fix(login): ?error=__proto__ 会崩掉整个登录页 + 补全 error code 映射 - #393
Merged
Conversation
线上活跃缺陷：LoginErrorNotice 里 messages[error] 是无保护的原型链查找。 messages["__proto__"] 取到的是 Object.prototype（对象而非 undefined，所以 ?? 兜底不触发），把非字符串交给 React 渲染会抛错；/login 没有 error boundary， 整个登录页被替换成 "Application error"，连 GitHub 登录一起不可用。 constructor / toString / valueOf 同理（取到函数）。发条链接即可让人登不了录。 改为显式 code→i18n key 白名单 + Object.hasOwn，未知 code 一律落到通用文案。 顺带（同区域）： - 补齐 4 个 error code 的映射。后端实发 discord_canary / oauth_failed / oauth_state / oauth_provider，此前后两者塌缩成"请重试"——而 oauth_state （cookie 被拦或超 300s）重试会无限复现，oauth_provider（服务端缺配置） 再怎么重试都不可能好，给的建议是错的。 - 去掉 messages prop：NextIntlClientProvider 已在 layout 包裹全站，直接 useTranslations 即可，省掉"加一个 error code 要改三个文件"的同步负担。 - 删掉按钮旁叙述当前灰度阶段的注释（CLAUDE.md §3 禁止的任务性注释，且 GA 是 改另一个仓库的 env，没人会回来删它）。 新增 tests/login-error-notice.test.ts（5 条），含 __proto__ 系列回归。 72 测试通过，typecheck / lint 干净，build 表 login 仍为 ● SSG。
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
修 involutionhell-backend#54 里属于前端的 3 条(后端 9 条见 involutionhell-backend#55)。请 review,我不合并。
🔴 这条是线上活跃缺陷
LoginErrorNotice里messages[error]是无保护的原型链查找:?error=messages[error]discord_canary__proto__constructor/toString/valueOfmessages["__proto__"]返回Object.prototype(不是undefined,所以?? messages.generic兜底不触发),React 抛Objects are not valid as a React child。/login没有error.tsx、全站也没有app/error.tsx→ 落到 Next 全局兜底 → 整个登录页变成 "Application error",GitHub 登录也一并不可用。发一条链接就能让人登不了录,当前生产可复现。
改为显式 code→i18n key 白名单 +
Object.hasOwn,未知 code 一律落到通用文案,绝不透传原值。顺带修的同区域两条
discord_canary/oauth_failed/oauth_state/oauth_provider,此前后两者都塌缩成"请重试"——而oauth_state(cookie 被拦、或在授权页停留超 300s)重试会无限复现,oauth_provider(服务端缺配置)再怎么重试都不可能好。给的建议是错的,且 support 拿不到可 grep 的区分串。messagesprop:NextIntlClientProvider已在layout.tsx:65包裹全站,直接useTranslations即可,省掉"加一个 error code 要改三个文件、漏改则静默降级"的同步负担。同时删掉按钮旁叙述当前灰度阶段的注释(CLAUDE.md§3 禁止的任务性注释,且 GA 是改另一个仓库的 env,没人会回来删它)。验证
新增
tests/login-error-notice.test.ts(5 条,含__proto__/constructor/toString/valueOf/hasOwnProperty回归,以及"解析出的 key 在 zh/en 里都存在")。pnpm test72 通过(67 → +5)·pnpm typecheck干净 ·pnpm lint0 error ·pnpm build通过且 build 表● /[locale]/login仍是 SSG。