Files
msime-windows/server
Evan Hu 205cafa4f5 fix(skin): @import 剥离只匹配真正的 at-rule;补转义绕过的不变量说明与用例
自查时发现的两处。

**@import 匹配过宽会损坏合法皮肤。** 此前在任意位置匹配 `@import`,于是 `.a{content:"@import //x";color:red}` 会被从 `@` 切到该声明的分号,留下一个未闭合的字符串和一份坏掉的样式表——为了保护皮肤反而弄坏了一个本来没问题的皮肤。改成只在 at-rule 能出现的位置匹配:样式表开头,或 `;` / `}` 之后;并要求关键字后面不是字母数字,避免 `@importantthing` 被当成 `@import`。

**CSS 转义不是漏洞,但原因不显然,值得钉死。** 样式表可以写 `url("https:\/\/host/x.png")`,浏览器解转义后得到一个可用的远程 URL,而字面文本里没有 `://`,分类器给出的是 Embed 而不是 Drop。这是安全的,但安全性来自 Embed 能产出什么:要么把文件内联成 data: 负载,要么回退到 candidate-skins 虚拟主机下的 URL,两者都无法命名皮肤作者选定的 origin。转义过的 `..` 同理——它以字面转义文本的形式进入文件系统查找,不会穿越,也永远不会被写回文档。

也就是说,真正保护候选窗的不变量是「Embed 永不产出攻击者命名的 origin」,而不是「Drop 拦住了远程 URL 的每一种写法」。把这条写进头文件,并补一个用例钉住「转义写法永远不落到 Keep」——将来若有人改动 Embed 的回退逻辑让它原样输出 URL,这个洞会重新打开,用例会先失败。

本机以 -Wall -Wextra -Wpedantic -Werror + ASan/UBSan 编译运行 8/8 通过,portable 目标经 CMake + ctest 验证,clang-format 干净。
2026-09-06 19:33:39 +09:00
..
2026-03-12 01:34:41 +08:00
2025-04-16 02:03:11 +08:00
2025-11-10 21:10:36 +08:00

Metasequoia IME Server(水杉输入法 Server 端)

This is the server end of MSIME-Windows.

How to build

Prerequisites

  • Visual Studio 2026
  • CMake
  • vcpkg
  • Python3.10+
  • Boost
  • Node.js and pnpm 10 (settings page build)

Make sure vcpkg and Boost are installed by Scoop.

Build steps(For Dev)

Clone the product and provision the reviewed dictionary release from its root:

git clone --recursive https://github.com/metasequoiaime/MSIME-Windows.git
cd MSIME-Windows
python scripts/product_lock.py fetch-dictionaries --staging-root .
if ($LASTEXITCODE -ne 0) { throw 'Dictionary verification failed' }
$devLocalData = Join-Path $PWD 'build/dev-local'
$devData = Join-Path $devLocalData 'metasequoiaime'
New-Item -ItemType Directory -Force $devData | Out-Null
Copy-Item MetasequoiaImeDict/out/* $devData -Force
Copy-Item vendor/MetasequoiaImeEngine/helpcode/helpcodes $devData -Recurse -Force
Copy-Item server/assets/tables/* $devData -Force
Copy-Item server/assets/config/config.toml $devData -Force
Push-Location ui-html/webview2/settings/ime-settings
try {
    pnpm install --frozen-lockfile
    if ($LASTEXITCODE -ne 0) { throw 'Settings dependencies failed' }
    pnpm build
    if ($LASTEXITCODE -ne 0) { throw 'Settings page build failed' }
} finally { Pop-Location }
$devWebview = Join-Path $devData 'html/webview2'
New-Item -ItemType Directory -Force $devWebview | Out-Null
foreach ($part in @('shared', 'candwnd', 'ftb', 'menu')) {
    Copy-Item "ui-html/webview2/$part" $devWebview -Recurse -Force
}
$devSettings = Join-Path $devWebview 'settings/ime-settings'
New-Item -ItemType Directory -Force $devSettings | Out-Null
Copy-Item ui-html/webview2/settings/ime-settings/dist $devSettings -Recurse -Force
python server/scripts/prepare_env.py
if ($LASTEXITCODE -ne 0) { throw 'Server environment setup failed' }
$env:LOCALAPPDATA = $devLocalData
$env:METASEQUOIA_IME_DATA_DIR = $devData
cd server

Use a dedicated PowerShell terminal. These steps stage the same locked data as CI and the current product pages in a separate development directory. Both LOCALAPPDATA (Windows config/pages) and METASEQUOIA_IME_DATA_DIR (Engine data) are set for that terminal; setting only the latter would still use installed Windows configuration and pages. Close the terminal after development. Dictionary source changes belong in Engine's dictionary/; use its root build_profile.py to build data instead of calling internal stages in the archived Dict repository.

Then, build and run,

.\scripts\lcompile.ps1
.\scripts\lrun.ps1

If you want to build and run in one step, run the following command,

.\scripts\llaunch.ps1

Watchdog

MetasequoiaImeWatchdog.exe is built next to the server. Starting the server directly also starts the watchdog, which monitors the server from the same directory and restarts it after an unexpected exit. Repeated early crashes use an exponential restart delay (up to 30 seconds) to avoid a restart storm.

The developer terminate shortcut stops both processes. The restart shortcut asks the watchdog to start a fresh server after the current process exits.

English prefix candidates

Place english.db next to msime.db in %LOCALAPPDATA%\metasequoiaime. Set general.cn_en_mixed_input = true in config.toml to enable asynchronous English prefix candidates for Quanpin and Shuangpin.

Developer Shortcuts

The server process includes a few built-in global shortcuts that are useful during development:

  • Ctrl + Shift + Alt + T
    • terminate MetasequoiaImeServer immediately
  • Ctrl + Shift + Alt + R
    • restart MetasequoiaImeServer
  • Ctrl + Shift + Alt + C
    • clear IME engine cache
  • Ctrl + Shift + Alt + 1 to Ctrl + Shift + Alt + 8
    • delete candidate 1 to 8 from the current candidate window
    • this only works while the candidate window is visible

Screenshots

Shared voice providers

The server links Engine VoiceCapture and Voice. WAV encoding and batch transcription/polish codecs come from the public library; Windows keeps provider configuration, SiliconFlow padding/retry behavior and Doubao streaming. Batch uploads are bounded to 20 MiB and responses to 1 MiB. Failed or empty polish responses retain the original transcript.

本地 Release 构建脚本可通过 -ManifestTool <mt.exe 路径> 使用其他 Windows SDK;未指定时沿用现有 SDK 路径。配置、编译或 manifest 嵌入失败都会中止,避免安装器收集旧产物。