mirror of
https://github.com/lobehub/lobe-chat.git
synced 2026-06-14 03:30:19 +00:00
Arvin Xu
d81e5e703e
* ✨ feat(remote-device): add client renders for listOnlineDevices and activateDevice Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * 🐛 fix(utils): make SVG event-handler stripping engine-independent DOMPurify's FORBID_ATTR / SVG-profile allowlist path relies on the underlying DOM's attribute + namespace handling, which differs across engines (jsdom vs happy-dom) and DOMPurify versions — in some CI environments on* handlers on SVG-namespaced nodes slipped through. Add a scoped uponSanitizeAttribute hook to drop every on* attribute deterministically, and assert by security property instead of exact serialization to drop whitespace brittleness. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * 🐛 fix(remote-device): render activation failure content when no device state activateDevice returns success:false with explanatory content but no error and no state when the target is offline/unknown. The tool detail view only skips custom rendering when result.error is set, so the custom renderer's `return null` rendered a blank result. Fall back to the failure content so the user/model still sees the message. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * 🐛 fix(utils): deterministically scrub SVG on* handlers via post-pass The DOMPurify uponSanitizeAttribute hook still failed in CI: <script> is removed (tag filtering) but on* handlers survive, because the attribute-sanitization phase doesn't run for SVG-namespaced nodes in CI's DOM engine — so the hook never fires. Replace it with an explicit regex scrub on the serialized output, which strips every on* event-handler attribute independent of the DOM engine. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * 🔒 fix(utils): loop SVG on* scrub until stable to close recombination bypass A single-pass regex replace can leave a fresh handler behind when removing one splices the surrounding text back together (` on onclick="x"click="y"` → ` onclick="y"`) — the CodeQL js/incomplete-multi-character-sanitization case. Repeat the scrub until the string stops changing so no on*= token can survive. Adds a regression test for the recombination input. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
17 lines
338 B
JSON
17 lines
338 B
JSON
{
|
|
"name": "@lobechat/builtin-tool-remote-device",
|
|
"version": "1.0.0",
|
|
"private": true,
|
|
"exports": {
|
|
".": "./src/index.ts",
|
|
"./client": "./src/client/index.ts"
|
|
},
|
|
"main": "./src/index.ts",
|
|
"dependencies": {
|
|
"@lobechat/prompts": "workspace:*"
|
|
},
|
|
"devDependencies": {
|
|
"@lobechat/types": "workspace:*"
|
|
}
|
|
}
|