fix(web-ui): validate provider modal input

cli.js

@@ -3455,6 +3455,9 @@ function addProviderToConfig(params = {}) {
     if (!isValidProviderName(name)) {
         return { error: '名称仅支持字母/数字/._-' };
     }
+    if (!isValidHttpUrl(normalizeBaseUrl(url))) {
+        return { error: 'URL 仅支持 http/https' };
+    }
     if (isReservedProviderNameForCreation(name)) {
         return { error: 'local provider 为系统保留名称，不可新增' };
     }
@@ -3533,6 +3536,9 @@ function updateProviderInConfig(params = {}) {
     if (!url && key === undefined) {
         return { error: 'URL 或密钥至少填写一项' };
     }
+    if (url && !isValidHttpUrl(normalizeBaseUrl(url))) {
+        return { error: 'URL 仅支持 http/https' };
+    }
     if (isNonEditableProvider(name) && !allowManaged) {
         if (isDefaultLocalProvider(name)) {
             return { error: 'local provider 为系统保留项，不可编辑' };
@@ -8228,7 +8234,7 @@ function cmdUseModel(modelName, silent = false) {
 // 添加提供商
 function cmdAdd(name, baseUrl, apiKey, silent = false) {
     const providerName = typeof name === 'string' ? name.trim() : '';
-    const providerBaseUrl = typeof baseUrl === 'string' ? baseUrl.trim() : '';
+    const providerBaseUrl = normalizeBaseUrl(baseUrl);
 
     if (!providerName || !providerBaseUrl) {
         if (!silent) {
@@ -8250,6 +8256,10 @@ function cmdAdd(name, baseUrl, apiKey, silent = false) {
         if (!silent) console.error('错误: codexmate-proxy 为保留名称，不可手动添加');
         throw new Error('codexmate-proxy 为保留名称，不可手动添加');
     }
+    if (!isValidHttpUrl(providerBaseUrl)) {
+        if (!silent) console.error('错误: URL 仅支持 http/https');
+        throw new Error('URL 仅支持 http/https');
+    }
 
     const config = readConfig();
     if (config.model_providers && config.model_providers[providerName]) {
@@ -8307,6 +8317,7 @@ function cmdDelete(name, silent = false) {
 // 更新提供商
 function cmdUpdate(name, baseUrl, apiKey, silent = false, options = {}) {
     const allowManaged = !!(options && options.allowManaged);
+    const normalizedBaseUrl = baseUrl === undefined ? undefined : normalizeBaseUrl(baseUrl);
     if (!name) {
         if (!silent) console.error('错误: 提供商名称必填');
         throw new Error('提供商名称必填');
@@ -8335,6 +8346,10 @@ function cmdUpdate(name, baseUrl, apiKey, silent = false, options = {}) {
         if (!silent) console.error('错误: 无法找到提供商配置块');
         throw new Error('无法找到提供商配置块');
     }
+    if (normalizedBaseUrl !== undefined && !isValidHttpUrl(normalizedBaseUrl)) {
+        if (!silent) console.error('错误: URL 仅支持 http/https');
+        throw new Error('URL 仅支持 http/https');
+    }
 
     const replaceTomlStringField = (block, fieldName, rawValue) => {
         const safeValue = escapeTomlBasicString(rawValue);
@@ -8460,8 +8475,8 @@ function cmdUpdate(name, baseUrl, apiKey, silent = false, options = {}) {
     for (const range of sorted) {
         const providerBlock = newContent.slice(range.start, range.end);
         let updatedBlock = providerBlock;
-        if (baseUrl) {
-            updatedBlock = replaceTomlStringField(updatedBlock, 'base_url', baseUrl);
+        if (normalizedBaseUrl) {
+            updatedBlock = replaceTomlStringField(updatedBlock, 'base_url', normalizedBaseUrl);
         }
         if (apiKey !== undefined) {
             updatedBlock = replaceTomlStringField(updatedBlock, 'preferred_auth_method', apiKey);

