bd91b015ee
fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme ( #5056 )
...
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
2026-07-28 13:40:13 +08:00
2350884eae
fix(mobile): handle RSSHub subscription limit errors
2026-07-26 07:29:14 +08:00
52f587dacb
fix(desktop): dismiss share popover after actions
2026-07-25 20:23:44 +08:00
3d65478fb6
fix(subscription): recover past-due Stripe checkout
2026-07-25 20:22:55 +08:00
22c8a667e6
fix(desktop): restore category chevron rotation
2026-07-25 20:18:50 +08:00
764c70b48c
fix(mobile): restore dark mode text colors
2026-07-25 18:20:36 +08:00
110960a6f0
fix(ssr): restore shared user profiles
2026-07-25 15:06:20 +08:00
cf224d63f5
fix(ssr): escape hydration data in inline scripts
2026-07-25 12:38:49 +08:00
192a7139ce
fix(desktop): use js-yaml ESM exports for Windows metadata
2026-07-13 13:03:42 +08:00
c3eb7285f9
Merge pull request #5044 from RSSNext/main
...
chore(sync): merge main into dev
2026-07-13 12:37:24 +08:00
d90cdfe2b3
fix(desktop): package jsdom runtime dependencies
2026-07-13 12:13:57 +08:00
713c53352d
fix(desktop): package jsdom runtime dependencies
2026-07-13 12:12:50 +08:00
c231c05ed9
Merge pull request #5043 from RSSNext/mobile-main
...
chore(sync): merge mobile-main into dev
2026-07-13 11:47:28 +08:00
57fd759f25
fix(desktop): use js-yaml ESM exports
2026-07-13 11:33:09 +08:00
d726ccccb2
fix(desktop): use js-yaml ESM exports
2026-07-13 11:32:42 +08:00
06135760ba
docs(mobile): restore desktop release inputs
2026-07-13 11:14:43 +08:00
7c4d51a642
release(mobile): release v0.5.6
2026-07-13 11:14:04 +08:00
c3fae852aa
docs(desktop): restore mobile release inputs
2026-07-13 11:13:00 +08:00
c77e60e161
release(desktop): release v1.11.0
2026-07-13 11:11:44 +08:00
ce905f8c5a
docs(mobile): prepare release metadata
2026-07-13 11:10:19 +08:00
5318b9e156
docs(desktop): prepare release inputs
2026-07-13 11:10:13 +08:00
212db8a584
fix(mobile): restore push notification registration
2026-07-12 19:43:36 +08:00
451e263db4
chore(sync): merge mobile-main into dev
2026-07-12 18:32:36 +08:00
c3e1c26194
fix(desktop): set referrerpolicy on youtube embed iframes ( #5039 )
2026-07-12 18:07:09 +08:00
cde24e2614
fix(mobile): declare Expo Babel preset
2026-07-11 09:45:08 +08:00
c144c36baa
fix(mobile): restore scrolled header background
2026-07-11 09:05:16 +08:00
87862b4b93
fix(mobile): prevent timeline view selector overflow
2026-07-11 09:04:44 +08:00
8ae78f747f
fix(mobile): restore signed-out launch login
2026-07-11 09:03:59 +08:00
1158281f59
chore(deps): update frontend dependencies ( #5038 )
...
* chore(deps): update frontend dependencies
* fix(ci): format OTA verification commands
2026-07-10 22:36:12 +08:00
e48a8f4f2e
fix(mobile): use folo callback for social auth
2026-07-03 17:41:58 +08:00
72e289bb3e
fix(tracker): sample PostHog events at five percent
2026-07-03 16:46:26 +08:00
c782efa65e
fix(landing): bundle legal markdown content
2026-06-22 20:57:58 +08:00
aa91b25bff
docs(mobile): restore desktop release inputs
2026-06-22 14:59:02 +08:00
5d6b5ed40f
release(mobile): release v0.5.5
2026-06-22 14:58:32 +08:00
195a2a71f4
docs(desktop): restore mobile release inputs
2026-06-22 14:57:45 +08:00
ddef59d1bc
release(desktop): release v1.10.0
2026-06-22 14:57:04 +08:00
8305a5caf4
docs(desktop): prepare release inputs
2026-06-22 14:48:43 +08:00
7cb35c4d7c
docs(mobile): prepare release metadata
2026-06-22 14:48:30 +08:00
43fb8f23a7
fix(desktop): avoid idle Spline AI indicator render
2026-06-22 11:38:31 +08:00
84f692ad35
fix(desktop): keep reading mode content when translated
...
Refs RSSNext/Folo#5023 .
2026-06-22 10:43:34 +08:00
4ab06f42b4
fix(desktop): stabilize streaming tts scheduling
2026-06-22 10:41:54 +08:00
c98f572cf8
fix: dedupe code blocks with nested line divs
...
fix: dedupe code blocks with nested line divs
2026-06-05 19:44:07 +08:00
73870a8170
fix(desktop): reset social timeline on view change
2026-06-05 11:42:37 +08:00
4e8cf33941
fix(mobile): preserve social timeline scroll reset
2026-06-05 10:26:09 +08:00
31c10ea635
fix(desktop): hide empty recent reader spacer
2026-06-02 10:38:16 +08:00
2ed4ac546b
fix(timeline): guard mark read during scroll reset
2026-06-02 10:04:30 +08:00
fe1fcff315
fix(timeline): scroll to top before refresh
2026-06-01 10:43:23 +08:00
0476396414
Merge remote-tracking branch 'origin/dev' into mobile-main
...
# Conflicts:
# apps/desktop/package.json
# apps/desktop/release.json
2026-05-29 15:57:13 +08:00
a1988abc0c
chore(mobile): keep release pr mobile-only
2026-05-29 15:35:59 +08:00
367c638ddd
release(mobile): release v0.5.4
2026-05-29 15:34:49 +08:00
Sebastion
DIYgod
Tony