44 lines
1.2 KiB
Markdown
44 lines
1.2 KiB
Markdown
|
# 审计 — 移除 iframe 内置浏览器
|
|||
|
|
|
|||
|
|
**Changelog**: `docs/changelog/2026-06-11-remove-embedded-browser.md`
|
|||
|
|
|
|||
|
|
## 范围（文件清单）
|
|||
|
|
|
|||
|
|
| 文件 | 变更 |
|
|||
|
|
|------|------|
|
|||
|
|
| `frontend/src/components/GlobalBrowserPanel.vue` | 删除 |
|
|||
|
|
| `frontend/src/composables/useGlobalBrowser.ts` | 删除 |
|
|||
|
|
| `frontend/src/pages/BrowserPage.vue` | 删除 |
|
|||
|
|
| `server/api/browser.py` | 删除 |
|
|||
|
|
| `server/utils/browser_ui_state.py` | 删除 |
|
|||
|
|
| `tests/test_browser_ui_state.py` | 删除 |
|
|||
|
|
| `frontend/src/App.vue` | 移除 GlobalBrowserPanel、侧栏项 |
|
|||
|
|
| `frontend/src/router/index.ts` | 移除路由 |
|
|||
|
|
| `frontend/src/pages/ServersPage.vue` | 站点 → window.open |
|
|||
|
|
| `server/main.py` | 移除 router |
|
|||
|
|
|
|||
|
|
## Step 3 规则扫描
|
|||
|
|
|
|||
|
|
| H | 规则 | 结论 |
|
|||
|
|
|---|------|------|
|
|||
|
|
| H1 | 无 SSRF 新增 | PASS — 删除 iframe，站点按钮仅客户端 window.open |
|
|||
|
|
| H2 | 无静默吞错 | PASS — 无新增 |
|
|||
|
|
| H3 | 无密钥 | PASS |
|
|||
|
|
| H4 | CUD 审计 | N/A — 删除 API，无新 CUD |
|
|||
|
|
|
|||
|
|
## Closure
|
|||
|
|
|
|||
|
|
| H | 判定 | 依据 |
|
|||
|
|
|---|------|------|
|
|||
|
|
| H1–H4 | PASS | 纯删除 + 外链兜底 |
|
|||
|
|
|
|||
|
|
## DoD
|
|||
|
|
|
|||
|
|
- [x] type-check
|
|||
|
|
- [x] 删除 `/api/browser` 路由
|
|||
|
|
- [ ] 生产部署（待用户批准）
|
|||
|
|
|
|||
|
|
## 验证
|
|||
|
|
|
|||
|
|
侧栏无浏览器；站点按钮新标签打开公网 URL。
|