Files that changed from the base of the PR and between 98246dd and 3683ebb.

• packages/renderless/package.json (1 hunks)
• packages/renderless/src/anchor/index.ts (1 hunks)
• packages/renderless/src/common/xss.ts (2 hunks)
• packages/renderless/src/fluent-editor/options.ts (4 hunks)
• packages/theme/package.json (1 hunks)
• packages/theme/src/fluent-editor/index.less (1 hunks)
• packages/vue/src/form-item/package.json (1 hunks)
• packages/vue/src/form-item/src/pc.vue (2 hunks)
• packages/vue/src/grid/package.json (1 hunks)
• packages/vue/src/grid/src/dragger/src/methods.ts (1 hunks)

• packages/renderless/package.json
• packages/theme/package.json
• packages/vue/src/grid/package.json

packages/vue/src/form-item/package.json (4)

3-3: LGTM: Addition of "type": "module"

The addition of "type": "module" is a positive change. It explicitly declares that this package uses ECMAScript modules, which is consistent with modern JavaScript practices and can lead to better tree-shaking and module resolution.

---

6-6: LGTM: Addition of "license": "MIT"

The addition of the MIT license is a positive change. It clearly communicates the terms under which the package can be used, modified, and distributed. This is crucial for open-source projects and helps users understand their rights and obligations when using the package.

---

20-23: LGTM: Addition of testing dependencies

The addition of @opentiny-internal/vue-test-utils and vitest as devDependencies is a positive change. This suggests an improvement in the testing setup for the package, which can lead to better code quality and reliability.

To ensure these new testing dependencies are being utilized effectively:

1. Verify that appropriate test files exist for the form-item component.
2. Check if there's adequate test coverage for the component's functionality.

Run the following script to check for test files and their content:

---

16-16: Verify dependency changes and their impact

The dependencies have been updated:

• Removed: @opentiny/vue-icon
• Added: @opentiny/vue-tooltip

These changes suggest a shift in the package's requirements, potentially affecting the form-item component's functionality.

Please ensure that:

1. The removal of vue-icon doesn't break any existing functionality.
2. The addition of vue-tooltip is necessary and properly utilized in the component.

Run the following script to check for any remaining references to the removed icon package and usage of the new tooltip package:

Also applies to: 18-18

✅ Verification successful

Dependency changes verified successfully

The removal of @opentiny/vue-icon and the addition of @opentiny/vue-tooltip have been verified. No references to the removed package remain, and the new package is not currently utilized, ensuring that the form-item component's functionality remains unaffected.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Check for references to removed icon package and usage of new tooltip package

echo "Checking for remaining references to @opentiny/vue-icon:"
rg -i "@opentiny/vue-icon" --type ts --type vue

echo "Checking for usage of @opentiny/vue-tooltip:"
rg -i "@opentiny/vue-tooltip" --type ts --type vue

Length of output: 363

packages/vue/src/grid/src/dragger/src/methods.ts (2)

Line range hint 1-100: Summary of changes and review findings

The changes in this file focus on enhancing the flexibility of the row drag-and-drop functionality in the grid component. Key improvements include:

1. Introduction of a trigger parameter for custom drag handles.
2. Special handling for index-based rows.
3. More modular approach with the use of createHandlerOnEnd.

These changes improve the component's customizability without introducing breaking changes. The overall structure and purpose of the file remain intact.

While the implementation appears sound, it's important to verify the correctness of the import statement and the potential impact on other parts of the codebase that may rely on the rowDrop method.

---

Line range hint 1-1: Verify the impact of changes and import statement

The changes to the rowDrop method introduce the use of createHandlerOnEnd, which is imported from a rowDrop module. Please ensure that:

1. The createHandlerOnEnd function is correctly implemented in the rowDrop module.
2. The import statement is correct and the rowDrop module is up-to-date with these changes.
3. Any other components or tests that rely on the rowDrop method are updated if necessary.

To verify the correctness of the import and the existence of the createHandlerOnEnd function, please run the following script:

Also applies to: 79-79

✅ Verification successful

Import statement and createHandlerOnEnd implementation verified successfully.

The createHandlerOnEnd function is correctly imported from ./rowDrop in methods.ts and is properly implemented in rowDrop.ts. No further changes are necessary.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Verify the import statement and the existence of createHandlerOnEnd function

# Check the import statement
echo "Checking import statement:"
rg --type typescript "import.*createHandlerOnEnd.*from './rowDrop'" packages/vue/src/grid/src/dragger/src/

# Check the implementation of createHandlerOnEnd
echo "Checking createHandlerOnEnd implementation:"
rg --type typescript "function createHandlerOnEnd" packages/vue/src/grid/src/dragger/src/
rg --type typescript "const createHandlerOnEnd" packages/vue/src/grid/src/dragger/src/

Length of output: 560

---

Script:

#!/bin/bash
# Verify the import statement and the existence of createHandlerOnEnd function

# Check the import statement
echo "Checking import statement:"
rg "import.*createHandlerOnEnd.*from './rowDrop'" packages/vue/src/grid/src/dragger/src/ --glob "*.ts" --glob "*.tsx"

# Check the implementation of createHandlerOnEnd
echo "Checking createHandlerOnEnd implementation:"
rg "function createHandlerOnEnd" packages/vue/src/grid/src/dragger/src/ --glob "*.ts" --glob "*.tsx"
rg "const createHandlerOnEnd" packages/vue/src/grid/src/dragger/src/ --glob "*.ts" --glob "*.tsx"

Length of output: 707

packages/theme/src/fluent-editor/index.less (1)

Line range hint 1-293: Overall assessment: Minor visual improvements

The changes in this file focus on refining the visual presentation of the fluent editor component, particularly the toolbar icons. These adjustments enhance the consistency and visual hierarchy of the interface without introducing any functional changes or potential issues.

Key improvements:

1. Standardized icon sizes for better visual consistency
2. Special treatment for the fullscreen button, making it visually distinct

These changes contribute to a more polished user interface, which can lead to a better user experience when interacting with the editor.

packages/renderless/src/common/xss.ts (2)

77-77: Ensure proper sanitization for 'src' attribute in img tags.

Adding 'src' to the whitelist for 'img' tags is necessary for image functionality. However, this change could potentially introduce security risks if not handled carefully.

To mitigate potential XSS vulnerabilities:

1. Ensure that the XSS filter sanitizes the 'src' attribute content to prevent XSS attacks through malicious image sources.
2. Consider implementing a URL validation function specifically for image sources.
3. If possible, use Content Security Policy (CSP) headers to restrict image sources to trusted domains.

Run the following script to verify the XSS filter implementation for image sources:

#!/bin/bash
# Description: Verify XSS filter implementation for 'src' attribute in img tags

# Test: Search for image URL sanitization or validation logic
rg --type typescript 'filterImageUrl|sanitizeImageUrl|validateImageUrl'

# Test: Check for any custom XSS filter implementations related to images
ast-grep --lang typescript --pattern 'function $_($$_) { $$_ filter $$_ (image|img|src) $$_ }'

---

25-25: Ensure proper sanitization for 'href' attribute.

Adding 'href' to the whitelist for 'a' tags is necessary for link functionality. However, this change could potentially introduce security risks if not handled carefully.

To mitigate potential XSS vulnerabilities:

1. Ensure that the XSS filter sanitizes the 'href' attribute content to prevent JavaScript injection (e.g., javascript: URLs).
2. Consider implementing a URL validation function to check for safe protocols.

Run the following script to verify the XSS filter implementation:

✅ Verification successful

'href' Attribute Sanitization Verified

The filterUrl function effectively sanitizes the href attribute by:

• Decoding HTML entities to prevent obfuscated URLs.
• Allowing only relative URLs or those with safe protocols.
• Rejecting dangerous protocols such as javascript:, data:, and vbscript:.

This ensures that adding href to the whitelist does not introduce XSS vulnerabilities.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify XSS filter implementation for 'href' attribute

# Test: Search for URL sanitization or validation logic
rg --type typescript 'filterUrl|sanitizeUrl|validateUrl'

# Test: Check for any custom XSS filter implementations
ast-grep --lang typescript --pattern 'function $_($$_) { $$_ filter $$_ xss $$_ }'

Length of output: 205

---

Script:

#!/bin/bash
# Description: Verify XSS filter implementation for 'href' attribute

# Test: Search for URL sanitization or validation logic using correct file type
rg --type ts 'filterUrl|sanitizeUrl|validateUrl'

# Test: Check for any custom XSS filter implementations with refined pattern
ast-grep --lang typescript --pattern 'function $_($$_) { $$_ filter $_ xss $_ }'

Length of output: 5043

---

Script:

#!/bin/bash
# Description: Locate the implementation of `filterUrl` function

# Test: Search for the definition of `filterUrl` using various patterns
rg --type ts 'function\s+filterUrl\s*\('
rg --type ts 'const\s+filterUrl\s*='
rg --type ts 'let\s+filterUrl\s*='
rg --type ts 'filterUrl\s*:\s*function\s*\('
rg --type ts 'export\s+const\s+filterUrl\s*='

Length of output: 288

---

Script:

#!/bin/bash
# Description: Extract the implementation of `filterUrl` function from xss.ts

# Use grep to extract lines containing the definition and the function body
rg --type ts -A 20 'let\s+filterUrl\s*=\s*function\s*\(content\)\s*\{' packages/renderless/src/common/xss.ts

Length of output: 692

packages/renderless/src/anchor/index.ts (1)

127-129: Improved robustness with early return check.

The addition of this check enhances the function's reliability by preventing potential errors when props.links is undefined or empty. This is a good defensive programming practice.

packages/renderless/src/fluent-editor/options.ts (1)

38-38: LGTM! Good range of line height options.

The lineHeightConfig array provides a good range of line height options from 1 to 5. Using unitless values for line heights is a best practice, allowing for better scaling with different font sizes. The progression of values is logical, including both common (1.5, 2) and more extreme options for flexibility.

packages/vue/src/form-item/src/pc.vue (1)

224-225: Class merging logic is correct

The code correctly merges the tiny-tooltip class with existing classes and removes duplicates using deduplicateCssClass. This ensures that the component applies the appropriate styles without any conflicting or redundant class names.