fix(security): validate presigned URL scheme before PUT / download

yujiawei's P1: `uploadMcpIconReal` and `uploadFile` used the backend-
returned `presigned_url` directly with no scheme/host check; likewise
`downloadSkill` assigned `result.url` to `anchor.href` without a scheme
check. A misconfigured or compromised marketplace could point the
browser at `javascript:`, `data:`, `file:`, or an internal-only host.

Both packages now gate every backend-supplied external URL through a
tiny checker that only accepts:
- `https://…` (production case), or
- `http://localhost` / `http://127.0.0.1` (dev proxy)

Everything else throws before the network call happens. Credential
leakage was already covered (raw axios / no interceptors on the PUT);
this closes the destination-side gap.

Refs: PR Mininglamp-OSS#851 review by @yujiawei

Author: lsc

packages/dmworkmcp/src/api/mcpService.ts

@@ -64,6 +64,25 @@ function delay<T>(value: T, ms = MOCK_DELAY_MS): Promise<T> {
   return new Promise((resolve) => setTimeout(() => resolve(value), ms));
 }
 
+/**
+ * Reject presigned upload / download URLs whose scheme is not http(s), or
+ * whose http-scheme host is not a loopback (dev proxy). Backend-supplied
+ * URLs are still trusted for the exact host they name, but we refuse to
+ * PUT / GET against `javascript:`, `data:`, `file:` etc. — defense in
+ * depth against a misconfigured or compromised marketplace.
+ */
+function assertSafeUploadURL(raw: string): void {
+  let u: URL;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new Error(t("mcp.create.iconUploadFailed"));
+  }
+  if (u.protocol === "https:") return;
+  if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1")) return;
+  throw new Error(t("mcp.create.iconUploadFailed"));
+}
+
 // ─── Mock implementations ──────────────────────────────────────────────────
 
 function buildCategories(): McpCategory[] {
@@ -553,6 +572,12 @@ async function uploadMcpIconReal(_id: string, file: File): Promise<string> {
     throw new Error(t("mcp.create.iconUploadFailed"));
   }
   const { presigned_url, download_url, headers } = init.data;
+  // Defense-in-depth: the presigned URLs come back from our own marketplace
+  // backend, but any downstream misconfiguration/compromise could point them
+  // at an internal address or a non-HTTPS host. Only allow https:// (or
+  // http:// on localhost for dev proxies).
+  assertSafeUploadURL(presigned_url);
+  assertSafeUploadURL(download_url);
 
   // PUT via raw axios (no interceptors) — the presigned URL points at
   // storage / local proxy, not marketplace, and any Accept-Language /

packages/dmworkskillmarket/src/api/skillApiReal.ts

@@ -126,6 +126,25 @@ function wait(ms: number): Promise<void> {
   return new Promise((resolve) => globalThis.setTimeout(resolve, ms));
 }
 
+/**
+ * Reject presigned upload / download URLs whose scheme is not http(s), or
+ * whose http-scheme host is not loopback. Guards against a compromised or
+ * misconfigured marketplace returning `javascript:` / `data:` / `file:` /
+ * arbitrary internal targets that a browser would otherwise honor
+ * (anchor.href / xhr.open both accept unusual schemes).
+ */
+function assertSafeExternalURL(raw: string): void {
+  let u: URL;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw normalizeError({ code: "invalid_response", message: "URL 无效" });
+  }
+  if (u.protocol === "https:") return;
+  if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1")) return;
+  throw normalizeError({ code: "invalid_response", message: "URL scheme 不允许" });
+}
+
 // ─── Mappers ───────────────────────────────────────────────────────────────
 
 function mapCategory(raw: RawCategory, index: number): Category {
@@ -273,6 +292,7 @@ export async function downloadSkill(id: string): Promise<void> {
   if (!result.url) {
     throw normalizeError({ code: "invalid_response", message: "下载地址无效" });
   }
+  assertSafeExternalURL(result.url);
   const anchor = document.createElement("a");
   anchor.href = result.url;
   anchor.target = "_blank";
@@ -298,6 +318,7 @@ export function initUpload(fileName: string, fileSize: number): Promise<UploadIn
 
 /** Step 2: Upload the file to the pre-signed URL (PUT). */
 export async function uploadFile(presignedUrl: string, file: File, headers?: Record<string, string>, onProgress?: (percent: number) => void): Promise<void> {
+  assertSafeExternalURL(presignedUrl);
   // Use XMLHttpRequest for progress support
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest();