Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| let j = i + 1; | ||
| while (j < lines.length && /^\s+-\s+/.test(lines[j])) { | ||
| arrayItems.push(lines[j].replace(/^\s+-\s+/, "").trim()); | ||
| let nextLine = lines[j]; |
| while (typeof nextLine === "string" && /^\s+-\s+/.test(nextLine)) { | ||
| arrayItems.push(nextLine.replace(/^\s+-\s+/, "").trim()); | ||
| j++; | ||
| nextLine = lines[j]; |
📝 WalkthroughSummary by CodeRabbitBug Fixes
Walkthrough本次提交涉及四个文件的改进，包括搜索组件的选择逻辑与关键词高亮优化、Markdown 图像处理的 URL 规范化、YAML 前置元数据解析的防御性编程，以及管理后台主题配置逻辑的重构。 Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
coderabbitai
Bot
added
bug
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
client/src/lib/markdown.ts (1)
174-224:⚠️ Potential issue | 🟠 Major相对媒体地址被改写为
monolith.local，会导致线上图片/视频加载失败。
normalizedHref适合作为“解析/识别”中间值，但不应直接作为最终src输出。当前改动会把相对路径渲染成绝对的https://monolith.local/...。renderMarkdown在client/src/pages/post.tsx、client/src/pages/dynamic-page.tsx、client/src/pages/admin/editor.tsx都会消费用户内容，这个影响面较大。🔧 建议修复
- let normalizedHref = href; + let normalizedHref = href; try { normalizedHref = new URL(href, "https://monolith.local").toString(); } catch { normalizedHref = href; } @@ if (["mp4", "webm", "ogg", "mov"].includes(mediaExtension)) { return `<figure class="md-figure md-video"> - <video src="${normalizedHref}" controls playsinline preload="metadata" class="w-full rounded-lg border border-border/20 shadow-lg bg-black/5"></video> + <video src="${escapeHtml(href)}" controls playsinline preload="metadata" class="w-full rounded-lg border border-border/20 shadow-lg bg-black/5"></video> ${text ? `<figcaption>${escapeHtml(text)}</figcaption>` : ""} </figure>`; } @@ - return `<figure class="md-figure"><img src="${normalizedHref}" alt="${escapeHtml(text)}" loading="lazy" decoding="async" data-lazy-img${titleAttr} class="lazy-img"/>${text ? `<figcaption>${escapeHtml(text)}</figcaption>` : ""}</figure>`; + return `<figure class="md-figure"><img src="${escapeHtml(href)}" alt="${escapeHtml(text)}" loading="lazy" decoding="async" data-lazy-img${titleAttr} class="lazy-img"/>${text ? `<figcaption>${escapeHtml(text)}</figcaption>` : ""}</figure>`;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@client/src/lib/markdown.ts` around lines 174 - 224, The code incorrectly uses normalizedHref (which rewrites relative URLs to https://monolith.local) as the final src; preserve href for output when the original was relative. Update the logic around normalizedHref/videoUrl: compute a boolean (e.g., isRelative) before/after the new URL(...) attempt (detect hrefs that do not include a scheme or start with "//") and when rendering the <video>, <iframe> embeds, and the final <img> use href (original) for src if isRelative is true, otherwise use normalizedHref; keep normalizedHref for parsing/extension detection (mediaExtension, bpxMatch, ytMatch) but ensure the emitted src attributes use the original relative path when appropriate (affecting the video/YouTube/Bilibili/image return blocks referencing normalizedHref).client/src/components/search.tsx (1)
123-135:⚠️ Potential issue | 🟠 MajorEnter 键未处理 IME 组合输入，中文输入时可能误触发跳转。
在输入法组合态（如拼音候选）按 Enter 时会走“打开结果”分支，可能打断输入流程。
🔧 建议修复
const handleKeyDown = (e: React.KeyboardEvent) => { + if (e.nativeEvent.isComposing) return; + if (e.key === "ArrowDown") { e.preventDefault(); setSelectedIndex((prev) => Math.min(prev + 1, results.length - 1)); } else if (e.key === "ArrowUp") { e.preventDefault(); setSelectedIndex((prev) => Math.max(prev - 1, 0)); } else if (e.key === "Enter") { const selected = findSelectedResult(results, selectedIndex); if (selected) { setOpen(false); window.location.href = `/posts/${selected.slug}`; } } };As per coding guidelines
client/src/components/**：审查时请关注“无障碍访问（aria 标签、键盘导航）”。🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@client/src/components/search.tsx` around lines 123 - 135, The Enter key handler in handleKeyDown triggers navigation even when the IME is composing (e.g., Chinese pinyin), interrupting input; add an IME composition guard before the Enter branch by checking e.nativeEvent.isComposing (or maintain an isComposing state via onCompositionStart/onCompositionEnd) and early-return if composing, then proceed to use findSelectedResult/results/selectedIndex to navigate and call setOpen(false) only when not composing.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@client/src/components/search.tsx`:
- Around line 123-135: The Enter key handler in handleKeyDown triggers
navigation even when the IME is composing (e.g., Chinese pinyin), interrupting
input; add an IME composition guard before the Enter branch by checking
e.nativeEvent.isComposing (or maintain an isComposing state via
onCompositionStart/onCompositionEnd) and early-return if composing, then proceed
to use findSelectedResult/results/selectedIndex to navigate and call
setOpen(false) only when not composing.