tests/e2e/test-config.js

@@ -311,11 +311,19 @@ preferred_auth_method = "shadow-key"
 
     const addProviderInvalidName = await api('add-provider', { name: 'bad name', url: mockProviderUrl });
     assert(addProviderInvalidName.error, 'add-provider should reject invalid provider name');
+    const addProviderInvalidUrl = await api('add-provider', { name: 'bad-url', url: 'not-a-url' });
+    assert(addProviderInvalidUrl.error, 'add-provider should reject invalid provider url');
+    const cliAddInvalidUrl = runSync(node, [cliPath, 'add', 'cli-bad-url', 'not-a-url'], { env });
+    assert(cliAddInvalidUrl.status !== 0, 'cli add should reject invalid provider url');
     const apiListAfterInvalidName = await api('list');
     assert(
         !apiListAfterInvalidName.providers.some((item) => item && item.name === 'bad name'),
         'add-provider invalid name should not pollute provider list'
     );
+    assert(
+        !apiListAfterInvalidName.providers.some((item) => item && item.name === 'bad-url'),
+        'add-provider invalid url should not pollute provider list'
+    );
     const apiStatusAfterInvalidName = await api('status');
     assert(apiStatusAfterInvalidName.provider, 'status should remain readable after invalid add-provider');
 
@@ -1356,6 +1364,8 @@ preferred_auth_method = "shadow-key"
 
     // ========== Update Provider Tests ==========
     const updatedUrl = `${mockProviderUrl}/v2`;
+    const updateProviderInvalidUrl = await api('update-provider', { name: 'e2e-api', url: 'ftp://bad.example.com' });
+    assert(updateProviderInvalidUrl.error, 'update-provider should reject invalid provider url');
     const updateProvider = await api('update-provider', { name: 'e2e-api', url: updatedUrl, key: 'sk-e2e-api-upd' });
     assert(updateProvider.success === true, 'update-provider failed');
 

tests/unit/provider-switch-regression.test.mjs

@@ -298,7 +298,7 @@ test('updateProvider keeps edit modal open when request throws', async () => {
     assert.strictEqual(context.showEditModal, true);
     assert.deepStrictEqual(context.editingProvider, {
         name: 'alpha',
-        url: ' https://api.example.com/v1 ',
+        url: 'https://api.example.com/v1',
         key: '',
         readOnly: false,
         nonEditable: false

