发布 0.2.1 并完善工具边界与安全性

README.md

@@ -8,13 +8,13 @@ The authoritative application version is the `version` field in `package.json`.
 
 ## Included tools
 
-- ASCII/UTF-8 and Hex conversion
+- UTF-8 and Hex conversion at the canonical route `/tools/utf8-hex`
 - Base64 and Base64 URL encoding/decoding, with UTF-8, continuous Hex, and source-code byte-array output
-- AES-128-CMAC (RFC 4493)
+- AES-CMAC with selectable AES-128, AES-192, and AES-256 keys
 - CRC-8/16/32/64 presets and custom parameters for BIN and multi-block Intel HEX files
 - Firmware SHA-256/SHA-512 over Intel HEX effective data, optionally with an address/length header for each block
 - RSA 2048/3072/4096-bit key-pair generation with PEM, N/E Hex, and byte-array output
-- Cryptographically secure random bytes in continuous Hex, spaced Hex, or byte-array form
+- Cryptographically secure random bytes in continuous Hex, spaced Hex, or byte-array form, defaulting to 16 bytes
 - JSON formatting, minification, validation, and syntax highlighting
 - XML formatting, minification, validation, and syntax highlighting
 - PNG to multi-size ICO conversion
@@ -22,13 +22,21 @@ The authoritative application version is the `version` field in `package.json`.
 ## Security and state model
 
 - Tool data is processed locally in browser memory and is not sent to the server or a third party.
-- There is no login, account, favorites, sponsorship, telemetry, CDN, or database.
-- `/setting` is a fixed, deliberately unlisted management route. It is not authentication: anyone who can reach the application can open that URL and change the globally shared navigation order.
+- There is no login, account, favorites, sponsorship, telemetry, application-loaded CDN asset, or database.
+- The Node server emits a fresh 128-bit CSP nonce on every response. Cloudflare can attach it to JavaScript Detections injected by its proxy without enabling `unsafe-inline`; this compatibility does not add application analytics or send tool inputs away from the browser.
+- `/tools/setting` is the fixed, deliberately unlisted management route. It is not authentication: anyone who can reach the application can open that URL and change the globally shared navigation order.
+- Existing navigation files that still contain the legacy `ascii-hex` tool ID are migrated in place to `utf8-hex`, preserving their category and position. New configurations and application routes use only `utf8-hex`.
+- The first-run default category order is Encoding, Checksum, Cryptography, Formatting, and Image. A saved `navigation.json` intentionally keeps its existing custom order; it is not silently reset by an application update.
 - Theme selection is stored in same-origin browser `localStorage`. The only server-side application data is `navigation.json`.
+- Browser navigation writes carrying Fetch Metadata are accepted only when `Sec-Fetch-Site` is `same-origin`. Clients that omit the header are still accepted, so this is defense in depth rather than authentication.
 - The application is suitable for a private network, VPN, or a deployment protected by an external access-control layer. Do not treat the hidden settings URL as an Internet-facing security boundary.
 
 See [README.zh-CN.md](README.zh-CN.md) for the exact algorithm contracts, input limits, concurrency behavior, and server security controls.
 
+## Resource limits
+
+The browser rejects oversized or structurally dense inputs before costly allocation. The current limits are 64 MiB for firmware files and merged Intel HEX effective data, 500,000 non-empty Intel HEX records, 1,024 Intel HEX blocks, 32 MiB for compressed PNG files, 16,384 pixels per PNG side and 32,000,000 decoded pixels, 1-65,536 bytes for secure random output (default 16), and 100,000 characters/10,000 tokens for syntax highlighting. Highlighting falls back to complete plain text; it never truncates a result.
+
 ## Docker deployment
 
 Requirements: Docker Engine 24+ and Docker Compose v2 on Linux AMD64 or ARM64.
@@ -117,6 +125,10 @@ public/                        browser icons and Web App Manifest
 
 New tools must keep their computation independent, register the same stable ID in the catalog, default navigation, and lazy-load registry, reuse the shared UI, define resource limits where appropriate, and include normal, invalid, boundary, and known-vector tests. Routes are generated from the tool registry; ordinary tools do not add routes manually.
 
+RSA uses Web Crypto first and dynamically loads the bundled `node-forge` fallback chunk from the same origin only when the native provider is unavailable or fails. Tool components remain lazy-loaded; the project does not add a Service Worker or duplicate the Brotli/Gzip compression normally supplied by a production reverse proxy such as Cloudflare.
+
+Only fingerprinted files under `dist/assets/` receive long-lived immutable caching. HTML, icons, the Manifest, and other stable filenames use `no-cache` so deployments can update them without waiting for a one-year browser cache to expire. XML validation identifies browser parser failures by their dedicated namespace, so a valid user element named `parsererror` is not rejected.
+
 The browser icon set follows the sidebar brand and includes SVG, multi-frame ICO, Apple touch, 192/512, and maskable assets. The manifest supplies metadata only: the project deliberately has no Service Worker, offline cache, install prompt, or splash-screen bundle, so a deployment update cannot be hidden by application-managed stale caches.
 
 The page exposes one product description through both the standard HTML description and an identical `og:description` compatibility field. It has no custom share image, other Open Graph metadata, platform crawler, or platform-specific fields. Sharing clients may fall back to the document title and existing favicons, but each platform controls its final preview and cache refresh behavior.