feat: add secure remote channel media

src/main/channels/wechat-sidecar-entry.test.ts

@@ -13,6 +13,7 @@ const originalParentPort = Object.getOwnPropertyDescriptor(
   process,
   'parentPort'
 )
+const originalFetch = global.fetch
 
 afterEach(() => {
   if (originalParentPort) {
@@ -20,6 +21,7 @@ afterEach(() => {
   } else {
     delete (process as Partial<NodeJS.Process>).parentPort
   }
+  global.fetch = originalFetch
   vi.resetModules()
 })
 
@@ -38,4 +40,36 @@ describe('Weixin utility-process entry', () => {
       { type: 'status', status: 'stopped' }
     ])
   })
+
+  it('does not follow API redirects outside Tencent Weixin hosts', async () => {
+    const parentPort = new FakeParentPort()
+    Object.defineProperty(process, 'parentPort', {
+      configurable: true,
+      value: parentPort
+    })
+    global.fetch = vi.fn(async () =>
+      new Response(null, {
+        status: 307,
+        headers: {
+          location: 'https://attacker.example/collect'
+        }
+      })
+    ) as typeof fetch
+    await import('./wechat-sidecar')
+
+    parentPort.emit('message', {
+      data: { type: 'start_login' }
+    })
+
+    await vi.waitFor(() =>
+      expect(parentPort.messages).toContainEqual(
+        expect.objectContaining({
+          type: 'status',
+          status: 'failed',
+          detail: expect.stringContaining('不受信任')
+        })
+      )
+    )
+    expect(fetch).toHaveBeenCalledOnce()
+  })
 })