ct = resp.headers.get('content-type') || '';
+    if (ct.includes('application/json')) return resp.json();
+    const text = await resp.text();
+    try { return JSON.parse(text); } catch { return text; }
+  }
+}
+
+export const httpClient = new HttpClient();
+export default HttpClient;