From 5a35cb999d871c9f3f5331898018d0f2031f9259 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Albert=20M=C3=BCller?= Date: Thu, 6 Aug 2026 02:12:14 +0300 Subject: [PATCH] Potential fix for code scanning alert no. 6: Clear text storage of sensitive information MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Albert Müller --- others/translate/translate.js | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/others/translate/translate.js b/others/translate/translate.js index 8413598..4601f80 100644 --- a/others/translate/translate.js +++ b/others/translate/translate.js @@ -191,8 +191,18 @@ const TranslateApp = { } } - // 保存到本地存储 - localStorage.setItem('translateApiConfig', JSON.stringify(apiConfig)); + // 保存到本地存储（移除敏感字段，避免明文持久化） + const safeApiConfig = JSON.parse(JSON.stringify(apiConfig)); + if (safeApiConfig.baidu) { + delete safeApiConfig.baidu.secretKey; + } + if (safeApiConfig.youdao) { + delete safeApiConfig.youdao.secretKey; + } + if (safeApiConfig.google) { + delete safeApiConfig.google.apiKey; + } + localStorage.setItem('translateApiConfig', JSON.stringify(safeApiConfig)); return true; } catch (e) { @@ -272,8 +282,18 @@ const TranslateApp = { TranslateAPI.setService(currentService); } - // 保存到本地存储 - localStorage.setItem('translateApiConfig', JSON.stringify(apiConfig)); + // 保存到本地存储（移除敏感字段，避免明文持久化） + const safeApiConfig = JSON.parse(JSON.stringify(apiConfig)); + if (safeApiConfig.baidu) { + delete safeApiConfig.baidu.secretKey; + } + if (safeApiConfig.youdao) { + delete safeApiConfig.youdao.secretKey; + } + if (safeApiConfig.google) { + delete safeApiConfig.google.apiKey; + } + localStorage.setItem('translateApiConfig', JSON.stringify(safeApiConfig)); // 更新API状态 this.checkApiStatus(); @@ -1300,7 +1320,8 @@ document.addEventListener('DOMContentLoaded', () => { const baiduAppId = baiduAppIdElement.value; const baiduSecretKey = baiduSecretKeyElement.value; if (baiduAppId && baiduSecretKey) { - TranslateApp.saveApiConfig('api', 'baidu', baiduAppId, baiduSecretKey); + // 不在本地存储中持久化密钥，仅在当前运行时设置 + TranslateApp.saveApiConfig('api', 'baidu', baiduAppId, ''); TranslateAPI.setApiKey('baidu', baiduAppId, baiduSecretKey); } } @@ -1312,7 +1333,8 @@ document.addEventListener('DOMContentLoaded', () => { const youdaoAppId = youdaoAppIdElement.value; const youdaoSecretKey = youdaoSecretKeyElement.value; if (youdaoAppId && youdaoSecretKey) { - TranslateApp.saveApiConfig('api', 'youdao', youdaoAppId, youdaoSecretKey); + // 不在本地存储中持久化密钥，仅在当前运行时设置 + TranslateApp.saveApiConfig('api', 'youdao', youdaoAppId, ''); TranslateAPI.setApiKey('youdao', youdaoAppId, youdaoSecretKey); } }