tests/unit/providers-validation.test.mjs

@@ -0,0 +1,127 @@
+import assert from 'assert';
+import { createProvidersMethods } from '../../web-ui/modules/app.methods.providers.mjs';
+
+function createContext(overrides = {}, apiImpl = async () => ({ success: true })) {
+    const messages = [];
+    const loadAllCalls = [];
+    const methods = createProvidersMethods({ api: apiImpl });
+    const context = {
+        providersList: [],
+        codexAuthProfiles: [],
+        showAddModal: true,
+        showEditModal: false,
+        resetConfigLoading: false,
+        newProvider: { name: '', url: '', key: '' },
+        editingProvider: { name: '', url: '', key: '', readOnly: false, nonEditable: false },
+        claudeConfigs: {},
+        showMessage(text, type) {
+            messages.push({ text: String(text), type: type || 'info' });
+        },
+        async loadAll() {
+            loadAllCalls.push('loadAll');
+        },
+        ...methods,
+        ...overrides
+    };
+    return { context, messages, loadAllCalls };
+}
+
+test('provider validation rejects invalid add-provider fields before submit', async () => {
+    const apiCalls = [];
+    const { context, messages } = createContext({
+        newProvider: {
+            name: 'bad name',
+            url: 'not-a-url',
+            key: 'sk-test'
+        }
+    }, async (action, params) => {
+        apiCalls.push({ action, params });
+        return { success: true };
+    });
+
+    assert.strictEqual(context.canSubmitProvider('add'), false);
+    assert.strictEqual(context.providerFieldError('add', 'name'), '名称仅支持字母/数字/._-');
+    assert.strictEqual(context.providerFieldError('add', 'url'), 'URL 仅支持 http/https');
+
+    await context.addProvider();
+
+    assert.deepStrictEqual(apiCalls, []);
+    assert.strictEqual(messages.length, 1);
+    assert.deepStrictEqual(messages[0], {
+        text: '名称仅支持字母/数字/._-',
+        type: 'error'
+    });
+});
+
+test('addProvider normalizes trimmed values and submits sanitized payload', async () => {
+    const apiCalls = [];
+    const { context, messages, loadAllCalls } = createContext({
+        providersList: [{ name: 'alpha', url: 'https://alpha.example.com/v1', hasKey: true }],
+        newProvider: {
+            name: '  beta.provider  ',
+            url: ' https://api.example.com/v1/ ',
+            key: ' sk-live '
+        }
+    }, async (action, params) => {
+        apiCalls.push({ action, params });
+        return { success: true };
+    });
+
+    await context.addProvider();
+
+    assert.deepStrictEqual(apiCalls, [{
+        action: 'add-provider',
+        params: {
+            name: 'beta.provider',
+            url: 'https://api.example.com/v1',
+            key: ' sk-live '
+        }
+    }]);
+    assert.strictEqual(context.showAddModal, false);
+    assert.deepStrictEqual(context.newProvider, { name: '', url: '', key: '' });
+    assert.deepStrictEqual(loadAllCalls, ['loadAll']);
+    assert.deepStrictEqual(messages[0], {
+        text: '操作成功',
+        type: 'success'
+    });
+});
+
+test('updateProvider blocks invalid edit URL and skips api call', async () => {
+    const apiCalls = [];
+    const { context, messages } = createContext({
+        editingProvider: {
+            name: 'alpha',
+            url: 'ftp://api.example.com',
+            key: '',
+            readOnly: false,
+            nonEditable: false
+        }
+    }, async (action, params) => {
+        apiCalls.push({ action, params });
+        return { success: true };
+    });
+
+    assert.strictEqual(context.canSubmitProvider('edit'), false);
+    assert.strictEqual(context.providerFieldError('edit', 'url'), 'URL 仅支持 http/https');
+
+    await context.updateProvider();
+
+    assert.deepStrictEqual(apiCalls, []);
+    assert.deepStrictEqual(messages[0], {
+        text: 'URL 仅支持 http/https',
+        type: 'error'
+    });
+});
+
+test('provider validation rejects reserved proxy name on add', () => {
+    const { context } = createContext({
+        newProvider: {
+            name: 'codexmate-proxy',
+            url: 'https://api.example.com/v1',
+            key: ''
+        }
+    });
+
+    assert.strictEqual(context.providerFieldError('add', 'name'), 'codexmate-proxy 为保留名称，不可手动添加');
+    assert.strictEqual(context.canSubmitProvider('add'), false);
+});

tests/unit/run.mjs

@@ -35,6 +35,7 @@ await import(pathToFileURL(path.join(__dirname, 'text-diff.test.mjs')));
 await import(pathToFileURL(path.join(__dirname, 'claude-settings-sync.test.mjs')));
 await import(pathToFileURL(path.join(__dirname, 'unzip-ext.test.mjs')));
 await import(pathToFileURL(path.join(__dirname, 'provider-share-command.test.mjs')));
+await import(pathToFileURL(path.join(__dirname, 'providers-validation.test.mjs')));
 await import(pathToFileURL(path.join(__dirname, 'provider-switch-regression.test.mjs')));
 await import(pathToFileURL(path.join(__dirname, 'codex-proxy-options.test.mjs')));
 await import(pathToFileURL(path.join(__dirname, 'coderabbit-workflows.test.mjs')));

