Files
msime-windows/server
Evan Hu 680fdfa648 fix(skin): 丢弃第三方皮肤 CSS 里的远程引用,不再原样注入候选窗
皮肤是用户往 %LOCALAPPDATA%\metasequoiaime\skins 里丢的文件夹,是彻头彻尾的第三方内容,而它的 CSS 会被内联进候选窗文档。此前 IsRewritableSkinCssUrl() 对含 :// 的 URL 直接返回 false,而 false 分支把原始 url("…") 原封不动写回样式表——也就是说 `background-image: url(https://attacker/beacon.png)` 会在每一次候选窗渲染时向外发一个请求,泄露「此人此刻正在打字」以及 IP。这直接推翻了 PRIVACY.md 的 "Local conversion never contacts the network",而那句话是这个项目最强的信任资产。

问题出在这个判断只有两态:不可重写就等于放行。实际上有三类:

- Embed——皮肤包内的相对路径,读文件内联;
- Keep——本身就是惰性的 data: 负载和文档内 #fragment 引用,照原样保留;
- Drop——任何会让候选窗向皮肤包之外取数据的写法。丢掉 URL 后声明不完整,CSS 会整条丢弃,这正是想要的结果。

Drop 覆盖 http/https/ftp 等带 scheme 的、协议相对的 //host/x(不写 scheme 但照样出网)、路径穿越,以及会逃出皮肤包的绝对路径。

url() 不是唯一入口:`@import "https://…"` 根本不含 url() token,扫描器永远看不到它。补 StripRemoteImports() 做前置处理,只删远程 @import,本地的保留。

skin.preview 来自皮肤自己的 skin.toml,此前直接进 EmbedSkinCssUrl。现在同样过一遍分类,不因为它是通过 manifest 字段到达就被信任。

判断逻辑抽到 server/src/webview2/skin_css_policy.{h,cpp},不依赖任何 Windows API,配 6 个用例覆盖三类判定与两种 @import 写法。本机以 -Wall -Wextra 编译运行全部通过。
2026-09-06 18:05:09 +09:00
..
2026-03-12 01:34:41 +08:00
2025-04-16 02:03:11 +08:00
2025-11-10 21:10:36 +08:00

Metasequoia IME Server(水杉输入法 Server 端)

This is the server end of MSIME-Windows.

How to build

Prerequisites

  • Visual Studio 2026
  • CMake
  • vcpkg
  • Python3.10+
  • Boost
  • Node.js and pnpm 10 (settings page build)

Make sure vcpkg and Boost are installed by Scoop.

Build steps(For Dev)

Clone the product and provision the reviewed dictionary release from its root:

git clone --recursive https://github.com/metasequoiaime/MSIME-Windows.git
cd MSIME-Windows
python scripts/product_lock.py fetch-dictionaries --staging-root .
if ($LASTEXITCODE -ne 0) { throw 'Dictionary verification failed' }
$devLocalData = Join-Path $PWD 'build/dev-local'
$devData = Join-Path $devLocalData 'metasequoiaime'
New-Item -ItemType Directory -Force $devData | Out-Null
Copy-Item MetasequoiaImeDict/out/* $devData -Force
Copy-Item vendor/MetasequoiaImeEngine/helpcode/helpcodes $devData -Recurse -Force
Copy-Item server/assets/tables/* $devData -Force
Copy-Item server/assets/config/config.toml $devData -Force
Push-Location ui-html/webview2/settings/ime-settings
try {
    pnpm install --frozen-lockfile
    if ($LASTEXITCODE -ne 0) { throw 'Settings dependencies failed' }
    pnpm build
    if ($LASTEXITCODE -ne 0) { throw 'Settings page build failed' }
} finally { Pop-Location }
$devWebview = Join-Path $devData 'html/webview2'
New-Item -ItemType Directory -Force $devWebview | Out-Null
foreach ($part in @('shared', 'candwnd', 'ftb', 'menu')) {
    Copy-Item "ui-html/webview2/$part" $devWebview -Recurse -Force
}
$devSettings = Join-Path $devWebview 'settings/ime-settings'
New-Item -ItemType Directory -Force $devSettings | Out-Null
Copy-Item ui-html/webview2/settings/ime-settings/dist $devSettings -Recurse -Force
python server/scripts/prepare_env.py
if ($LASTEXITCODE -ne 0) { throw 'Server environment setup failed' }
$env:LOCALAPPDATA = $devLocalData
$env:METASEQUOIA_IME_DATA_DIR = $devData
cd server

Use a dedicated PowerShell terminal. These steps stage the same locked data as CI and the current product pages in a separate development directory. Both LOCALAPPDATA (Windows config/pages) and METASEQUOIA_IME_DATA_DIR (Engine data) are set for that terminal; setting only the latter would still use installed Windows configuration and pages. Close the terminal after development. Dictionary source changes belong in Engine's dictionary/; use its root build_profile.py to build data instead of calling internal stages in the archived Dict repository.

Then, build and run,

.\scripts\lcompile.ps1
.\scripts\lrun.ps1

If you want to build and run in one step, run the following command,

.\scripts\llaunch.ps1

Watchdog

MetasequoiaImeWatchdog.exe is built next to the server. Starting the server directly also starts the watchdog, which monitors the server from the same directory and restarts it after an unexpected exit. Repeated early crashes use an exponential restart delay (up to 30 seconds) to avoid a restart storm.

The developer terminate shortcut stops both processes. The restart shortcut asks the watchdog to start a fresh server after the current process exits.

English prefix candidates

Place english.db next to msime.db in %LOCALAPPDATA%\metasequoiaime. Set general.cn_en_mixed_input = true in config.toml to enable asynchronous English prefix candidates for Quanpin and Shuangpin.

Developer Shortcuts

The server process includes a few built-in global shortcuts that are useful during development:

  • Ctrl + Shift + Alt + T
    • terminate MetasequoiaImeServer immediately
  • Ctrl + Shift + Alt + R
    • restart MetasequoiaImeServer
  • Ctrl + Shift + Alt + C
    • clear IME engine cache
  • Ctrl + Shift + Alt + 1 to Ctrl + Shift + Alt + 8
    • delete candidate 1 to 8 from the current candidate window
    • this only works while the candidate window is visible

Screenshots

Shared voice providers

The server links Engine VoiceCapture and Voice. WAV encoding and batch transcription/polish codecs come from the public library; Windows keeps provider configuration, SiliconFlow padding/retry behavior and Doubao streaming. Batch uploads are bounded to 20 MiB and responses to 1 MiB. Failed or empty polish responses retain the original transcript.

本地 Release 构建脚本可通过 -ManifestTool <mt.exe 路径> 使用其他 Windows SDK;未指定时沿用现有 SDK 路径。配置、编译或 manifest 嵌入失败都会中止,避免安装器收集旧产物。