Copilot commented on code in PR #887:
URL: 
https://github.com/apache/rocketmq-dashboard/pull/887#discussion_r3708444639


##########
web/src/pages/instance/topic.tsx:
##########
@@ -96,6 +96,49 @@ const TYPE_OPTIONS = [
 // ─── Perm label ───────────────────────────────────────────────────
 const PERM_LABEL: Record<string, string> = { RW: '读写', RO: '只读', WO: '只写' };
 
+const TOPIC_EXPORT_COLUMNS: Array<{ header: string; value: (topic: Topic) => 
unknown }> = [
+  { header: 'Name', value: (topic) => topic.name },
+  { header: 'Namespace', value: (topic) => topic.namespace },
+  { header: 'Type', value: (topic) => topic.type },
+  { header: 'Cluster ID', value: (topic) => topic.clusterId },
+  { header: 'Write Queues', value: (topic) => topic.writeQueues },
+  { header: 'Read Queues', value: (topic) => topic.readQueues },
+  { header: 'Permission', value: (topic) => topic.perm },
+  { header: 'Message Count', value: (topic) => topic.messageCount },
+  { header: 'TPS', value: (topic) => topic.tps },
+  { header: 'Consumer Groups', value: (topic) => topic.consumerGroupCount },
+  { header: 'Remark', value: (topic) => topic.remark },
+  { header: 'Created At', value: (topic) => topic.createdAt },
+  { header: 'Updated At', value: (topic) => topic.updatedAt },
+];
+
+const escapeCsvCell = (value: unknown) => {
+  const text = value == null ? '' : String(value);
+  const formulaSafeText = /^[=+\-@]/.test(text) ? `'${text}` : text;
+  return `"${formulaSafeText.replace(/"/g, '""')}"`;

Review Comment:
   CSV 单元格的公式注入防护与仓库其他导出实现不一致:DLQ 导出会防护以 \t 或 \r 开头的值(也会被 Excel 识别为公式),但这里仅匹配 
[=+\-@],可能遗漏攻击面。建议与 dlq.tsx 的规则保持一致。



##########
web/src/pages/instance/__tests__/TopicPage.test.tsx:
##########
@@ -49,6 +49,14 @@ beforeAll(() => {
       dispatchEvent: vi.fn(),
     })),
   });
+  Object.defineProperty(URL, 'createObjectURL', {
+    writable: true,
+    value: vi.fn(() => 'blob:topic-export'),
+  });

Review Comment:
   这里用 Object.defineProperty 覆盖 URL.createObjectURL 但未设置 
configurable:true;defineProperty 默认 configurable=false,可能导致同一 worker 
中其他测试文件无法再次重定义该属性(仓库里其他测试通常会 configurable:true)。建议显式设置 configurable:true。
   
   This issue also appears on line 56 of the same file.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to