In `@client/src/lib/markdown.ts`:
- Around line 174-224: The code incorrectly uses normalizedHref (which rewrites
relative URLs to https://monolith.local) as the final src; preserve href for
output when the original was relative. Update the logic around
normalizedHref/videoUrl: compute a boolean (e.g., isRelative) before/after the
new URL(...) attempt (detect hrefs that do not include a scheme or start with
"//") and when rendering the <video>, <iframe> embeds, and the final <img> use
href (original) for src if isRelative is true, otherwise use normalizedHref;
keep normalizedHref for parsing/extension detection (mediaExtension, bpxMatch,
ytMatch) but ensure the emitted src attributes use the original relative path
when appropriate (affecting the video/YouTube/Bilibili/image return blocks
referencing normalizedHref).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 84fd11e1-c534-4e35-b030-859cd626b150
📒 Files selected for processing (4)
client/src/components/search.tsxclient/src/lib/importers/frontmatter.tsclient/src/lib/markdown.tsclient/src/pages/admin/backup.tsx
📜 Review details
⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: ESLint 安全扫描
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (actions)
🧰 Additional context used
📓 Path-based instructions (2)
client/src/pages/**
⚙️ CodeRabbit configuration file
client/src/pages/**: 页面级组件。审查时请关注： 1. 数据加载和错误处理是否完善 2. SEO 相关（页面标题、meta 标签） 3. 导航和路由是否正确
Files:
client/src/pages/admin/backup.tsx
client/src/components/**
⚙️ CodeRabbit configuration file
client/src/components/**: 这是 React 前端组件目录。审查时请关注： 1. 是否同时兼容暗色和亮色主题（检查 CSS 变量和 data-theme） 2. 响应式布局是否完整（移动端/平板/桌面端） 3. 无障碍访问（aria 标签、键盘导航） 4. 组件是否保持单一职责
Files:
client/src/components/search.tsx
🪛 GitHub Check: ESLint
client/src/lib/importers/frontmatter.ts
[warning] 130-130: Detects "variable[key]" as a left- or right-hand assignment operand.
Variable Assigned to Object Injection Sink
[warning] 134-134: Detects "variable[key]" as a left- or right-hand assignment operand.
Generic Object Injection Sink
🔇 Additional comments (3)
client/src/pages/admin/backup.tsx (1)
602-606: 色调分支在当前调用范围内行为正确。当前页面仅传入
orange / blue / emerald，该分支逻辑可正确映射样式，未见功能性问题。client/src/lib/importers/frontmatter.ts (1)
111-114: 防御性类型守卫实现合理。这两处检查能避免对非字符串执行正则匹配，提升了解析器的健壮性。
Also applies to: 130-134
client/src/components/search.tsx (1)
31-58: 关键词高亮拆分实现清晰且可维护。按片段标记后再渲染
<mark>的方式可读性好，也避免了正则转义带来的边界问题。Also applies to: 142-150
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
devintomain, including deployment guardrails, Pages FunctionsAPI_BASEfixes, and improved error handling across settings, analytics, comments, media, and pagesdev