From 5e9f0df57fa55d3afd04e996912f5e468c8dc099 Mon Sep 17 00:00:00 2001
From: yu <191972707@qq.com>
Date: Wed, 28 Oct 2026 10:56:40 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=BC=80=E6=94=BE=E6=B5=8F=E8=A7=88?=
 =?UTF-8?q?=E5=99=A8HTTP=E7=AB=99=E7=82=B9=E8=AE=BF=E9=97=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/main/browser/session.ts             | 17 -----------------
 src/renderer/src/pages/SettingsPage.tsx |  6 +++---
 2 files changed, 3 insertions(+), 20 deletions(-)

diff --git a/src/main/browser/session.ts b/src/main/browser/session.ts
index a5c4988..cd34c9f 100644
--- a/src/main/browser/session.ts
+++ b/src/main/browser/session.ts
@@ -12,16 +12,6 @@ import {
   type BrowserSimilarElementOptions
 } from "../engine/types";
 
-const DEFAULT_DOMAINS = ["127.0.0.1", "localhost", "example.com"];
-
-function allowedDomains(): string[] {
-  const extra = (process.env.RPA_ALLOWED_DOMAINS || "")
-    .split(",")
-    .map((item) => item.trim())
-    .filter(Boolean);
-  return [...DEFAULT_DOMAINS, ...extra];
-}
-
 function assertUrl(raw: string): URL {
   let url: URL;
   try {
@@ -32,13 +22,6 @@ function assertUrl(raw: string): URL {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new RuntimeError("blocked_url", `只允许 http/https，当前为 ${url.protocol}`);
   }
-  const host = url.hostname;
-  const allowed = allowedDomains().some((domain) => host === domain || host.endsWith(`.${domain}`));
-  if (!allowed) {
-    throw new RuntimeError("blocked_url", `域名不在白名单：${host}`, {
-      recommendation: `在设置中把 ${host} 加入白名单（或设置 RPA_ALLOWED_DOMAINS）`
-    });
-  }
   return url;
 }
 
diff --git a/src/renderer/src/pages/SettingsPage.tsx b/src/renderer/src/pages/SettingsPage.tsx
index 9214b01..ebf55a4 100644
--- a/src/renderer/src/pages/SettingsPage.tsx
+++ b/src/renderer/src/pages/SettingsPage.tsx
@@ -29,7 +29,7 @@ export function SettingsPage({ catalog }: { catalog: Catalog }) {
         <button type="button" className={tab === "about" ? "active" : ""} onClick={() => setTab("about")}>关于与运行环境</button>
         <button type="button" className={tab === "catalog" ? "active" : ""} onClick={() => setTab("catalog")}>组件目录</button>
         <button type="button" className={tab === "execution" ? "active" : ""} onClick={() => setTab("execution")}>执行与证据</button>
-        <button type="button" className={tab === "browser" ? "active" : ""} onClick={() => setTab("browser")}>浏览器白名单</button>
+        <button type="button" className={tab === "browser" ? "active" : ""} onClick={() => setTab("browser")}>浏览器访问</button>
       </aside>
 
       <section className="panel setting-body">
@@ -61,8 +61,8 @@ export function SettingsPage({ catalog }: { catalog: Catalog }) {
 
         {tab === "browser" && (
           <>
-            <SettingCard icon={Globe2} title="浏览器域名白名单"><dl className="kv"><dt>默认允许</dt><dd>127.0.0.1、localhost、example.com</dd><dt>本地演示站</dt><dd>{info?.fixtureUrl || "未启动"}</dd><dt>扩展方式</dt><dd>环境变量 RPA_ALLOWED_DOMAINS</dd><dt>格式</dt><dd>逗号分隔域名，不含协议和路径</dd></dl></SettingCard>
-            <SettingCard icon={ShieldCheck} title="限制说明"><p className="field-hint setting-copy">导航只允许 HTTP/HTTPS。未列入白名单的域名会返回 blocked_url；文件协议、脚本协议和任意本地路径不会由浏览器导航组件打开。</p></SettingCard>
+            <SettingCard icon={Globe2} title="浏览器访问范围"><dl className="kv"><dt>默认允许</dt><dd>全部 HTTP/HTTPS 站点</dd><dt>本地演示站</dt><dd>{info?.fixtureUrl || "未启动"}</dd><dt>协议限制</dt><dd>HTTP / HTTPS</dd><dt>用途</dt><dd>支持内网、公网和测试站点</dd></dl></SettingCard>
+            <SettingCard icon={ShieldCheck} title="限制说明"><p className="field-hint setting-copy">浏览器导航不限制域名。只拒绝 HTTP/HTTPS 以外的协议；文件协议、脚本协议和任意本地路径不会由浏览器导航组件打开。</p></SettingCard>
           </>
         )}
       </section>