fix(v0.15): 审查即修（b64 解码前尺寸防线/拖拽监听清理/列布局守卫/死代码清理）

Author: Aparencia

app/src-tauri/src/commands_note_images.rs

@@ -120,6 +120,11 @@ pub async fn import_note_image_b64(
     if state.db.get_note(note_id).map_err(|e| e.to_string())?.is_none() {
         return Err("笔记不存在".to_string());
     }
+    // 解码前尺寸防线：base64 膨胀率 4/3（+填充余量）——纯文本长度超上限直接拒绝，
+    // 防恶意/畸形超大输入先完整解码再检查的内存峰值（解码缓冲区翻倍）
+    if image_b64.len() as u64 > IMAGE_MAX_BYTES / 3 * 4 + 64 {
+        return Err(format!("图片数据超过大小上限（{} 字节）", IMAGE_MAX_BYTES));
+    }
     let bytes = BASE64
         .decode(image_b64.trim())
         .map_err(|_| "图片数据解码失败（非法 base64）".to_string())?;

app/src/components/ColumnBar.tsx

@@ -8,16 +8,14 @@ interface Props {
   icon: string;
   title: string;
   onClick: () => void;
-  /** 附加徽标（如收件箱计数）——窄条上不常显，仅 title 提示 */
-  badge?: string;
 }
 
-export default function ColumnBar({ icon, title, onClick, badge }: Props) {
+export default function ColumnBar({ icon, title, onClick }: Props) {
   return (
     <div
       data-testid="column-bar"
       onClick={onClick}
-      title={`${title}${badge ? `（${badge}）` : ""}`}
+      title={title}
       style={{
         width: 26,
         flexShrink: 0,

app/src/components/ColumnResizer.tsx

@@ -1,12 +1,13 @@
 /**
  * ColumnResizer — 列拖拽手柄（v0.15 全站自适应）。
  *
- * @ai-context: pointer 事件捕获（setPointerCapture → window move/up）——拖出窗口
- *              或丢失 mouseup 仍能结束；方向由调用方决定（side="right" 拖右边
- *              增宽/左边收窄；side="left" 反向——拖左手柄收窄列本身）。纯展示，
- *              增量化经 onResize 上抛（useColumnLayout.resizeBy 夹取 min/max）。
+ * @ai-context: pointer 事件捕获（setPointerCapture → 事件全量路由到元素本身，
+ *              拖出窗口仍持续；元素卸载即自动停止——无 window 监听残留，审查即修）。
+ *              方向由调用方决定（side="right" 拖右边增宽/左边收窄；side="left"
+ *              反向——拖左手柄收窄列本身）。纯展示，增量化经 onResize 上抛
+ *              （useColumnLayout.resizeBy 夹取 min/max）。
  */
-import { useState } from "react";
+import { useRef, useState } from "react";
 
 interface Props {
   /** 手柄所在边的对齐方向（决定拖拽增量的符号） */
@@ -18,28 +19,35 @@ interface Props {
 
 export default function ColumnResizer({ side = "right", onResize, onReset }: Props) {
   const [hover, setHover] = useState(false);
+  const [dragging, setDragging] = useState(false);
+  const startXRef = useRef(0);
 
   const onPointerDown = (e: React.PointerEvent<HTMLDivElement>) => {
     e.preventDefault();
-    const startX = e.clientX;
-    const el = e.currentTarget;
-    try { el.setPointerCapture(e.pointerId); } catch { /* 旧 WebView 无捕获——move 仍走 window */ }
-    const move = (ev: PointerEvent) => {
-      const dx = ev.clientX - startX;
-      onResize(side === "right" ? dx : -dx);
-    };
-    const up = () => {
-      window.removeEventListener("pointermove", move);
-      window.removeEventListener("pointerup", up);
-    };
-    window.addEventListener("pointermove", move);
-    window.addEventListener("pointerup", up);
+    startXRef.current = e.clientX;
+    try { e.currentTarget.setPointerCapture(e.pointerId); } catch { /* 旧 WebView 无捕获——move 仍走元素事件 */ }
+    setDragging(true);
+  };
+
+  const onPointerMove = (e: React.PointerEvent<HTMLDivElement>) => {
+    if (!dragging) return;
+    const dx = e.clientX - startXRef.current;
+    onResize(side === "right" ? dx : -dx);
+  };
+
+  const endDrag = (e: React.PointerEvent<HTMLDivElement>) => {
+    if (!dragging) return;
+    try { e.currentTarget.releasePointerCapture(e.pointerId); } catch { /* 未捕获则忽略 */ }
+    setDragging(false);
   };
 
