代码审计修复：安全加固、超时统一、请求取消保护、歌词同步等多项优化#1
Merged
Merged
Conversation
- 移除 package.json 和 vite.config.js 中的 UTF-8 BOM，解决 Vite 8 PostCSS JSON.parse 崩溃 - 更新 engines.node 为 ^20.19.0 || >=22.12.0 以满足 Vite 8/rolldown 要求 - 更新 .node-version 为 20.19 - 在 Linux 环境重新生成 package-lock.json，确保 rolldown Linux native binding 正确安装
- 修复：store.playerLrc 歌词数据从未写入 Footer，导致歌词显示完全失效 - 安全：社交链接添加 rel="noopener noreferrer" 防止窗口劫持 - 安全：移除未使用的 Color Thief CDN 引用，消除供应链攻击风险 - 优化：useWeather.js 统一 fetchWithTimeout 超时逻辑 - 优化：useHitokoto.js 添加 AbortController 请求取消保护 - 优化：api/music.js 添加响应类型检查与兜底 - 优化：移除 App.vue 中 font-preload-helper hack，改用标准 link preload - 优化：useTime.js 改用 dayjs locale 替代手工维护的星期数组 - 优化：提取问候逻辑为 composables/useGreeting.js，与组件解耦 - 优化：nginx.conf 添加 charset utf-8 配置 - 优化：MusicPlayer 添加 Enter 键无障碍支持 - 清理：移除 Teleport 中重复的 footer-lyric-bar（与 Footer.vue 冲突） - 清理：补全多处空 catch 块中的日志输出
- 修复：Background.vue handleError 中 API 回退路径缺少超时兜底 - 修复：MusicPlayer.vue parseLrc fetch 添加 AbortController 请求取消保护 - 修复：Footer.vue 移除 unsafe-url referrerPolicy，防止 URL 泄漏 - 优化：useWeather.js getLocationByFreeApi 统一使用 fetchWithTimeout - 优化：用 loadTimeout 引用替换裸 setTimeout，在 handleLoad/handleError/onBeforeUnmount 中正确清理 - 优化：Vore.top handler 添加 data.ip 作为 IP 字段回退 - 修复：添加缺失的 apple-touch-icon.png - 新增：.gitattributes 统一行尾风格（text=auto eol=lf）
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更摘要
三轮代码审计后的修复与优化，涵盖安全性、健壮性、代码一致性等多个维度。
安全加固
请求保护与超时统一
歌词同步修复
代码质量
工程化
测试