refactor: improve request rendering logic and enhance HTML escaping

lakernote · lakernote · commit 5340aa74c274 · 2025-10-15T19:16:21.000+08:00
diff --git a/src/main/java/com/laker/postman/common/tree/RequestTreeCellRenderer.java b/src/main/java/com/laker/postman/common/tree/RequestTreeCellRenderer.java
@@ -15,6 +15,11 @@
  * 自定义树节点渲染器，用于美化 JTree 的节点显示
  */
 public class RequestTreeCellRenderer extends DefaultTreeCellRenderer {
+
+    private static final int ICON_SIZE = 16;
+    private static final int METHOD_FONT_PX = 7;
+    private static final int NAME_FONT_PX = 8; // using 8 instead of 8.5 for simplicity
+
     @Override
     public Component getTreeCellRendererComponent(JTree tree, Object value, boolean sel, boolean expanded,
                                                   boolean leaf, int row, boolean hasFocus) {
@@ -23,33 +28,65 @@ public Component getTreeCellRendererComponent(JTree tree, Object value, boolean
         Object userObject = node.getUserObject();
         if (userObject instanceof Object[] obj) {
             if (RequestCollectionsLeftPanel.GROUP.equals(obj[0])) {
-                setIcon(new FlatSVGIcon("icons/group.svg", 16, 16));
+                setIcon(new FlatSVGIcon("icons/group.svg", ICON_SIZE, ICON_SIZE));
                 setText((String) obj[1]);
             } else if (RequestCollectionsLeftPanel.REQUEST.equals(obj[0])) {
-                // 直接用彩色文本显示 method + name，method 彩色，name 默认色
                 HttpRequestItem item = (HttpRequestItem) obj[1];
-                String method = item.getMethod();
-                String name = item.getName();
-                RequestItemProtocolEnum protocol = item.getProtocol();
-                String methodColor = HttpUtil.getMethodColor(method);
-
-                // 根据协议类型设置不同的图标和显示样式
-                if (protocol.isWebSocketProtocol()) {
-                    setIcon(new FlatSVGIcon("icons/websocket.svg", 16, 16));
-                    setText("<html><span style='color:#1976D2;font-weight:bold;font-size:7px'>WS</span> <span style='font-size:8.5px'>" + name + "</span></html>");
-                } else {
-                    if (protocol.isSseProtocol()) {
-                        setIcon(new FlatSVGIcon("icons/sse.svg", 16, 16));
-                    } else {
-                        setIcon(new FlatSVGIcon("icons/http.svg", 16, 16));
-                    }
-                    setText("<html><span style='color:" + methodColor + ";font-weight:bold;font-size:7px'>" +
-                            (method == null ? "" : method) + "</span> <span style='font-size:8.5px'>" + name + "</span></html>");
-                }
+                applyRequestRendering(item);
             }
         }
         if (sel) setBackgroundSelectionColor(new Color(255, 230, 180));
         else setBackgroundNonSelectionColor(getBackground());
         return this;
     }
+
+    // Extracted to reduce cognitive complexity of the main method
+    private void applyRequestRendering(HttpRequestItem item) {
+        String method = item.getMethod();
+        String name = item.getName();
+        RequestItemProtocolEnum protocol = item.getProtocol();
+        String methodColor = HttpUtil.getMethodColor(method);
+
+        if (protocol.isWebSocketProtocol()) {
+            method = "WS";
+            methodColor = "#29cea5";
+        } else if (protocol.isSseProtocol()) {
+            method = "SSE";
+            methodColor = "#7fbee3";
+        }
+
+        setText(buildStyledText(method, methodColor, name));
+    }
+
+    // Build HTML with escaped content and consistent font sizes
+    private static String buildStyledText(String method, String methodColor, String name) {
+        String safeMethod = method == null ? "" : escapeHtml(method);
+        String safeName = name == null ? "" : escapeHtml(name);
+        String color = methodColor == null ? "#000" : methodColor;
+        // simple concatenation is clearer for this short html fragment
+        return "<html>" +
+                "<span style='color:" + color + ";font-weight:bold;font-size:" + METHOD_FONT_PX + "px'>" +
+                safeMethod +
+                "</span> " +
+                "<span style='font-size:" + NAME_FONT_PX + "px'>" +
+                safeName +
+                "</span></html>";
+    }
+
+    // Minimal HTML escape to avoid broken rendering or injection
+    private static String escapeHtml(String s) {
+        if (s == null) return null;
+        StringBuilder out = new StringBuilder(Math.max(16, s.length()));
+        for (char c : s.toCharArray()) {
+            switch (c) {
+                case '<' -> out.append("&lt;");
+                case '>' -> out.append("&gt;");
+                case '&' -> out.append("&amp;");
+                case '"' -> out.append("&quot;");
+                case '\'' -> out.append("&#39;");
+                default -> out.append(c);
+            }
+        }
+        return out.toString();
+    }
 }
