fix: remove XSS vulnerability and add security attributes

- Removed dangerouslySetInnerHTML with unsanitized user input
- Removed highlightCommit prop and related highlighting logic
- Added download and rel="noopener noreferrer" attributes to download link
- Simplified component to safely display filename without HTML rendering

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

app/download/ApkCard.tsx

@@ -7,21 +7,14 @@ interface ApkCardProps {
   size: number;
   modifiedAt: string;
   downloadUrl: string;
-  highlightCommit?: string;
 }
 
-export default function ApkCard({ name, commit, size, modifiedAt, downloadUrl, highlightCommit }: ApkCardProps) {
+export default function ApkCard({ name, commit, size, modifiedAt, downloadUrl }: ApkCardProps) {
-  // 高亮显示 commit id
-  const displayName = commit && highlightCommit
-    ? name.replace(new RegExp(commit, 'gi'), (match) => `<mark class="bg-yellow-200">${match}</mark>`)
-    : name;
-
   return (
     <div className="bg-white border border-gray-200 rounded-lg p-4 hover:shadow-md transition-shadow">
-      <h3
+      <h3 className="text-lg font-semibold text-gray-800 mb-2 break-all">
-        className="text-lg font-semibold text-gray-800 mb-2 break-all"
+        {name}
-        dangerouslySetInnerHTML={{ __html: displayName }}
+      </h3>
-      />
 
       <div className="space-y-1 text-sm text-gray-600 mb-4">
         <div className="flex justify-between">
@@ -42,6 +35,8 @@ export default function ApkCard({ name, commit, size, modifiedAt, downloadUrl, h
 
       <a
         href={downloadUrl}
+        download
+        rel="noopener noreferrer"
         className="block w-full text-center bg-green-600 text-white py-2 px-4 rounded-md hover:bg-green-700 transition-colors"
       >
         下载 APK