T09 · Insecure Skill Coding Practices
Warning
- Location
assets/word-doc.html:1009- Finding
Deleted Images and Files Remain in IndexedDB
- Content
View full analysis
{ trash.unshift({ text: e.text, deletedAt: Date.now() }); saveTrash(); entries.splice(i, 1); save(); render(); updateTrashBadge(); toast("已移入回收站"); }); ``` Folder deletion removes the folder metadata but does not delete the corresponding file records from IndexedDB: ```javascript del.addEventListener("click", (e) => { e.stopPropagation(); if (!confirm(`删除文件夹「${f.name}」？其中的 ${f.files.length} 个文件也会一并删除。`)) return; folders = folders.filter((x) => x.id !== f.id); save(); if (activeId === f.id) activeId = null; renderFolderList(); renderMain(); toast("已删除文件夹"); }); ``` Deleting an individual file deliberately retains its original blob: ```javascript delBtn.addEventListener("click", () => { if (!confirm(`删除文件「${file.name}」？`)) return; try { const t = JSON.parse(localStorage.getItem("wordpad_trash") || "[]"); t.unshift({ type: "file", text: file.text || "", name: file.name, size: file.size, mime: file.type || "", uploadedAt: file.uploadedAt, folderId: f.id, folderName: f.name, origId: file.id, deletedAt: Date.now() }); localStorage.setItem("wordpad_trash", JSON.stringify(t)); } catch (e) { console.warn("trash save failed", e); } // 不删 blob，恢复时还能用 f.files = f.files.filter((x) => x.id !== file.id); save(); renderFolderList(); renderMain(); }); ``` Permanent purge removes only trash metadata: ```javascri ...[truncated 2317 chars]- Remediation
View remediation