Complete the fake jQuery/document sandbox for cookie, location, querySelector and chained APIs, extract ajax params by regex first with JS fallback, and generate GitHub release notes in a single job so matrix OS uploads no longer append What's Changed twice.
Bump version to 0.4.3.
Co-authored-by: Cursor <cursoragent@cursor.com>
Root cause confirmed against a live share link: FcTool never actually
checked share validity against the info API — it read a top-level
"is_valid" field that the endpoint doesn't return. The real validity
flags (process.is_closed / process.is_expired) live under "process",
so an invalid share fell through to HTML scraping and surfaced a
confusing "未匹配到文件id(typed_id)" error instead of a clear
"分享已失效" message. parse() now checks share_links/info first and
fails fast with a clear message when the share is closed/expired.
Also widen PanDomainTemplate's FC regex to accept the mobile H5
landing page path (/h5/share/{key}), which previously didn't match
at all.
Updated verify_fangcloud_share.py to reflect the confirmed API
response shape instead of the earlier incorrect guess.
FcTool.java's share validity check hits a share_links/info endpoint on
v2.fangcloud.cn that doesn't appear in the project's own captured
traffic (pan-fc.http) or public docs, and its regex in
PanDomainTemplate doesn't match the /h5/share/ path used by mobile
links. This script reproduces both requests against a live share URL
to confirm the root cause before fixing the parser.
Disable redirect following on CE/Ce4 attacker-controlled requests and stop
echoing upstream response bodies in client-facing JSON errors. Add
assertPublicHost regression coverage for the advisory PoC hosts.
Co-authored-by: qaiu <qaiu@vip.qq.com>
- Preserve download cookie for UC/Quark needDownloader flows and disable browser/copy when required
- Quark: share-link first, transfer only on size limit (23018), reuse savedFileCache/search_exit
- Propagate auth to subdirectory parser URLs; switch path params to URL-safe Base64 (no double encode)
- Bump version to 0.4.2
Fixes#205
Co-authored-by: Cursor <cursoragent@cursor.com>
When the frontend requests subdirectory contents for UC drive shares, the
stoken query parameter is mishandled in two places, breaking directory browsing:
1. URLParamUtil.handleTruncatedUrl() does not exclude stoken from the URL
construction loop. As a result, the stoken value gets appended to the share
URL (e.g. https://drive.uc.cn/s/xxx?stoken=yyy). The extra query string
breaks the UC URL regex match in PanDomainTemplate, causing the parser to
fall back to the default IPanTool.parseFileList() which returns
"Not implemented yet".
2. ParserApi.getFileList() does not accept stoken as a method parameter and
does not forward it to ShareLinkInfo.otherParam. Even when the stoken is
present in the request URL, UcTool.parseFileList() cannot find it and must
re-authenticate against the UC API — which fails without proper auth cookies.
The fix:
- URLParamUtil: add stoken to the param exclusion list
- ParserApi: add String stoken parameter and put it into otherParam
Both first-level and nested directory listing work correctly after this fix.
q