更新

server/tests/QywxPromotionWidgetServiceTest.php

@@ -98,9 +98,10 @@ $encoded = QywxPromotionWidgetService::encode($xssConfig);
 widgetAssert(!str_contains($encoded, '<img') && str_contains($encoded, '\\u003Cimg'), '持久化 JSON 未使用 HEX 转义');
 
 $key = str_repeat('a', 32);
+$officialUrl = 'https://work.weixin.qq.com/ca/test?customer_channel=zyt_pool:123';
 $script = QywxPromotionWidgetService::renderScript(
     $key,
-    '/api/qywx-promotion/go/' . $key,
+    $officialUrl,
     $xssConfig,
     true
 );
@@ -112,8 +113,9 @@ widgetAssert(str_contains($script, '.wecom-promotion-link[data-pool'), '旧 data
 widgetAssert(str_contains($script, 'w.WecomPromotion=w.WecomPromotion||{}'), '全局 WecomPromotion 注册表丢失');
 widgetAssert(str_contains($script, 'open:openPromotion'), '全局 open 方法丢失');
 widgetAssert(str_contains($script, 'show:show') && str_contains($script, 'hide:hide') && str_contains($script, 'destroy:destroy'), '浮窗生命周期方法不完整');
-widgetAssert(str_contains($script, 'location.origin') && str_contains($script, 'location.pathname'), '来源地址未限制为 origin + pathname');
-widgetAssert(!str_contains($script, 'location.href'), '公开脚本仍发送完整 location.href');
+widgetAssert(str_contains($script, 'location.assign(targetUrl)'), '公开脚本没有直达企业微信官方链接');
+widgetAssert(str_contains($script, 'work.weixin.qq.com/ca/test?customer_channel=zyt_pool:123'), '公开脚本缺少官方渠道链接');
+widgetAssert(!str_contains($script, '?from='), '公开脚本仍追加本站跳转来源参数');
 widgetAssert(str_contains($script, 'attachShadow'), '公开脚本未隔离浮窗样式');
 widgetAssert(str_contains($script, 'd.currentScript') && str_contains($script, 'new w.URL(value,node.src)'), '跳转地址未从安装脚本来源解析');
 widgetAssert(str_contains($script, "style.setAttribute('nonce',nonce)"), '公开脚本未向动态样式传递 CSP nonce');