Merge branch 'misskey-dev:develop' into develop

CHANGELOG.md

@@ -46,6 +46,7 @@
 - Fix: 共有機能をサポートしていないブラウザの場合は共有ボタンを非表示にする #11305
 - Fix: 通知のグルーピング設定を変更してもリロードされるまで表示が変わらない問題を修正 #12470
 - Fix: 長い名前のチャンネルにおける投稿フォームの表示が崩れる問題を修正
+- Fix: セキュリティ向上のためAiScriptの`Mk:apiExternal`を無効化
 
 ### Server
 - Enhance: MFM `$[ruby ]` が他ソフトウェアと連合されるように

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "misskey",
-	"version": "2023.12.0-beta.2",
+	"version": "2023.12.0-beta.3",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",
@@ -50,13 +50,13 @@
 		"js-yaml": "4.1.0",
 		"postcss": "8.4.32",
 		"terser": "5.24.0",
-		"typescript": "5.3.2"
+		"typescript": "5.3.3"
 	},
 	"devDependencies": {
-		"@typescript-eslint/eslint-plugin": "6.13.1",
-		"@typescript-eslint/parser": "6.13.1",
+		"@typescript-eslint/eslint-plugin": "6.13.2",
+		"@typescript-eslint/parser": "6.13.2",
 		"cross-env": "7.0.3",
-		"cypress": "13.6.0",
+		"cypress": "13.6.1",
 		"eslint": "8.55.0",
 		"start-server-and-test": "2.0.3",
 		"ncp": "2.0.0"

packages/backend/package.json

@@ -61,13 +61,13 @@
 	"dependencies": {
 		"@aws-sdk/client-s3": "3.412.0",
 		"@aws-sdk/lib-storage": "3.412.0",
-		"@bull-board/api": "5.10.1",
-		"@bull-board/fastify": "5.10.1",
-		"@bull-board/ui": "5.10.1",
+		"@bull-board/api": "5.10.2",
+		"@bull-board/fastify": "5.10.2",
+		"@bull-board/ui": "5.10.2",
 		"@discordapp/twemoji": "14.1.2",
-		"@fastify/accepts": "4.2.0",
+		"@fastify/accepts": "4.3.0",
 		"@fastify/cookie": "9.2.0",
-		"@fastify/cors": "8.4.1",
+		"@fastify/cors": "8.4.2",
 		"@fastify/express": "2.3.0",
 		"@fastify/http-proxy": "9.3.0",
 		"@fastify/multipart": "8.0.0",
@@ -89,7 +89,7 @@
 		"bcryptjs": "2.4.3",
 		"blurhash": "2.0.5",
 		"body-parser": "1.20.2",
-		"bullmq": "4.14.4",
+		"bullmq": "4.15.2",
 		"cacheable-lookup": "7.0.0",
 		"cbor": "9.0.1",
 		"chalk": "5.3.0",
@@ -117,7 +117,7 @@
 		"js-yaml": "4.1.0",
 		"jsdom": "23.0.1",
 		"json5": "2.2.3",
-		"jsonld": "8.3.1",
+		"jsonld": "8.3.2",
 		"jsrsasign": "10.9.0",
 		"meilisearch": "0.36.0",
 		"mfm-js": "0.23.3",
@@ -134,7 +134,7 @@
 		"oauth2orize": "1.12.0",
 		"oauth2orize-pkce": "0.1.2",
 		"os-utils": "0.0.14",
-		"otpauth": "9.2.0",
+		"otpauth": "9.2.1",
 		"parse5": "7.1.2",
 		"pg": "8.11.3",
 		"pkce-challenge": "4.0.1",
@@ -148,7 +148,7 @@
 		"ratelimiter": "3.4.1",
 		"re2": "1.20.9",
 		"redis-lock": "0.1.4",
-		"reflect-metadata": "0.1.13",
+		"reflect-metadata": "0.1.14",
 		"rename": "1.0.4",
 		"rss-parser": "3.13.0",
 		"rxjs": "7.8.1",
@@ -167,7 +167,7 @@
 		"tsconfig-paths": "4.2.0",
 		"twemoji-parser": "14.0.0",
 		"typeorm": "0.3.17",
-		"typescript": "5.3.2",
+		"typescript": "5.3.3",
 		"ulid": "2.3.0",
 		"vary": "1.1.2",
 		"web-push": "3.6.6",
@@ -187,14 +187,14 @@
 		"@types/content-disposition": "0.5.8",
 		"@types/fluent-ffmpeg": "2.1.24",
 		"@types/http-link-header": "1.0.5",
-		"@types/jest": "29.5.10",
+		"@types/jest": "29.5.11",
 		"@types/js-yaml": "4.0.9",
 		"@types/jsdom": "21.1.6",
 		"@types/jsonld": "1.5.13",
 		"@types/jsrsasign": "10.5.12",
 		"@types/mime-types": "2.1.4",
 		"@types/ms": "0.7.34",
-		"@types/node": "20.10.3",
+		"@types/node": "20.10.4",
 		"@types/node-fetch": "3.0.3",
 		"@types/nodemailer": "6.4.14",
 		"@types/oauth": "0.9.4",
@@ -217,8 +217,8 @@
 		"@types/vary": "1.1.3",
 		"@types/web-push": "3.6.3",
 		"@types/ws": "8.5.10",
-		"@typescript-eslint/eslint-plugin": "6.13.1",
-		"@typescript-eslint/parser": "6.13.1",
+		"@typescript-eslint/eslint-plugin": "6.13.2",
+		"@typescript-eslint/parser": "6.13.2",
 		"aws-sdk-client-mock": "3.0.0",
 		"cross-env": "7.0.3",
 		"eslint": "8.55.0",

