DrSmoothl
369dea582c
NapCat-compatible server-push download: one request answered by a file_info header, N base64 file_chunk frames, then a terminal file_complete. Bytes come from a local file under the stream temp root, an http(s) URL, or a cached image/voice id resolved to its QQ CDN URL. test_download_stream pushes 10 canned frames so a client can validate the transport without touching QQ. Actions: download_file_stream / download_file_image_stream / download_file_record_stream / test_download_stream. Hardened beyond the NapCat original (which streams any local path and follows redirects to anywhere), per three adversarial review passes: - arbitrary-file-read: local reads are fenced inside the stream temp root, realpath-resolved so a symlink can't point out. - SSRF: every URL (incl. each redirect hop, followed manually) is guarded — http(s) only, and neither the literal host nor any resolved address may be private/loopback/link-local; IPv6 is byte-parsed so normalized v4-mapped literals (::ffff:a9fe:a9fe) can't slip past. (DNS rebinding remains a documented residual — needs connect-time peer-IP validation.) - robustness: TTFB-only connect timeout (doesn't cut a large body mid-stream) plus a per-chunk idle watchdog that aborts a stalled source so a hung upstream can't pin a socket; total size capped; non-2xx bodies cancelled; client disconnect aborts via the sink. 501 onebot tests green.
Next Remote Protocol Framework.
Releases · Issues · QQ 群 · Telegram
SnowLuma 是一个基于 TypeScript 的协议转换框架，旨在为 QQ 客户端提供 OneBot v11 标准接口，支持 WebSocket/HTTP 适配、多账号并行及 WebUI 管理。
⚠️ 免责声明：SnowLuma 是独立的第三方互操作项目，与腾讯 / QQ 无任何隶属或授权关系。本项目仅供学习与技术研究，请遵守《QQ 用户协议》及适用法律；软件按"现状"提供、不附带任何担保，使用风险自负。详见
EULA.md。⚠️ Disclaimer: SnowLuma is an independent, third-party interoperability project with no affiliation with or endorsement by Tencent / QQ, provided for study and research only, "as is" without warranty. Comply with the QQ User Agreement and applicable law; use at your own risk. See
EULA.md.
特性
- OneBot v11 兼容：支持文本、音视频、Markdown、JSON 等消息格式。
- 高性能架构：TypeScript 全栈，基于 pnpm monorepo 管理，核心逻辑分离。
- 现代化管理：内置 WebUI 面板，支持实时日志、密码热更、多账号管理。
- 多适配器支持：WebSocket (Server/Client)、HTTP (Server/Post)。
- 数据持久化：使用 SQLite 存储好友、群组等关系数据。
快速开始
- 从 Releases 下载最新发布包并解压。
- 运行
./launcher.bat(Windows) 或./launcher.sh(Linux)。 - 访问
http://localhost:5099(初始账号admin，密码见控制台输出)。
许可 / License
SnowLuma 采用 源码可见非商业许可（SnowLuma Source-Available Non-Commercial License），见 LICENSE。这不是 OSI 开源许可：源码公开供查看、学习与非商业自托管，但禁止任何商业使用（出售、转售、付费托管 / 代搭 / 代运营等），公开发布修改版须事先书面授权。随附的原生附加组件（snowluma-*.node 等）为专有组件，不在本许可范围内。二进制发行包另受 EULA.md 约束；商业授权请联系 motricseven@foxmail.com。参与贡献请阅读 CONTRIBUTING.md。
SnowLuma is under a source-available, non-commercial license (see LICENSE) — NOT an OSI open-source license. The source is published for study and non-commercial self-hosting; commercial use is prohibited without prior written permission, and the bundled native addon (snowluma-*.node) is proprietary and not covered by this license.
鸣谢
参考了 LagrangeV2 的协议定义与 NapCatQQ 的实现思路。