SkyJourney
58087d0c7e
新增共享 Preview Engine，统一 Web 连续预览、快速分页、Playwright PDF 与 Electron PDF；实现稳定前缀复用和修改位置后的增量分页，保留媒体块按文档顺序串行回填与单次重排。 完善跨端链接与桌面文档工作流：Web 受控处理锚点和 HTTP/HTTPS 外链；Desktop 支持本地路径、file URI、系统协议、多窗口、同文件单例、Markdown 当前或新窗口打开，以及聚焦时外部文件变化提示。 统一四套内置主题名称并默认使用 Typora Github；修复连续预览双滚动条、ECharts 尺寸、PDF 本地链接、围栏代码块 Typora DOM 与重复行内样式；桌面发行链强制完整重建内嵌 Web，避免安装包携带陈旧资源。 发布 Web/Compose 与 Windows NSIS/ZIP：镜像 yixiong/md-to-pdf:v0.5.0 已健康部署；NSIS SHA-256 为 60992D1FDCA513F46346C78478537EB4159D8C0E76B41ECF3CDC25BE77707D92，ZIP SHA-256 为 D74F82293FB67126E583546CBA894569EFC9A0B1B6343FAC648CCC95F1D188D8，本机安装版已升级至 v0.5.0。 验证：全项目 238 项测试通过，类型检查、生产构建和 git diff --check 通过；Web 快速/连续/精确预览、Compose、Desktop 多窗口、窗口状态、文件关联、链接与代码块均完成真实环境验收。
104 lines
3.3 KiB
TypeScript
104 lines
3.3 KiB
TypeScript
import { mkdtemp, rm, writeFile } from "node:fs/promises";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { pathToFileURL } from "node:url";
|
|
import { describe, expect, it, vi } from "vitest";
|
|
import {
|
|
createImageResourceResolver,
|
|
downloadRemoteImage,
|
|
normalizeDocumentAssetPath
|
|
} from "../src/index.js";
|
|
|
|
const png = Buffer.from([
|
|
0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a
|
|
]);
|
|
|
|
describe("Markdown 图片资源安全", () => {
|
|
it("解码合法相对路径并拒绝越界与绝对路径", () => {
|
|
expect(
|
|
normalizeDocumentAssetPath(
|
|
"./%E6%96%87%E6%A1%A3.assets/a%20b.png?raw=1"
|
|
)
|
|
).toBe("文档.assets/a b.png");
|
|
expect(() => normalizeDocumentAssetPath("../secret.png")).toThrow(
|
|
"越过文档目录"
|
|
);
|
|
expect(() => normalizeDocumentAssetPath("C:/secret.png")).toThrow(
|
|
"绝对图片路径"
|
|
);
|
|
});
|
|
|
|
it("在发起请求前拒绝直接指向本机的远程地址", async () => {
|
|
const fetcher = vi.fn<typeof fetch>();
|
|
await expect(
|
|
downloadRemoteImage("http://127.0.0.1/private.png", fetcher)
|
|
).rejects.toThrow("非公网 IP");
|
|
expect(fetcher).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("缓存成功的远程图片并把失败转换为可诊断占位", async () => {
|
|
const remoteLoader = vi
|
|
.fn()
|
|
.mockResolvedValueOnce({
|
|
content: png,
|
|
contentType: "image/png"
|
|
})
|
|
.mockRejectedValueOnce(new Error("网络不可用"));
|
|
const resolve = createImageResourceResolver({ remoteLoader });
|
|
const first = await resolve(
|
|
"\n",
|
|
undefined
|
|
);
|
|
const failed = await resolve(
|
|
"",
|
|
undefined
|
|
);
|
|
|
|
expect(remoteLoader).toHaveBeenCalledTimes(2);
|
|
expect(first.sources.get("https://example.com/a.png")).toMatch(
|
|
/^data:image\/png;base64,/u
|
|
);
|
|
expect(failed.sources.get("https://example.com/b.png")).toMatch(
|
|
/^data:image\/svg\+xml;base64,/u
|
|
);
|
|
expect(failed.warnings[0]).toContain("网络不可用");
|
|
});
|
|
|
|
it("仅在显式授权时允许桌面读取上级、绝对及 file URI 图片", async () => {
|
|
const directory = await mkdtemp(
|
|
path.join(os.tmpdir(), "md-to-pdf-local-images-")
|
|
);
|
|
const documentRoot = path.join(directory, "docs");
|
|
const imagePath = path.join(directory, "共享图片.png");
|
|
try {
|
|
await writeFile(imagePath, png);
|
|
const resolve = createImageResourceResolver();
|
|
const sources = [
|
|
"../共享图片.png",
|
|
imagePath,
|
|
pathToFileURL(imagePath).href
|
|
];
|
|
const markdown = sources
|
|
.map((source) => `})`)
|
|
.join("\n");
|
|
|
|
const restricted = await resolve(markdown, undefined, {
|
|
localRoot: documentRoot
|
|
});
|
|
expect(restricted.warnings).toHaveLength(3);
|
|
|
|
const unrestricted = await resolve(markdown, undefined, {
|
|
localRoot: documentRoot,
|
|
allowUnrestrictedLocalFiles: true
|
|
});
|
|
expect(unrestricted.warnings).toEqual([]);
|
|
expect(unrestricted.sources).toHaveLength(3);
|
|
for (const dataUrl of unrestricted.sources.values()) {
|
|
expect(dataUrl).toMatch(/^data:image\/png;base64,/u);
|
|
}
|
|
} finally {
|
|
await rm(directory, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|