packages/frontend/package.json

@@ -22,7 +22,7 @@
 		"@rollup/plugin-alias": "5.1.0",
 		"@rollup/plugin-json": "6.0.1",
 		"@rollup/plugin-replace": "5.0.5",
-		"@rollup/pluginutils": "5.0.5",
+		"@rollup/pluginutils": "5.1.0",
 		"@syuilo/aiscript": "0.16.0",
 		"@tabler/icons-webfont": "2.37.0",
 		"@vitejs/plugin-vue": "4.5.1",
@@ -34,12 +34,12 @@
 		"browser-image-resizer": "github:misskey-dev/browser-image-resizer#v2.2.1-misskey.3",
 		"buraha": "0.0.1",
 		"canvas-confetti": "1.6.1",
-		"chart.js": "4.4.0",
+		"chart.js": "4.4.1",
 		"chartjs-adapter-date-fns": "3.0.0",
 		"chartjs-chart-matrix": "2.0.1",
 		"chartjs-plugin-gradient": "0.6.1",
 		"chartjs-plugin-zoom": "2.0.1",
-		"chromatic": "9.1.0",
+		"chromatic": "10.1.0",
 		"compare-versions": "6.1.0",
 		"cropperjs": "2.0.0-beta.4",
 		"date-fns": "2.30.0",
@@ -57,9 +57,9 @@
 		"photoswipe": "5.4.3",
 		"punycode": "2.3.1",
 		"querystring": "0.2.1",
-		"rollup": "4.6.1",
+		"rollup": "4.7.0",
 		"sanitize-html": "2.11.0",
-		"shiki": "^0.14.5",
+		"shiki": "0.14.6",
 		"sass": "1.69.5",
 		"strict-event-emitter-types": "2.0.0",
 		"textarea-caret": "3.1.0",
@@ -69,53 +69,53 @@
 		"tsc-alias": "1.8.8",
 		"tsconfig-paths": "4.2.0",
 		"twemoji-parser": "14.0.0",
-		"typescript": "5.3.2",
+		"typescript": "5.3.3",
 		"uuid": "9.0.1",
 		"v-code-diff": "1.7.2",
 		"vanilla-tilt": "1.8.1",
-		"vite": "5.0.5",
-		"vue": "3.3.9",
+		"vite": "5.0.7",
+		"vue": "3.3.11",
 		"vuedraggable": "next"
 	},
 	"devDependencies": {
-		"@storybook/addon-actions": "7.6.3",
-		"@storybook/addon-essentials": "7.6.3",
-		"@storybook/addon-interactions": "7.6.3",
-		"@storybook/addon-links": "7.6.3",
-		"@storybook/addon-storysource": "7.6.3",
-		"@storybook/addons": "7.6.3",
-		"@storybook/blocks": "7.6.3",
-		"@storybook/core-events": "7.6.3",
+		"@storybook/addon-actions": "7.6.4",
+		"@storybook/addon-essentials": "7.6.4",
+		"@storybook/addon-interactions": "7.6.4",
+		"@storybook/addon-links": "7.6.4",
+		"@storybook/addon-storysource": "7.6.4",
+		"@storybook/addons": "7.6.4",
+		"@storybook/blocks": "7.6.4",
+		"@storybook/core-events": "7.6.4",
 		"@storybook/jest": "0.2.3",
-		"@storybook/manager-api": "7.6.3",
-		"@storybook/preview-api": "7.6.3",
-		"@storybook/react": "7.6.3",
-		"@storybook/react-vite": "7.6.3",
