xiaoxue_admin
/
Folo
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6,990 Commits 1 Branch 156 Tags 74 MiB
Commit Graph

6990 Commits

Author SHA1 Message Date
Sebastion bd91b015ee
fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056) 
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.

Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.

Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
 2026-07-28 13:40:13 +08:00
DIYgod 2350884eae fix(mobile): handle RSSHub subscription limit errors 2026-07-26 07:29:14 +08:00
DIYgod 52f587dacb fix(desktop): dismiss share popover after actions 2026-07-25 20:23:44 +08:00
DIYgod 3d65478fb6 fix(subscription): recover past-due Stripe checkout 2026-07-25 20:22:55 +08:00
DIYgod 22c8a667e6 fix(desktop): restore category chevron rotation 2026-07-25 20:18:50 +08:00
DIYgod 2034702df6 fix(styles): avoid DaisyUI border token collision 2026-07-25 20:17:55 +08:00
DIYgod 764c70b48c fix(mobile): restore dark mode text colors 2026-07-25 18:20:36 +08:00
DIYgod a9e2b1a818 fix: make Codex worktree setup portable 2026-07-25 15:31:42 +08:00
DIYgod 110960a6f0 fix(ssr): restore shared user profiles 2026-07-25 15:06:20 +08:00
DIYgod cf224d63f5 fix(ssr): escape hydration data in inline scripts 2026-07-25 12:38:49 +08:00
dependabot[bot] 773f1bfe21
build(deps): bump actions/setup-node from 6 to 7 (#5046) 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-15 09:00:49 +08:00
DIYgod 192a7139ce fix(desktop): use js-yaml ESM exports for Windows metadata 2026-07-13 13:03:42 +08:00
DIYgod c3eb7285f9
Merge pull request #5044 from RSSNext/main 
chore(sync): merge main into dev
 2026-07-13 12:37:24 +08:00
DIYgod d7365aebf4
Merge pull request #5041 from RSSNext/release/desktop/1.11.0 
release(desktop): Release v1.11.0
 2026-07-13 12:36:53 +08:00
DIYgod d90cdfe2b3 fix(desktop): package jsdom runtime dependencies 2026-07-13 12:13:57 +08:00
DIYgod 713c53352d fix(desktop): package jsdom runtime dependencies 2026-07-13 12:12:50 +08:00
DIYgod c231c05ed9
Merge pull request #5043 from RSSNext/mobile-main 
chore(sync): merge mobile-main into dev
 2026-07-13 11:47:28 +08:00
DIYgod 8f7471951d
Merge pull request #5042 from RSSNext/release/mobile/0.5.6 
release(mobile): Release v0.5.6
 2026-07-13 11:46:49 +08:00
DIYgod 57fd759f25 fix(desktop): use js-yaml ESM exports 2026-07-13 11:33:09 +08:00
DIYgod d726ccccb2 fix(desktop): use js-yaml ESM exports 2026-07-13 11:32:42 +08:00
DIYgod 06135760ba docs(mobile): restore desktop release inputs 2026-07-13 11:14:43 +08:00
DIYgod 7c4d51a642 release(mobile): release v0.5.6 2026-07-13 11:14:04 +08:00
DIYgod c3fae852aa docs(desktop): restore mobile release inputs 2026-07-13 11:13:00 +08:00
DIYgod c77e60e161 release(desktop): release v1.11.0 2026-07-13 11:11:44 +08:00
DIYgod ce905f8c5a docs(mobile): prepare release metadata 2026-07-13 11:10:19 +08:00
DIYgod 5318b9e156 docs(desktop): prepare release inputs 2026-07-13 11:10:13 +08:00
DIYgod 212db8a584 fix(mobile): restore push notification registration 2026-07-12 19:43:36 +08:00
DIYgod 451e263db4 chore(sync): merge mobile-main into dev 2026-07-12 18:32:36 +08:00
Tony c3e1c26194
fix(desktop): set referrerpolicy on youtube embed iframes (#5039) 2026-07-12 18:07:09 +08:00
DIYgod de935145da fix(ci): run iOS builds on macOS 26 2026-07-11 10:21:42 +08:00
DIYgod dd99acf8ef fix(ci): trigger iOS builds for toolchain changes 2026-07-11 10:16:55 +08:00
DIYgod 815536c93f fix(ci): use Xcode 26.4.1 for iOS builds 2026-07-11 10:15:31 +08:00
DIYgod f89260362b fix(ci): use Xcode 26.3 for iOS builds 2026-07-11 09:45:50 +08:00
DIYgod cde24e2614 fix(mobile): declare Expo Babel preset 2026-07-11 09:45:08 +08:00
DIYgod c144c36baa fix(mobile): restore scrolled header background 2026-07-11 09:05:16 +08:00
DIYgod 87862b4b93 fix(mobile): prevent timeline view selector overflow 2026-07-11 09:04:44 +08:00
DIYgod 8ae78f747f fix(mobile): restore signed-out launch login 2026-07-11 09:03:59 +08:00
DIYgod 1158281f59
chore(deps): update frontend dependencies (#5038) 
* chore(deps): update frontend dependencies

