Merge branch 'dev' into dialog

Author: chenyme

VERSION

@@ -1 +1 @@
-0.3.0
+0.3.1

backend/cmd/server/main.go

@@ -9,7 +9,7 @@ import (
 )
 
 // @title DEEIX Chat API
-// @version 0.3.0
+// @version 0.3.1
 // @description DEEIX Chat 后端 API 文档
 // @BasePath /api/v1
 // @securityDefinitions.apikey BearerAuth

backend/docs/docs.go

@@ -17899,7 +17899,7 @@ const docTemplate = `{
 
 // SwaggerInfo holds exported Swagger Info so clients can modify it
 var SwaggerInfo = &swag.Spec{
-	Version:          "0.3.0",
+	Version:          "0.3.1",
 	Host:             "",
 	BasePath:         "/api/v1",
 	Schemes:          []string{},

backend/docs/swagger.json

@@ -4,7 +4,7 @@
         "description": "DEEIX Chat 后端 API 文档",
         "title": "DEEIX Chat API",
         "contact": {},
-        "version": "0.3.0"
+        "version": "0.3.1"
     },
     "basePath": "/api/v1",
     "paths": {
@@ -17888,4 +17888,4 @@
             "in": "header"
         }
     }
-}
+}

backend/docs/swagger.yaml

@@ -5148,7 +5148,7 @@ info:
   contact: {}
   description: DEEIX Chat 后端 API 文档
   title: DEEIX Chat API
-  version: 0.3.0
+  version: "0.3.1"
 paths:
   /admin/announcements:
     get:

backend/internal/application/auth/provider.go

@@ -598,13 +598,8 @@ func (s *Service) normalizeProviderInput(input UpsertIdentityProviderInput, curr
 		return nil, ErrIdentityProviderSuperAdminDefaultRoleNotAllowed
 	}
 	logoURL := strings.TrimSpace(input.LogoURL)
-	if logoURL != "" {
-		parsedLogoURL, err := url.Parse(logoURL)
-		isHTTPLogoURL := (parsedLogoURL.Scheme == "http" || parsedLogoURL.Scheme == "https") && parsedLogoURL.Host != ""
-		isAbsolutePathLogoURL := strings.HasPrefix(logoURL, "/")
-		if err != nil || (!isHTTPLogoURL && !isAbsolutePathLogoURL) {
-			return nil, fmt.Errorf("logo url must be a valid http(s) or absolute path")
-		}
+	if logoURL != "" && !isValidProviderLogoURL(logoURL) {
+		return nil, fmt.Errorf("logo url must be a valid http(s) or absolute path")
 	}
 	provider := &domainuser.IdentityProvider{
 		Type:                providerType,
@@ -660,6 +655,21 @@ func (s *Service) normalizeProviderInput(input UpsertIdentityProviderInput, curr
 	return provider, nil
 }
 
+func isValidProviderLogoURL(value string) bool {
+	parsedLogoURL, err := url.Parse(value)
+	if err != nil {
+		return false
+	}
+	if (parsedLogoURL.Scheme == "http" || parsedLogoURL.Scheme == "https") && parsedLogoURL.Host != "" {
+		return true
+	}
+	return parsedLogoURL.Scheme == "" &&
+		parsedLogoURL.Host == "" &&
+		strings.HasPrefix(value, "/") &&
+		!strings.HasPrefix(value, "//") &&
+		!strings.Contains(value, "\\")
+}
+
 func toProviderViews(items []domainuser.IdentityProvider, includeSensitive bool) []IdentityProviderView {
 	results := make([]IdentityProviderView, 0, len(items))
 	for _, item := range items {

backend/internal/application/auth/provider_test.go

@@ -90,6 +90,47 @@ func TestNormalizeProviderInputProtectsSuperAdminDefaultRole(t *testing.T) {
 	}
 }
 
+func TestNormalizeProviderInputValidatesLogoURL(t *testing.T) {
+	service := NewService(config.Config{JWTSecret: "test-secret"}, &providerLoginRepo{}, nil)
+
+	cases := []struct {
+		name    string
+		logoURL string
+		wantErr bool
+	}{
+		{name: "https url", logoURL: "https://example.com/logo.svg"},
+		{name: "http url", logoURL: "http://example.com/logo.svg"},
+		{name: "absolute path", logoURL: "/identity-providers/acme.svg"},
+		{name: "protocol relative url", logoURL: "//example.com/logo.svg", wantErr: true},
+		{name: "data url", logoURL: "data:image/svg+xml,<svg/>", wantErr: true},
+		{name: "javascript url", logoURL: "javascript:alert(1)", wantErr: true},
+		{name: "relative path", logoURL: "identity-providers/acme.svg", wantErr: true},
+		{name: "backslash path", logoURL: `/\example.svg`, wantErr: true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := service.normalizeProviderInput(UpsertIdentityProviderInput{
+				ActorRole:           domainuser.RoleAdmin,
+				Type:                domainuser.IdentityProviderTypeOIDC,
+				Name:                "Acme SSO",
+				LogoURL:             tc.logoURL,
+				ClientID:            "client",
+				ClientSecret:        "secret",
+				DiscoveryURL:        "https://example.com/.well-known/openid-configuration",
+				RegistrationEnabled: boolPtr(true),
+				DefaultRole:         domainuser.RoleUser,
+			}, nil)
+			if tc.wantErr && err == nil {
+				t.Fatalf("expected logo URL %q to be rejected", tc.logoURL)
+			}
+			if !tc.wantErr && err != nil {
+				t.Fatalf("expected logo URL %q to be accepted, got %v", tc.logoURL, err)
+			}
+		})
+	}
+}
+
 func TestResolveProviderUserAutoRegistrationAddsUsernameSuffixOnCollision(t *testing.T) {
 	repo := &providerLoginRepo{duplicateUsernameAttempts: 1}
 	service := NewService(config.Config{JWTSecret: "test-secret"}, repo, nil)

frontend/package.json

@@ -1,14 +1,14 @@
 {
   "name": "deeix-chat",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": true,
   "packageManager": "pnpm@10.17.0",
   "pnpm": {
     "overrides": {
       "@babel/core": "7.29.7",
       "brace-expansion@1": "1.1.15",
       "brace-expansion@5": "5.0.6",
-      "dompurify": "3.4.10",
+      "dompurify": "3.4.11",
       "flatted": "3.4.2",
       "js-yaml": "4.2.0",
       "mermaid": "11.15.0",

frontend/pnpm-lock.yaml

@@ -1,4 +1,4 @@
-const PWA_ASSET_VERSION = "0.3.0";
+const PWA_ASSET_VERSION = "0.3.1";
 const PWA_ASSET_CACHE_KEY = "632cb83037d9";
 const PWA_ASSET_MANIFEST = {
   "/pwa/icon.svg": "/pwa/generated/icon.fe1d64d9758c.svg",