+		"@storybook/manager-api": "7.6.4",
+		"@storybook/preview-api": "7.6.4",
+		"@storybook/react": "7.6.4",
+		"@storybook/react-vite": "7.6.4",
 		"@storybook/testing-library": "0.2.2",
-		"@storybook/theming": "7.6.3",
-		"@storybook/types": "7.6.3",
-		"@storybook/vue3": "7.6.3",
-		"@storybook/vue3-vite": "7.6.3",
+		"@storybook/theming": "7.6.4",
+		"@storybook/types": "7.6.4",
+		"@storybook/vue3": "7.6.4",
+		"@storybook/vue3-vite": "7.6.4",
 		"@testing-library/vue": "8.0.1",
 		"@types/escape-regexp": "0.0.3",
 		"@types/estree": "1.0.5",
 		"@types/matter-js": "0.19.5",
 		"@types/micromatch": "4.0.6",
-		"@types/node": "20.10.3",
+		"@types/node": "20.10.4",
 		"@types/punycode": "2.1.3",
 		"@types/sanitize-html": "2.9.5",
 		"@types/throttle-debounce": "5.0.2",
 		"@types/tinycolor2": "1.4.6",
 		"@types/uuid": "9.0.7",
 		"@types/websocket": "1.0.10",
 		"@types/ws": "8.5.10",
-		"@typescript-eslint/eslint-plugin": "6.13.1",
-		"@typescript-eslint/parser": "6.13.1",
+		"@typescript-eslint/eslint-plugin": "6.13.2",
+		"@typescript-eslint/parser": "6.13.2",
 		"@vitest/coverage-v8": "0.34.6",
-		"@vue/runtime-core": "3.3.9",
+		"@vue/runtime-core": "3.3.11",
 		"acorn": "8.11.2",
 		"cross-env": "7.0.3",
-		"cypress": "13.6.0",
+		"cypress": "13.6.1",
 		"eslint": "8.55.0",
 		"eslint-plugin-import": "2.29.0",
 		"eslint-plugin-vue": "9.19.2",
@@ -129,13 +129,13 @@
 		"react": "18.2.0",
 		"react-dom": "18.2.0",
 		"start-server-and-test": "2.0.3",
-		"storybook": "7.6.3",
+		"storybook": "7.6.4",
 		"storybook-addon-misskey-theme": "github:misskey-dev/storybook-addon-misskey-theme",
 		"summaly": "github:misskey-dev/summaly",
 		"vite-plugin-turbosnap": "1.0.3",
 		"vitest": "0.34.6",
 		"vitest-fetch-mock": "0.2.2",
 		"vue-eslint-parser": "9.3.2",
-		"vue-tsc": "1.8.24"
+		"vue-tsc": "1.8.25"
 	}
 }

packages/frontend/src/components/MkAsUi.vue

@@ -43,6 +43,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 			fixed
 			:instant="true"
 			:initialText="c.form.text"
+			:initialCw="c.form.cw"
 		/>
 	</div>
 	<MkFolder v-else-if="c.type === 'folder'" :defaultOpen="c.opened">
@@ -97,6 +98,7 @@ function onSwitchUpdate(v) {
 function openPostForm() {
 	os.post({
 		initialText: c.form.text,
+		initialCw: c.form.cw,
 		instant: true,
 	});
 }

