fix(deps): close the last high advisories, sanitize rich-text echo, env-scoped amap key - #15
Conversation
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (12)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe pull request strengthens dependency auditing, sanitizes rich-text output, adds configurable AMap credentials, documents fallback settings, and changes video asset URLs to explicit HTTPS URLs. ChangesSecurity and Runtime Updates
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Sequence Diagram(s)sequenceDiagram
participant Environment
participant UmiConfig
participant AutonaviMap
participant AMapLoader
Environment->>UmiConfig: Provide AMAP_KEY and AMAP_SECURITY_CODE
UmiConfig->>AutonaviMap: Inject compile-time values
AutonaviMap->>AutonaviMap: Set window._AMapSecurityConfig when configured
AutonaviMap->>AMapLoader: Load the JS API with mapKey
Merge Risk: ⚪ Minimal · up to The security and configuration changes have no remaining concrete merge-blocking risk in the supplied evidence. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 7 files. (5 skipped: 5 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Warning Some tools did not complete. Review the errors below. 🔧 ESLint
config/config.github.tsESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. config/config.tsESLint skipped: the matched ESLint configuration already failed (missing-dependency). package.jsonESLint skipped: the matched ESLint configuration already failed (missing-dependency).
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying umi-react-admin with
|
| Latest commit: |
32a5a4f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://d1168002.umi-react-admin.pages.dev |
| Branch Preview URL: | https://fix-deps-cleanup.umi-react-admin.pages.dev |
…nv-scoped amap key - overrides: less <4.9.1 (drops image-size, the only remaining high), hono refreshed to 4.13.5, yaml 2.x and @hono/node-server covered; audit now 0 high / 4 moderate / 3 low, all registered as accepted risks in THIRD-PARTY-NOTICES with per-item rationale - ci audit step leaves observation mode: blocks on --audit-level=high - dompurify declared as a direct dependency and wired into the rich-text echo; verified headless that onerror/javascript: injected into the editor are stripped from the rendered preview - the echo is the pattern downstream projects copy when they persist content - amap key and security code move to AMAP_KEY/AMAP_SECURITY_CODE env defines (window._AMapSecurityConfig set before the loader fetches); unset keeps the loader's shared public key, README documents applying for a dedicated key - lyrics.ts documents that xgplayer-music renders LRC lines via unescaped innerHTML: remote lyrics must be escaped upstream - xgplayer demo media URLs pinned to https (protocol-relative would downgrade on http origins); notices gains the AGPL @stagewise/toolbar entry (inert unless umi stagewise is enabled)
# Conflicts: # src/typings.d.ts
1 participant
背景
审计 2026-09-22 M-9 + M-7 + M-6 + M-8 + L-4。审查时官方源 audit 为 14 条（2 high 均为构建期 image-size），另有数项遗留 medium。
改动与结果
依赖治理（M-9）
less@<4.9.1 → 4.9.1（4.9.1 起改用 probe-image-size，一次消掉仅存 2 条 high）、hono 刷新至 4.13.5、yaml 2.x 与 @hono/node-server 补覆盖--prod --audit-level=high阻断@stagewise/toolbar（AGPL，umi 4.7 传递、未激活不分发无义务）备注：勿开启 umi stagewise 配置富文本回显消毒（M-7）
dompurify显式声明为直接依赖（此前仅 tinymce 传递依赖），回显前DOMPurify.sanitize<img onerror>与javascript:链接，回显区均被剥除（<img src="x"><a>link</a>），零执行——此回显是下游「存库再展示」最易复制的模式，消毒即存储型 XSS 防线高德 key 环境化（M-6）
AMAP_KEY/AMAP_SECURITY_CODE经 define 注入；window._AMapSecurityConfig在 loader 加载前设置；未配置保持组件库默认公共 key（注释与 README 说明申请路径与配额影响）其他
lyrics.ts文件头警告：xgplayer-music 的 Lyric 插件以零转义 innerHTML 渲染歌词，远程化 LRC 前必须逐行转义（M-8）https://（协议相对在 http 源会降级明文；ffmpeg 不可用，自制媒体降级为定协议方案，L-4）.env.example同步验证
pnpm check全绿；pnpm audit --prodhigh=0；主产线构建 + 浏览器消毒实测通过。Summary by CodeRabbit
New Features
Bug Fixes
Security