spark-store-project/spark-store
15
0
Fork 0
mirror of https://gitee.com/spark-store-project/spark-store synced 2026-09-20 21:50:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): PR 审查整改 - setWindowOpenHandler 域名白名单 / openWebsite 协议校验 / 批量云端安装并发控制

Browse Source 
- electron/main/index.ts: setWindowOpenHandler 增加 ALLOWED_EXTERNAL_HOSTS 域名后缀白名单，仅可信 https 域名可 shell.openExternal（阻断项2）
- AppDetailModal.vue: openWebsite 增加 http/https 协议校验 + noopener,noreferrer（改进项5）
- useAccountSync.ts: installCloudItems 改为分批(BATCH_SIZE=3) + Promise.allSettled 错误收集（改进项2）
- 审查误报/未改动项已贴代码实证：阻断1 v-html 已用 textContent 转义；改进3 resolveCloudInstallCandidate 已有降级匹配链；改进4 单窗口无 HMR 不重复注册；改进1 暂停/恢复主进程无 handler 维持 TODO
This commit is contained in:
xiyidaiwa
2026-08-13 22:38:26 +08:00
parent 72d107c9de
commit cdd94c650d
4 changed files with 47 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
debian/changelog
Vendored
+1 -1
View File
@@ -1,4 +1,4 @@
spark-store (5.2.1.5-test) UNRELEASED; urgency=medium
spark-store (5.2.1.6-test) UNRELEASED; urgency=medium
* Initial release. (Closes: #nnnn) <nnnn is the bug number of your ITP>