FoXiMao/a-share-analysis
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(GOV-009): 封堵外部脚本边界绕过

Browse Source
This commit is contained in:
FoXiMao
2026-08-13 19:49:42 +08:00
parent cb550e3d5c
commit 95b8611bd9
5 changed files with 31 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/boundaries/verify-project-boundaries.test.mjs
+17 -11
View File
@@ -108,19 +108,25 @@ const value: Internal | undefined = undefined;
assert.match(result.stderr, /IllegalView\.vue/);
});
test('拒绝 Vue 外部 script src 绕过源码边界', async () => {
const repositoryRoot = await createFixture();
await writeFile(
path.join(repositoryRoot, 'web/src/ExternalScript.vue'),
`<script setup lang="ts" src="../../server/libs/internal.ts"></script>\n<template><main /></template>\n`,
);
for (const [name, scriptTag] of [
['双引号', '<script lang="ts" src="../../server/libs/internal.ts">'],
['单引号', "<script src='../../server/libs/internal.ts' lang='ts'>"],
['无引号且属性换序', '<script lang=ts src=../../server/libs/internal.ts>'],
]) {
test(`拒绝 Vue 外部 script src 通过${name}绕过源码边界`, async () => {
const repositoryRoot = await createFixture();
await writeFile(
path.join(repositoryRoot, 'web/src/ExternalScript.vue'),
`${scriptTag}</script>\n<template><main /></template>\n`,
);
const result = await runChecker(repositoryRoot);
const result = await runChecker(repositoryRoot);
assert.equal(result.exitCode, 1);
assert.match(result.stderr, /禁止使用外部 script src/);
assert.match(result.stderr, /ExternalScript\.vue/);
});
assert.equal(result.exitCode, 1);
assert.match(result.stderr, /禁止使用外部 script src/);
assert.match(result.stderr, /ExternalScript\.vue/);
});
}
test('接受只消费公开 OpenAPI 类型的 Web 工程', async () => {
const repositoryRoot = await createFixture();