Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 73 additions & 3 deletions packages/taro-vite-runner/src/h5/config.ts
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import type { PostcssOption } from '@tarojs/taro/types/compile'
import type { ViteH5CompilerContext } from '@tarojs/taro/types/compile/viteCompilerContext'
import type { PluginOption } from 'vite'


export default function (viteCompilerContext: ViteH5CompilerContext): PluginOption {
const { taroConfig, cwd: appPath, app, sourceDir } = viteCompilerContext
const routerMode = taroConfig.router?.mode || 'hash'
Expand Down Expand Up @@ -97,20 +98,77 @@ export default function (viteCompilerContext: ViteH5CompilerContext): PluginOpti
if (isObject<Record<string, any>>(serverOption.headers)) {
headers = serverOption.headers
}

let hmr = true
if (isBoolean(serverOption.hot)) {
hmr = serverOption.hot
if (isBoolean(serverOption.hmr)) {
hmr = serverOption.hmr
}

let open: string | boolean = true
if (isBoolean(serverOption.open) || isString(serverOption.open)) {
open = serverOption.open
}


let cors: boolean | Record<string, any> = true
if (isBoolean(serverOption.cors) || isObject<Record<string, any>>(serverOption.cors)) {
cors = serverOption.cors
}
Comment on lines +113 to +116
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

CORS 默认值不应强制为 true(存在安全风险)

Vite 默认仅允许 localhost/127.0.0.1/::1,强行默认 true 等于对任意来源开放,提升被同网段恶意页面读取源码的风险。建议:仅在类型匹配时透传,否则保持 undefined 交由 Vite 采用默认策略。(vite.dev)

-  let cors: boolean | Record<string, any> = true
-  if (isBoolean(serverOption.cors) || isObject<Record<string, any>>(serverOption.cors)) {
-    cors = serverOption.cors
-  }
+  let cors: boolean | Record<string, any> | undefined
+  if (isBoolean(serverOption.cors) || isObject<Record<string, any>>(serverOption.cors)) {
+    cors = serverOption.cors
+  }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
let cors: boolean | Record<string, any> = true
if (isBoolean(serverOption.cors) || isObject<Record<string, any>>(serverOption.cors)) {
cors = serverOption.cors
}
// only set cors when the user explicitly provides a boolean or object; otherwise let Vite apply its default
let cors: boolean | Record<string, any> | undefined
if (isBoolean(serverOption.cors) || isObject<Record<string, any>>(serverOption.cors)) {
cors = serverOption.cors
}
🤖 Prompt for AI Agents
In packages/taro-vite-runner/src/h5/config.ts around lines 113 to 116, the code
currently forces cors to true which opens CORS to all origins; instead, only
forward serverOption.cors when it is explicitly a boolean or an object and
otherwise leave cors undefined so Vite can apply its secure defaults. Change the
initialization to undefined, check types as currently done, and assign cors =
serverOption.cors only when the check passes; do not default to true.



let watch: Record<string, any> = {}
if (isObject<Record<string, any>>(serverOption.watch)) {
watch = serverOption.watch
}
Comment on lines +119 to +122
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

watch 配置需要更严格的类型检查

当前代码将 watch 默认设置为空对象,但 Vite 的 server.watch 可以是 boolean | WatchOptions。如果用户传入 boolean 值,应该直接透传而不是强制转换为对象。

应用以下修改:

-  let watch: Record<string, any> = {}
-  if (isObject<Record<string, any>>(serverOption.watch)) {
-    watch = serverOption.watch
-  }
+  let watch: Record<string, any> | boolean | undefined
+  if (isObject<Record<string, any>>(serverOption.watch) || isBoolean(serverOption.watch)) {
+    watch = serverOption.watch
+  }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
let watch: Record<string, any> = {}
if (isObject<Record<string, any>>(serverOption.watch)) {
watch = serverOption.watch
}
// Before: only objects were forwarded, defaulting to an empty object.
- let watch: Record<string, any> = {}
- if (isObject<Record<string, any>>(serverOption.watch)) {
- watch = serverOption.watch
- }
// After: allow boolean or object, otherwise leave undefined so Vite uses its default.
let watch: Record<string, any> | boolean | undefined
if (isObject<Record<string, any>>(serverOption.watch) || isBoolean(serverOption.watch)) {
watch = serverOption.watch
}
🤖 Prompt for AI Agents
In packages/taro-vite-runner/src/h5/config.ts around lines 141 to 144, the
current code always coerces serverOption.watch into an object which loses
support for boolean values; change the handling so if serverOption.watch is a
boolean (typeof serverOption.watch === 'boolean') assign that boolean directly
to watch, else if it's an object assign it as before, and otherwise leave watch
undefined or the proper default; update the watch variable's type to accept
boolean | Record<string, any> (or Vite's WatchOptions) so boolean values are
transparently passed through.