tests/unit/web-ui-behavior-parity.test.mjs

@@ -333,8 +333,12 @@ test('captured bundled app skeleton only exposes expected data key drift versus
         assert.deepStrictEqual(unexpectedExtraCurrentKeys, [], `unexpected extra data keys against ${parityBaseline.ref}`);
         assert.deepStrictEqual(unexpectedMissingCurrentKeys, [], `unexpected missing data keys against ${parityBaseline.ref}`);
     } else {
-        assert.deepStrictEqual(extraCurrentKeys, allowedExtraCurrentKeys, `unexpected extra data keys against ${parityBaseline.ref}`);
-        assert.deepStrictEqual(missingCurrentKeys, allowedMissingCurrentKeys, `unexpected missing data keys against ${parityBaseline.ref}`);
+        const allowedExtraKeySet = new Set(allowedExtraCurrentKeys);
+        const allowedMissingKeySet = new Set(allowedMissingCurrentKeys);
+        const unexpectedExtraCurrentKeys = extraCurrentKeys.filter((key) => !allowedExtraKeySet.has(key));
+        const unexpectedMissingCurrentKeys = missingCurrentKeys.filter((key) => !allowedMissingKeySet.has(key));
+        assert.deepStrictEqual(unexpectedExtraCurrentKeys, [], `unexpected extra data keys against ${parityBaseline.ref}`);
+        assert.deepStrictEqual(unexpectedMissingCurrentKeys, [], `unexpected missing data keys against ${parityBaseline.ref}`);
     }
     const normalizedCurrentKeys = currentDataKeys.filter((key) => !extraCurrentKeys.includes(key)).sort();
     const normalizedHeadKeys = headDataKeys.filter((key) => !missingCurrentKeys.includes(key)).sort();
@@ -343,7 +347,16 @@ test('captured bundled app skeleton only exposes expected data key drift versus
     const headMethodKeys = Object.keys(headMethods).sort();
     const extraCurrentMethodKeys = currentMethodKeys.filter((key) => !headMethodKeys.includes(key)).sort();
     const missingCurrentMethodKeys = headMethodKeys.filter((key) => !currentMethodKeys.includes(key)).sort();
-    const allowedExtraCurrentMethodKeys = [];
+    const allowedExtraCurrentMethodKeys = [
+        'canSubmitProvider',
+        'findProviderByName',
+        'getProviderValidation',
+        'isReservedProviderCreationName',
+        'isValidProviderNameInput',
+        'isValidProviderUrlInput',
+        'normalizeProviderDraft',
+        'providerFieldError'
+    ];
     const allowedMissingCurrentMethodKeys = [
         'closeInstallModal',
         'openInstallModal'
@@ -356,8 +369,12 @@ test('captured bundled app skeleton only exposes expected data key drift versus
         assert.deepStrictEqual(unexpectedExtraCurrentMethodKeys, [], `unexpected extra method keys against ${parityBaseline.ref}`);
         assert.deepStrictEqual(unexpectedMissingCurrentMethodKeys, [], `unexpected missing method keys against ${parityBaseline.ref}`);
     } else {
-        assert.deepStrictEqual(extraCurrentMethodKeys, allowedExtraCurrentMethodKeys);
-        assert.deepStrictEqual(missingCurrentMethodKeys, allowedMissingCurrentMethodKeys);
+        const allowedExtraMethodKeySet = new Set(allowedExtraCurrentMethodKeys);
+        const allowedMissingMethodKeySet = new Set(allowedMissingCurrentMethodKeys);
+        const unexpectedExtraCurrentMethodKeys = extraCurrentMethodKeys.filter((key) => !allowedExtraMethodKeySet.has(key));
+        const unexpectedMissingCurrentMethodKeys = missingCurrentMethodKeys.filter((key) => !allowedMissingMethodKeySet.has(key));
+        assert.deepStrictEqual(unexpectedExtraCurrentMethodKeys, []);
+        assert.deepStrictEqual(unexpectedMissingCurrentMethodKeys, []);
     }
     assert.deepStrictEqual(
         currentMethodKeys.filter((key) => !extraCurrentMethodKeys.includes(key)).sort(),