Evan Hu
205cafa4f5
自查时发现的两处。
**@import 匹配过宽会损坏合法皮肤。** 此前在任意位置匹配 `@import`，于是 `.a{content:"@import //x";color:red}` 会被从 `@` 切到该声明的分号，留下一个未闭合的字符串和一份坏掉的样式表——为了保护皮肤反而弄坏了一个本来没问题的皮肤。改成只在 at-rule 能出现的位置匹配：样式表开头，或 `;` / `}` 之后；并要求关键字后面不是字母数字，避免 `@importantthing` 被当成 `@import`。
**CSS 转义不是漏洞，但原因不显然，值得钉死。** 样式表可以写 `url("https:\/\/host/x.png")`，浏览器解转义后得到一个可用的远程 URL，而字面文本里没有 `://`，分类器给出的是 Embed 而不是 Drop。这是安全的，但安全性来自 Embed 能产出什么：要么把文件内联成 data: 负载，要么回退到 candidate-skins 虚拟主机下的 URL，两者都无法命名皮肤作者选定的 origin。转义过的 `..` 同理——它以字面转义文本的形式进入文件系统查找，不会穿越，也永远不会被写回文档。
也就是说，真正保护候选窗的不变量是「Embed 永不产出攻击者命名的 origin」，而不是「Drop 拦住了远程 URL 的每一种写法」。把这条写进头文件，并补一个用例钉住「转义写法永远不落到 Keep」——将来若有人改动 Embed 的回退逻辑让它原样输出 URL，这个洞会重新打开，用例会先失败。
本机以 -Wall -Wextra -Wpedantic -Werror + ASan/UBSan 编译运行 8/8 通过，portable 目标经 CMake + ctest 验证，clang-format 干净。
Metasequoia IME for Windows
中文 README · Website · Docs · Privacy
A free and open-source Chinese and Japanese input method for Windows 10 and 11, built on TSF with no legacy IMM32 path.
This repository is the Windows product: the TSF text service DLL, the resident server, a self-written native GUI framework, the HTML surfaces and the installer. The conversion engine is shared with the macOS, iOS and Linux frontends and lives in MSIME-Engine.
This is a public beta. Expect rough edges and read the release notes before upgrading.
Install
Download the installer from Releases or the download page, run it, then switch with Win + Space.
Current builds are not code signed. SmartScreen will block them and uiAccess is unavailable, which means the candidate window cannot float above elevated applications. Verify the download with the SHA256 published on the download page.
You need the Microsoft Visual C++ 2015–2022 Redistributable (x64). The server and settings app are 64-bit; the x86 redistributable is a separate package and does not substitute for it. If you cannot switch to the IME, the server keeps exiting, or the settings window closes immediately, install that first.
What it does
- Chinese input: full pinyin, double pinyin (Xiaohe / Ziranma / Shoudao / Microsoft), Wubi 86
- Japanese input: romaji, with hiragana, katakana and dictionary candidates; also available as a temporary mode from Chinese
- Helpcode (形码) filtering on pinyin schemes: five tables, single- and double-code
- Optional cloud candidates, and AI suggestions via DeepSeek / OpenAI / SiliconFlow / Groq
- English-Chinese glosses in the vertical candidate window
- Mixed Chinese-English input, emoji and kaomoji, a dedicated English candidate mode
- Voice input with streaming recognition and optional cleanup
- Handwriting, on-screen keyboard, floating toolbar, clipboard history
- User dictionary management, candidate frequency tuning, skins with light and dark variants
Privacy
An input method sees every keystroke, so the boundaries are stated explicitly in PRIVACY.md: which features reach the network, what each one sends, what the defaults are, and how to turn each off.
Two things worth knowing up front. Cloud candidates are on by default — the composition spelling goes to Google's input-tools service, and it is the only network feature that works without you supplying a credential. API tokens are stored in plain text in config.toml, unlike macOS and Linux which use the Keychain and Secret Service.
There is no telemetry, analytics or crash reporting of any kind.
Building and contributing
CONTRIBUTING.md has the environment, the build order and what to run before opening a pull request. Contributions do not have to be code — dictionary entries, documentation, icons and compatibility testing all count, and the recruiting page lists them by area.
Note that most issues, documentation and code comments are in Chinese. English pull requests and issues are welcome.
Licence
GPL-3.0. See LICENSE and THIRD_PARTY_NOTICES.txt.