let strictPort = false
if (isBoolean(serverOption.strictPort)) {
strictPort = serverOption.strictPort
}

let middlewareMode: 'ssr' | 'html' | false = false
if (serverOption.middlewareMode === 'ssr' || serverOption.middlewareMode === 'html') {
middlewareMode = serverOption.middlewareMode
}
Comment on lines +129 to +132
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

middlewareMode 需支持 boolean=true,否则丢失中间件模式能力

Vite 支持 boolean | 'ssr' | 'html'。当前实现仅识别 'ssr' | 'html',忽略 true

-  let middlewareMode: 'ssr' | 'html' | false = false
-  if (serverOption.middlewareMode === 'ssr' || serverOption.middlewareMode === 'html') {
-    middlewareMode = serverOption.middlewareMode
-  }
+  let middlewareMode: boolean | 'ssr' | 'html' | undefined
+  if (serverOption.middlewareMode === true || serverOption.middlewareMode === 'ssr' || serverOption.middlewareMode === 'html') {
+    middlewareMode = serverOption.middlewareMode
+  }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
let middlewareMode: 'ssr' | 'html' | false = false
if (serverOption.middlewareMode === 'ssr' || serverOption.middlewareMode === 'html') {
middlewareMode = serverOption.middlewareMode
}
let middlewareMode: boolean | 'ssr' | 'html' | undefined
if (
serverOption.middlewareMode === true ||
serverOption.middlewareMode === 'ssr' ||
serverOption.middlewareMode === 'html'
) {
middlewareMode = serverOption.middlewareMode
}
🤖 Prompt for AI Agents
In packages/taro-vite-runner/src/h5/config.ts around lines 151 to 154, the
middlewareMode variable is typed and assigned only for 'ssr'|'html', ignoring
boolean true; update the type to allow boolean | 'ssr' | 'html' and set
middlewareMode = serverOption.middlewareMode when serverOption.middlewareMode is
true or one of the string values so that a boolean true is preserved and
middleware mode isn't lost.


let origin = ''
if (isString(serverOption.origin)) {
origin = serverOption.origin
}

Comment on lines +134 to +138
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

避免将空字符串传入 origin:仅当为字符串时透传

origin 默认为空字符串会覆盖 Vite 默认行为,建议仅在为字符串时设置;否则保持 undefined

-  let origin = ''
-  if (isString(serverOption.origin)) {
-    origin = serverOption.origin
-  }
+  let origin: string | undefined
+  if (isString(serverOption.origin)) {
+    origin = serverOption.origin
+  }

(server 段保持 origin, 即可,未设置时为 undefined

Also applies to: 275-276

🤖 Prompt for AI Agents
In packages/taro-vite-runner/src/h5/config.ts around lines 168-172 (and
similarly lines 275-276), the current code initializes origin to an empty string
which overrides Vite's default; change the logic to leave origin as undefined
unless serverOption.origin is a non-empty string: only assign origin when typeof
serverOption.origin === 'string' and serverOption.origin.trim() !== '' so that
when origin is not provided it remains undefined (keep the server config
exporting origin, not origin: ''), ensuring Vite defaults are preserved.

let fsStrict = true
if (serverOption.fs && isBoolean(serverOption.fs.strict)) {
fsStrict = serverOption.fs.strict
}

let fsAllow: string[] = []
if (serverOption.fs && Array.isArray(serverOption.fs.allow)) {
fsAllow = serverOption.fs.allow
}

let fsDeny: string[] = ['.env', '.env.*', '*.{crt,pem}', '**/.git/**']
if (serverOption.fs && Array.isArray(serverOption.fs.deny)) {
fsDeny = serverOption.fs.deny
}

const mode = getMode(taroConfig)
const mainFields = [...defaultMainFields]
if (!isProd) {
mainFields.unshift('main:h5')
}

let allowedHosts: true | string[] | undefined
if (serverOption.allowedHosts === true || Array.isArray(serverOption.allowedHosts)) {
allowedHosts = serverOption.allowedHosts
} else if (isString(serverOption.allowedHosts) && serverOption.allowedHosts) {
allowedHosts = [serverOption.allowedHosts]
}

let sourcemapIgnoreList: false | ((sourcePath: string, sourcemapPath: string) => boolean) = (sourcePath) => sourcePath.includes('node_modules')
if (typeof serverOption.sourcemapIgnoreList === 'boolean' || typeof serverOption.sourcemapIgnoreList === 'function') {
sourcemapIgnoreList = serverOption.sourcemapIgnoreList
}

return {
name: 'taro:vite-h5-config',
enforce: 'pre',
Expand Down Expand Up @@ -173,9 +231,21 @@ export default function (viteCompilerContext: ViteH5CompilerContext): PluginOpti
port: serverOption.port ? Number(serverOption.port) : 10086,
https: typeof serverOption.https !== 'boolean' ? serverOption.https : undefined,
open,
proxy: (serverOption.proxy as any) || {},
proxy: serverOption.proxy || {} as Record<string, string | Record<string, any>>,
headers,
hmr,
watch,
fs: {
strict: fsStrict,
allow: fsAllow,
deny: fsDeny,
},
allowedHosts,
middlewareMode,
strictPort,
sourcemapIgnoreList,
origin,
cors,
},
css: {
postcss: {
Expand Down
4 changes: 3 additions & 1 deletion packages/taro/types/compile/config/h5.d.ts
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import type { IOption, IPostcssOption, IUrlLoaderOption } from './util'
import type { OutputOptions as RollupOutputOptions } from 'rollup'
import type { Compiler, CompilerTypes, CompilerWebpackTypes } from '../compiler'
import type { OutputExt } from './project'
import type { ServerOptions as ViteServerOptions } from 'vite'

export interface IH5RouterConfig {
/** 配置路由模式 */
Expand Down Expand Up @@ -51,7 +52,8 @@ export interface IH5Config <T extends CompilerTypes = CompilerWebpackTypes> {
router?: IH5RouterConfig

/** 预览服务的配置,可以更改端口等参数。具体配置参考 [webpack-dev-server](https://webpack.js.org/configuration/dev-server) */
devServer?: webpackDevServer.Configuration
// 修改后:同时支持 Webpack 和 Vite
devServer?: T extends 'vite' ? ViteServerOptions : webpackDevServer.Configuration

/** 用于控制是否生成 js、css 对应的 sourceMap (默认值:watch 模式下为 true,否则为 false) */
enableSourceMap?: boolean
Expand Down
Loading