-
Notifications
You must be signed in to change notification settings - Fork 50
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
一月累积更新 #177
Merged
Merged
一月累积更新 #177
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
喂 @Stapxs - 我已經審查咗你嘅改動 - 以下係啲意見:
整體意見:
- 喺 linkView.ts 入面,應該喺跟隨重定向之前,加入 URL 驗證同淨化,以防止潛在嘅 SSRF 安全漏洞
- 停用動畫嘅代碼可以用 CSS 類別嚟優化,而唔係動態插入樣式標籤,呢個會更加高效
以下係我喺審查期間睇嘅嘢
- 🟢 一般問題:一切正常
- 🟡 安全性:發現咗 2 個問題
- 🟢 測試:一切正常
- 🟡 複雜度:發現咗 1 個問題
- 🟢 文檔:一切正常
幫我變得更有用!請喺每個意見度撳 👍 或 👎,我會用呢個反饋嚟改進你嘅審查。
Original comment in English
Hey @Stapxs - I've reviewed your changes - here's some feedback:
Overall Comments:
- Consider adding URL validation and sanitization in linkView.ts before following redirects to prevent potential SSRF vulnerabilities
- The animation disabling code could be optimized by using CSS classes instead of dynamically injecting style tags, which would be more performant
Here's what I looked at during the review
- 🟢 General issues: all looks good
- 🟡 Security: 2 issues found
- 🟢 Testing: all looks good
- 🟡 Complexity: 1 issue found
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
一月累积更新 - 第一部分
✨ 群收纳盒功能,现在你可以在群收纳盒中查看活跃的群消息了 <- #169
✨ at 和特别关心消息现在将显示为红色文本便于查看 <- #169
✨ 快速动画模式 💨 <- #169
✨ 本地高级链接解析,目前只支持 electron 端
✨ 好友信息面板完善 <- #160
🐛 修正移出群聊和撤回菜单显示判断异常 <- #169
🐛 +1 操作未拷贝对象导致渲染移动 <- #170
🐛 为 npx 快速启动组件限制访问路径防止非法访问 <- #176
💩 移除英文文档和英文多语言支持
💩 调整一个判断错误导致的统计功能损坏