packages/frontend/src/components/MkPostForm.vue

@@ -135,6 +135,7 @@ const props = withDefaults(defineProps<{
 	mention?: Misskey.entities.User;
 	specified?: Misskey.entities.User;
 	initialText?: string;
+	initialCw?: string;
 	initialVisibility?: (typeof Misskey.noteVisibilities)[number];
 	initialFiles?: Misskey.entities.DriveFile[];
 	initialLocalOnly?: boolean;
@@ -177,10 +178,10 @@ const poll = ref<{
 	expiresAt: string | null;
 	expiredAfter: string | null;
 } | null>(null);
-const useCw = ref(false);
+const useCw = ref<boolean>(!!props.initialCw);
 const showPreview = ref(defaultStore.state.showPreview);
 watch(showPreview, () => defaultStore.set('showPreview', showPreview.value));
-const cw = ref<string | null>(null);
+const cw = ref<string | null>(props.initialCw ?? null);
 const localOnly = ref<boolean>(props.initialLocalOnly ?? defaultStore.state.rememberNoteVisibility ? defaultStore.state.localOnly : defaultStore.state.defaultNoteLocalOnly);
 const visibility = ref(props.initialVisibility ?? (defaultStore.state.rememberNoteVisibility ? defaultStore.state.visibility : defaultStore.state.defaultNoteVisibility) as typeof Misskey.noteVisibilities[number]);
 const visibleUsers = ref([]);

packages/frontend/src/components/MkPostFormDialog.vue

@@ -22,6 +22,7 @@ const props = defineProps<{
 	mention?: Misskey.entities.User;
 	specified?: Misskey.entities.User;
 	initialText?: string;
+	initialCw?: string;
 	initialVisibility?: typeof Misskey.noteVisibilities;
 	initialFiles?: Misskey.entities.DriveFile[];
 	initialLocalOnly?: boolean;

packages/frontend/src/os.ts

@@ -5,8 +5,8 @@
 
 // TODO: なんでもかんでもos.tsに突っ込むのやめたいのでよしなに分割する
 
-import { pendingApiRequestsCount, api, apiExternal, apiGet } from '@/scripts/api.js';
-export { pendingApiRequestsCount, api, apiExternal, apiGet };
+import { pendingApiRequestsCount, api, apiGet } from '@/scripts/api.js';
+export { pendingApiRequestsCount, api, apiGet };
 import { Component, markRaw, Ref, ref, defineAsyncComponent } from 'vue';
 import { EventEmitter } from 'eventemitter3';
 import insertTextAtCursor from 'insert-text-at-cursor';

packages/frontend/src/scripts/aiscript/api.ts

@@ -50,6 +50,7 @@ export function createAiScriptEnv(opts) {
 				return values.ERROR('request_failed', utils.jsToVal(err));
 			});
 		}),
+		/* セキュリティ上の問題があるため無効化
 		'Mk:apiExternal': values.FN_NATIVE(async ([host, ep, param, token]) => {
 			utils.assertString(host);
 			utils.assertString(ep);
@@ -60,6 +61,7 @@ export function createAiScriptEnv(opts) {
 				return values.ERROR('request_failed', utils.jsToVal(err));
 			});
 		}),
+		*/
 		'Mk:save': values.FN_NATIVE(([key, value]) => {
 			utils.assertString(key);
 			miLocalStorage.setItem(`aiscript:${opts.storageKey}:${key.value}`, JSON.stringify(utils.valToJs(value)));

packages/frontend/src/scripts/aiscript/ui.ts

@@ -121,13 +121,15 @@ export type AsUiPostFormButton = AsUiComponentBase & {
 	rounded?: boolean;
 	form?: {
 		text: string;
+		cw?: string;
 	};
 };
 
 export type AsUiPostForm = AsUiComponentBase & {
 	type: 'postForm';
 	form?: {
 		text: string;
+		cw?: string;
 	};
 };
 
@@ -454,8 +456,11 @@ function getPostFormButtonOptions(def: values.Value | undefined, call: (fn: valu
 	const getForm = () => {
 		const text = form!.value.get('text');
 		utils.assertString(text);
+		const cw = form!.value.get('cw');
+		if (cw) utils.assertString(cw);
 		return {
 			text: text.value,
+			cw: cw?.value,
 		};
 	};
 
@@ -478,8 +483,11 @@ function getPostFormOptions(def: values.Value | undefined, call: (fn: values.VFn
 	const getForm = () => {
 		const text = form!.value.get('text');
 		utils.assertString(text);
+		const cw = form!.value.get('cw');
+		if (cw) utils.assertString(cw);
 		return {
 			text: text.value,
+			cw: cw?.value,
 		};
 	};