   return (
     <div
       data-testid="column-resizer"
       onPointerDown={onPointerDown}
+      onPointerMove={onPointerMove}
+      onPointerUp={endDrag}
+      onPointerCancel={endDrag}
       onPointerEnter={() => setHover(true)}
       onPointerLeave={() => setHover(false)}
       onDoubleClick={() => onReset?.()}
@@ -48,10 +56,11 @@ export default function ColumnResizer({ side = "right", onResize, onReset }: Pro
         width: 5,
         flexShrink: 0,
         cursor: "col-resize",
-        background: hover ? "#0d9488" : "transparent",
+        background: hover || dragging ? "#0d9488" : "transparent",
         borderLeft: "1px solid #e5e7eb",
         transition: "background 0.15s",
         userSelect: "none",
+        touchAction: "none",
       }}
     />
   );

app/src/hooks/useColumnLayout.ts

@@ -26,19 +26,19 @@ export interface ColumnLayout {
   folded: boolean;
   /** 用户手动折叠态（自动折叠兜底下的用户意图保留） */
   manuallyFolded: boolean;
-  setWidth: (w: number) => void;
   /** 拖拽手柄增量化（负数=收窄——列方向感知由调用方处理） */
   resizeBy: (delta: number) => void;
   resetWidth: () => void;
   setManualFolded: (v: boolean) => void;
-  toggleFold: () => void;
   /** 立即展开（同时清自动/手动折叠态——窄窗下点击窄条仍可展开，resize 后按阈值重折） */
   expand: () => void;
 }
 
 const clamp = (w: number, min: number, max: number) => Math.max(min, Math.min(max, Math.round(w)));
 
 function readNumber(key: string, fallback: number): number {
+  // window 守卫（GroupSidebar 同款模式）——非浏览器环境（SSR/未来测试宿主）零崩溃
+  if (typeof window === "undefined") return fallback;
   try {
     const v = window.localStorage.getItem(`layout:col-width:${key}`);
     return v != null ? Number(v) : fallback;
@@ -48,6 +48,7 @@ function readNumber(key: string, fallback: number): number {
 }
 
 function readBool(key: string, fallback: boolean): boolean {
+  if (typeof window === "undefined") return fallback;
   try {
     const v = window.localStorage.getItem(`layout:col-fold:${key}`);
     return v != null ? v === "1" : fallback;
@@ -57,6 +58,7 @@ function readBool(key: string, fallback: boolean): boolean {
 }
 
 function writeLayout(key: string, value: string) {
+  if (typeof window === "undefined") return;
   try {
     window.localStorage.setItem(key, value);
   } catch {
@@ -85,12 +87,10 @@ export function useColumnLayout(key: string, opts: Options): ColumnLayout {
   useEffect(() => { writeLayout(`layout:col-width:${key}`, String(width)); }, [key, width]);
   useEffect(() => { writeLayout(`layout:col-fold:${key}`, manualFolded ? "1" : "0"); }, [key, manualFolded]);
 
-  const setWidth = useCallback((w: number) => setWidthState(clamp(w, opts.min, opts.max)), [opts.min, opts.max]);
   const resizeBy = useCallback((delta: number) => {
     setWidthState((cur) => clamp(cur + delta, opts.min, opts.max));
   }, [opts.min, opts.max]);
   const resetWidth = useCallback(() => setWidthState(opts.default), [opts.default]);
-  const toggleFold = useCallback(() => setManualFolded((v) => !v), []);
   const expand = useCallback(() => {
     setAutoFolded(false);
     setManualFolded(false);
@@ -100,11 +100,9 @@ export function useColumnLayout(key: string, opts: Options): ColumnLayout {
     width,
     folded: autoFolded || manualFolded,
     manuallyFolded: manualFolded,
-    setWidth,
     resizeBy,
     resetWidth,
     setManualFolded,
-    toggleFold,
     expand,
-  }), [width, autoFolded, manualFolded, setWidth, resizeBy, resetWidth, toggleFold, expand]);
+  }), [width, autoFolded, manualFolded, resizeBy, resetWidth, expand]);
 }