* fix(ci): format OTA verification commands
 2026-07-10 22:36:12 +08:00
DIYgod e48a8f4f2e fix(mobile): use folo callback for social auth 2026-07-03 17:41:58 +08:00
DIYgod dfcfb0ddff docs: remove status badge from readme 2026-07-03 16:49:39 +08:00
DIYgod 72e289bb3e fix(tracker): sample PostHog events at five percent 2026-07-03 16:46:26 +08:00
dependabot[bot] 54447e6faa
build(deps): bump actions/cache from 5 to 6 (#5034) 
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 09:20:14 +08:00
DIYgod c782efa65e fix(landing): bundle legal markdown content 2026-06-22 20:57:58 +08:00
DIYgod e4483e9052
release(mobile): Release v0.5.5 (#5030) 
* fix(release): extend OTA sync trigger timeout

* docs(release): clarify mobile OTA runtime selection

* fix(timeline): scroll to top before refresh

* fix(timeline): guard mark read during scroll reset

* fix(desktop): hide empty recent reader spacer

* fix(mobile): preserve social timeline scroll reset

* fix(desktop): reset social timeline on view change

* fix: dedupe code blocks with nested line divs

fix: dedupe code blocks with nested line divs

* build(deps): bump actions/checkout from 6 to 7 (#5025)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump expo/expo-github-action from 8 to 9 (#5019)

Bumps [expo/expo-github-action](https://github.com/expo/expo-github-action) from 8 to 9.
- [Release notes](https://github.com/expo/expo-github-action/releases)
- [Changelog](https://github.com/expo/expo-github-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/expo/expo-github-action/compare/v8...v9)

---
updated-dependencies:
- dependency-name: expo/expo-github-action
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(desktop): stabilize streaming tts scheduling

* fix(desktop): keep reading mode content when translated

Refs RSSNext/Folo#5023.

* fix(desktop): avoid idle Spline AI indicator render

* docs(mobile): prepare release metadata

* docs(desktop): prepare release inputs

* release(mobile): release v0.5.5

* docs(mobile): restore desktop release inputs

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Tony <TonyRL@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-22 15:07:05 +08:00
github-actions[bot] cbe4e06733
Merge pull request #5031 from RSSNext/main 
chore(sync): merge main into dev
 2026-06-22 07:06:40 +00:00
DIYgod 39857c6958
Merge pull request #5029 from RSSNext/release/desktop/1.10.0 
release(desktop): Release v1.10.0
 2026-06-22 15:01:31 +08:00
DIYgod aa91b25bff docs(mobile): restore desktop release inputs 2026-06-22 14:59:02 +08:00
DIYgod 5d6b5ed40f release(mobile): release v0.5.5 2026-06-22 14:58:32 +08:00
DIYgod 195a2a71f4 docs(desktop): restore mobile release inputs 2026-06-22 14:57:45 +08:00
DIYgod ddef59d1bc release(desktop): release v1.10.0 2026-06-22 14:57:04 +08:00