fix(live-editor): disable share and URL content loading to prevent XSS

site/package.json

@@ -36,7 +36,6 @@
     "@codemirror/theme-one-dark": "^6.1.3",
     "@codemirror/view": "^6.39.7",
     "@radix-ui/react-context-menu": "^2.1.5",
-    "@types/pako": "^2.0.4",
     "antd": "^5.24.7",
     "body-scroll-lock": "^3.1.3",
     "classnames": "^2.2.6",
@@ -47,7 +46,6 @@
     "lucide-react": "^0.554.0",
     "next": "^15.5.7",
     "next-remote-watch": "^1.0.0",
-    "pako": "^2.1.0",
     "parse-numeric-range": "^1.2.0",
     "react": "^19.0.0",
     "react-collapsed": "4.2.0",

site/src/components/LiveEditor/EditorPanel.tsx

@@ -10,7 +10,6 @@ import type {EditorView} from '@codemirror/view';
 import {Select} from 'antd';
 import {TEMPLATES} from 'components/Gallery/templates';
 import {IconClose} from 'components/Icon/IconClose';
-import {IconLink} from 'components/Icon/IconLink';
 import {IconRestart} from 'components/Icon/IconRestart';
 import {CodeEditor} from 'components/MDX/CodeEditor';
 import {useLocaleBundle} from 'hooks/useTranslation';
@@ -326,7 +325,6 @@ const TRANSLATIONS = {
     themeLabel: '主题',
     paletteLabel: '配色',
     resetButton: '重置',
-    shareButton: '分享',
     clearButton: '清空',
     searchPlaceholder: '搜索',
     noResults: '无匹配选项',
@@ -339,7 +337,6 @@ const TRANSLATIONS = {
     themeLabel: 'Theme',
     paletteLabel: 'Palette',
     resetButton: 'Reset',
-    shareButton: 'Share',
     clearButton: 'Clear',
     searchPlaceholder: 'Search',
     noResults: 'No results',
@@ -368,12 +365,10 @@ const CUSTOM_PALETTES = [
 export function EditorPanel({
   value,
   onChange,
-  onShare,
   onReset,
 }: {
   value: string;
   onChange: (value: string) => void;
-  onShare: () => void;
   onReset: () => void;
 }) {
   const texts = useLocaleBundle(TRANSLATIONS);
@@ -612,13 +607,6 @@ export function EditorPanel({
             aria-label={texts.resetButton}>
             <IconRestart className="w-4 h-4" />
           </button>
-          <div className="w-[1px] h-5 bg-border dark:bg-border-dark self-center mx-1" />
-          <button
-            onClick={onShare}
-            className="inline-flex items-center gap-2 px-4 py-2 text-sm font-semibold text-white rounded-full bg-gradient-to-r from-link to-link/80 dark:from-link-dark dark:to-link-dark/90 shadow-sm hover:shadow-md transition">
-            <IconLink className="w-4 h-4" />
-            {texts.shareButton}
-          </button>
         </div>
       </div>
       <div className="flex-1 relative group overflow-auto">

site/src/components/LiveEditor/index.tsx

@@ -1,12 +1,10 @@
 import {CopyToast, useCopyToast} from 'components/CopyToast';
 import {motion} from 'framer-motion';
 import {useLocaleBundle} from 'hooks/useTranslation';
-import {useRouter} from 'next/router';
 import {useEffect, useState} from 'react';
 import {DEFAULT_SYNTAX} from './defaultSyntax';
 import {EditorPanel} from './EditorPanel';
 import {PreviewPanel} from './PreviewPanel';
-import {extractContentFromUrl, generateShareUrl} from './utils';
 
 const STORAGE_KEY = 'live-editor-syntax';
 
@@ -15,43 +13,28 @@ const TRANSLATIONS = {
     title: 'Live Editor',
     description: '编辑 AntV Infographic Syntax 并查看实时预览',
     resetButton: '重置为默认',
-    shareButton: '分享',
     imageCopied: '图片已复制到剪贴板',
-    linkCopied: '分享链接已复制到剪贴板',
-    shareFailed: '生成分享链接失败',
   },
   'en-US': {
     title: 'Live Editor',
     description: 'Edit AntV Infographic Syntax and see real-time preview',
     resetButton: 'Reset to Default',
-    shareButton: 'Share',
     imageCopied: 'Image copied to clipboard',
-    linkCopied: 'Share link copied to clipboard',
-    shareFailed: 'Failed to generate share link',
   },
 };
 
 export function EditorContent() {
-  const router = useRouter();
   const [syntax, setSyntax] = useState(DEFAULT_SYNTAX);
   const [error, setError] = useState<string | null>(null);
   const [mounted, setMounted] = useState(false);
   const {message: copyHint, show: showCopyHint} = useCopyToast(2500);
   const texts = useLocaleBundle(TRANSLATIONS);
 
-  // Load from URL or localStorage on mount
+  // Load from localStorage on mount
   useEffect(() => {
     setMounted(true);
     if (typeof window === 'undefined') return;
 
-    // Try URL first
-    const urlContent = extractContentFromUrl();
-    if (urlContent) {
-      setSyntax(urlContent);
-      return;
-    }
-
-    // Fall back to localStorage
     const saved = localStorage.getItem(STORAGE_KEY);
     if (saved) {
       setSyntax(saved);
@@ -66,53 +49,11 @@ export function EditorContent() {
     localStorage.setItem(STORAGE_KEY, syntax);
   }, [syntax, mounted]);
 
-  // Debounced URL update when content is edited (if URL has content param)
-  useEffect(() => {
-    if (!mounted) return;
-    if (typeof window === 'undefined') return;
-
-    // Check if current URL has content parameter
-    const hasContentParam = window.location.search.includes('content=');
-    if (!hasContentParam) return;
-
-    // Debounce URL update (same delay as preview: 300ms)
-    const timer = setTimeout(() => {
-      const shareUrl = generateShareUrl(syntax);
-      if (shareUrl) {
-        window.history.replaceState(null, '', shareUrl);
-      }
-    }, 300);
-
-    return () => clearTimeout(timer);
-  }, [syntax, mounted]);
-
   const handleReset = () => {
     setSyntax(DEFAULT_SYNTAX);
     if (typeof window !== 'undefined') {
       localStorage.removeItem(STORAGE_KEY);
     }
-    // Clear URL params
-    router.replace('/editor', undefined, {shallow: true});
-  };
-
-  const handleShare = async () => {
-    const shareUrl = generateShareUrl(syntax);
-    if (!shareUrl) {
-      showCopyHint(texts.shareFailed);
-      return;
-    }
-
-    try {
-      await navigator.clipboard.writeText(shareUrl);
-      showCopyHint(texts.linkCopied);
-      // Use native history API to update URL without triggering re-render
-      if (typeof window !== 'undefined') {
-        window.history.replaceState(null, '', shareUrl);
-      }
-    } catch (e) {
-      console.error('Failed to copy share link:', e);
-      showCopyHint(texts.shareFailed);
-    }
   };
 
   return (
@@ -142,7 +83,6 @@ export function EditorContent() {
           <EditorPanel
             value={syntax}
             onChange={setSyntax}
-            onShare={handleShare}
             onReset={handleReset}
           />
           <PreviewPanel