Merge branch 'dev' into master

kernel/util/pandoc.go

@@ -211,6 +211,71 @@ func IsValidPandocBin(binPath string) bool {
 		return false
 	}
 
+	// 解析符号链接
+	if real, err := filepath.EvalSymlinks(binPath); err == nil {
+		binPath = real
+	}
+
+	// 文件信息检查
+	fi, err := os.Stat(binPath)
+	if err != nil || fi.IsDir() || !fi.Mode().IsRegular() {
+		return false
+	}
+
+	// 在 Unix 上要求拥有可执行权限
+	if !gulu.OS.IsWindows() {
+		if fi.Mode().Perm()&0111 == 0 {
+			return false
+		}
+	}
+
+	// 读取文件头判断是否为二进制并排除脚本（#!）
+	f, err := os.Open(binPath)
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+
+	header := make([]byte, 16)
+	n, _ := f.Read(header)
+	header = header[:n]
+
+	// 拒绝以 shebang 开头的脚本
+	if bytes.HasPrefix(header, []byte("#!")) {
+		return false
+	}
+
+	isBin := false
+	// 常见二进制魔数：ELF, PE("MZ"), Mach-O/FAT
+	if len(header) >= 4 {
+		switch {
+		case bytes.Equal(header[:4], []byte{0x7f, 'E', 'L', 'F'}):
+			isBin = true // ELF
+		case bytes.Equal(header[:4], []byte{0xfe, 0xed, 0xfa, 0xce}):
+			isBin = true // Mach-O
+		case bytes.Equal(header[:4], []byte{0xce, 0xfa, 0xed, 0xfe}):
+			isBin = true // Mach-O (swapped)
+		case bytes.Equal(header[:4], []byte{0xca, 0xfe, 0xba, 0xbe}):
+			isBin = true // FAT
+		}
+	}
+	// PE only needs first 2 bytes "MZ"
+	if !isBin && len(header) >= 2 && bytes.Equal(header[:2], []byte{'M', 'Z'}) {
+		isBin = true
+	}
+
+	// Windows 上允许 .exe 文件（作为补充判断）
+	if !isBin && gulu.OS.IsWindows() {
+		ext := strings.ToLower(filepath.Ext(binPath))
+		if ext == ".exe" {
+			isBin = true
+		}
+	}
+
+	if !isBin {
+		return false
+	}
+
 	cmd := exec.Command(binPath, "--version")
 	gulu.CmdAttr(cmd)
 	data, err := cmd.CombinedOutput()

kernel/util/websocket.go

@@ -26,7 +26,7 @@ import (
 )
 
 var (
-	WebSocketServer = melody.New()
+	WebSocketServer *melody.Melody
 
 	// map[string]map[string]*melody.Session{}
 	sessions = sync.Map{} // {appId, {sessionId, session}}

kernel/util/working.go

@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"math/rand"
 	"mime"
+	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -72,6 +73,7 @@ func initEnvVars() {
 var (
 	bootProgress = atomic.Int32{} // 启动进度，从 0 到 100
 	bootDetails  string           // 启动细节描述
+	HttpServer   *http.Server     // HTTP 伺服器实例
 	HttpServing  = false          // 是否 HTTP 伺服已经可用
 )
 
@@ -101,7 +103,7 @@ func Boot() {
 	readOnly := flag.String("readonly", "false", "read-only mode")
 	accessAuthCode := flag.String("accessAuthCode", "", "access auth code")
 	ssl := flag.Bool("ssl", false, "for https and wss")
-	lang := flag.String("lang", "", "ar_SA/de_DE/en_US/es_ES/fr_FR/he_IL/it_IT/ja_JP/pl_PL/pt_BR/ru_RU/tr_TR/zh_CHT/zh_CN")
+	lang := flag.String("lang", "", "ar_SA/de_DE/en_US/es_ES/fr_FR/he_IL/it_IT/ja_JP/ko_KR/pl_PL/pt_BR/ru_RU/tr_TR/zh_CHT/zh_CN")
 	mode := flag.String("mode", "prod", "dev/prod")
 	flag.Parse()
 
@@ -140,7 +142,7 @@ func Boot() {
 				// The access authorization code command line parameter must be set when deploying via Docker https://github.com/siyuan-note/siyuan/issues/9328
 				fmt.Printf("the access authorization code command line parameter (--accessAuthCode) must be set when deploying via Docker\n")
 				fmt.Printf("or you can set the SIYUAN_ACCESS_AUTH_CODE env var")
-				os.Exit(1)
+				os.Exit(logging.ExitCodeSecurityRisk)
 			}
 		}
 	}
@@ -345,10 +347,19 @@ func ReadWorkspacePaths() (ret []string, err error) {
 	}
 
 	var tmp []string
+	workspaceBaseDir := filepath.Dir(HomeDir)
 	for _, d := range ret {
+		if ContainerIOS == Container && strings.Contains(d, "/Documents/") {
+			// iOS 端沙箱路径会变化，需要转换为相对路径再拼接当前沙箱中的工作空间基路径
+			d = d[strings.Index(d, "/Documents/")+len("/Documents/"):]
+			d = filepath.Join(workspaceBaseDir, d)
+		}
+
 		d = strings.TrimRight(d, " \t\n") // 去掉工作空间路径尾部空格 https://github.com/siyuan-note/siyuan/issues/6353
 		if gulu.File.IsDir(d) {
 			tmp = append(tmp, d)
+		} else {
+			logging.LogWarnf("workspace path [%s] is not a dir", d)
 		}
 	}
 	ret = tmp

kernel/util/working_mobile.go

@@ -117,6 +117,7 @@ func initWorkspaceDirMobile(workspaceBaseDir string) {
 
 	var workspacePaths []string
 	if !gulu.File.IsExist(workspaceConf) {
+		logging.LogInfof("workspace conf [%s] not exist, use the default workspace [%s]", workspaceConf, defaultWorkspaceDir)
 		WorkspaceDir = defaultWorkspaceDir
 		if !gulu.File.IsDir(WorkspaceDir) {
 			logging.LogWarnf("use the default workspace [%s] since the specified workspace [%s] is not a dir", WorkspaceDir, defaultWorkspaceDir)
@@ -125,6 +126,7 @@ func initWorkspaceDirMobile(workspaceBaseDir string) {
 		workspacePaths = append(workspacePaths, WorkspaceDir)
 	} else {
 		workspacePaths, _ = ReadWorkspacePaths()
+
 		if 0 < len(workspacePaths) {
 			WorkspaceDir = workspacePaths[len(workspacePaths)-1]
 			if !gulu.File.IsDir(WorkspaceDir) {