维护者确认:PR #4252 测试中的 dynamic-eval 需安全确认
- Dominant language
- TypeScript
- Stars
- 2.7k
- Forks
- 395
- Avg merge
- 21h 48m
- Merged PRs (30d)
- 776
Description
PR https://github.com/makecindy/cindy/pull/4252 把移动端 schedule 镜像失效改成幂等,并让设备详情页按 generation 只消费一次,修复 Android 冷启动 Maximum update depth 崩溃。
维护者确认门触发:
- product:命中 `apps/mobile/app/devices/[deviceId].tsx` 与 `apps/mobile/src/scheduler/remoteScheduleEvents.ts`。完整 diff 是内部崩溃修复(幂等 emit + effect consume-once),不改变用户看得见的外观、布局、文案或交互流向,按既有语义不作为产品确认项。
- security:测试 `apps/mobile/src/__tests__/deviceScheduleVisibility.test.ts` 用 `new Function` 抽出并执行详情页 useEffect 源码,命中危险写法 hard 项(dynamic-eval)。该类别不吃 bugfix / 测试桩语义豁免,需要维护者明确确认。
请维护者直接在 PR 上 Approve 放行;若作者需要改测试写法,请 Request Changes。
---
关联 PR:#4252(作者 @guyong-zapo);本 issue 由 review-pr 流程自动创建,用于先讨论该 PR 涉及的安全敏感改动,维护者确认后 PR 会恢复推进。
Contributor guide
Research direction
Start with PR #4252 and review apps/mobile/app/devices/[deviceId].tsx, apps/mobile/src/scheduler/remoteScheduleEvents.ts, and apps/mobile/src/__tests__/deviceScheduleVisibility.test.ts. Check the test's use of new Function and the related crash fix; the issue is done when a maintainer approves the security-sensitive test or requests changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- mobile, security, testing
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100