@abtnode/blocklet-services 1.16.47-beta-20250730-070104-87a128a5 → 1.16.47-beta-20250801-094129-1ba43aaa

package/api/index.js

@@ -13,7 +13,8 @@ const httpProxy = require('@arcblock/http-proxy');
 const { minimatch } = require('minimatch');
 const helmet = require('helmet');
 const isUrl = require('is-url');
-const { WELLKNOWN_SERVICE_PATH_PREFIX, EVENTS } = require('@abtnode/constant');
+const { WELLKNOWN_SERVICE_PATH_PREFIX, EVENTS, WELLKNOWN_BLOCKLET_ADMIN_PATH } = require('@abtnode/constant');
+const getBlockletComingSoonTemplate = require('@abtnode/router-templates/lib/blocklet-coming-soon');
 const {
   BlockletEvents,
   BlockletInternalEvents,
@@ -147,11 +148,23 @@ module.exports = function createServer(node, serverOptions = {}) {
   });
 
   proxy.safeWeb = (req, res, opts = {}) => {
-    proxy.web(req, res, opts, (error) => {
+    proxy.web(req, res, opts, async (error) => {
       if (error) {
         logger.error('http proxy error', { error, raw: req.originalUrl, opts });
         if (!res.headersSent) {
-          res.status(502).send(`Can not proxy to upstream target: ${opts.target}`);
+          try {
+            const [blocklet, nodeInfo] = await Promise.all([req.getBlocklet(), req.getNodeInfo()]);
+            res
+              .status(502)
+              .send(
+                blocklet && nodeInfo
+                  ? getBlockletComingSoonTemplate(blocklet, nodeInfo, WELLKNOWN_BLOCKLET_ADMIN_PATH)
+                  : `Can not proxy to upstream target: ${opts.target}`
+              );
+          } catch (err) {
+            logger.error('Failed to get blocklet or node info', { err });
+            res.status(502).send(`Can not proxy to upstream target: ${opts.target}`);
+          }
         }
       }
     });

package/api/libs/image.js

@@ -108,7 +108,8 @@ const getCacheFilePath = (dataDir, fileName) => {
   return result;
 };
 
-const isImageRequest = (req) => {
+// NOTICE: 如果传入了 fileName，则优先使用 fileName 的 extension，否则使用 req.path 的 extension
+const isImageRequest = (req, fileName) => {
   if (req.method !== 'GET') {
     return false;
   }
@@ -122,7 +123,8 @@ const isImageRequest = (req) => {
   if (!req.query.imageFilter) {
     return false;
   }
-  const extension = toLower(path.extname(req.path).slice(1));
+  const extension = toLower(path.extname(fileName || req.path).slice(1));
+
   if (extension && !FORMATS.includes(EXTENSIONS[extension])) {
     return false;
   }
@@ -138,95 +140,136 @@ const isImageRequest = (req) => {
 
 const getImageContentType = (extension) => (extension === 'svg' ? 'image/svg+xml' : `image/${extension}`);
 
-const processImage = (src, extension, dest, params) => {
+const processImage = (srcStream, { extension, destPath, srcPath }, filterParams = {}) => {
   return new Promise((resolve, reject) => {
     // output stream
-    const out = fs.createWriteStream(dest);
-    out.on('close', () => {
-      resolve(dest);
-    });
+    const out = fs.createWriteStream(destPath);
+
+    try {
+      // 这里是双重保障， /.blocklet/service/blocklet/logo 已经在 isImageRequest 中可以过滤掉了
+      // 此处只是为了增加健壮性，一般情况下不会到这里
+      if (extension && !FORMATS.includes(EXTENSIONS[extension])) {
+        // 如果是不支持的 extension，则将源文件直接写入目标地址
+        srcStream.pipe(out);
+        return;
+      }
 
-    out.on('error', (err) => {
-      reject(err);
-    });
+      out.on('close', () => {
+        resolve(destPath);
+      });
+
+      out.on('error', (err) => {
+        reject(err);
+      });
+
+      const {
+        imageFilter,
+        w: width,
+        h: height,
+        t: top,
+        l: left,
+        q: quality,
+        f: format,
+        m: mode,
+        r: rotate,
+        p: progressive,
+        g: greyscale,
+        b: blur,
+        a: transparency,
+        n: negative,
+        s: sharpen,
+      } = filterParams;
+
+      const dimensions = { top, left };
+      if (width) {
+        dimensions.width = width;
+      }
+      if (height) {
+        dimensions.height = height;
+      }
 
-    const {
-      imageFilter,
-      w: width,
-      h: height,
-      t: top,
-      l: left,
-      q: quality,
-      f: format,
-      m: mode,
-      r: rotate,
-      p: progressive,
-      g: greyscale,
-      b: blur,
-      a: transparency,
-      n: negative,
-      s: sharpen,
-    } = params;
-
-    const dimensions = { top, left };
-    if (width) {
-      dimensions.width = width;
-    }
-    if (height) {
-      dimensions.height = height;
-    }
+      const pipeline = sharp({ animated: true, limitInputPixels: 0 }).timeout({ seconds: 60 });
+      if (rotate) {
+        pipeline.rotate(rotate);
+      }
+      if (imageFilter === 'resize') {
+        if (!dimensions.width && !dimensions.height) {
+          reject(new CustomError(400, 'At least one of `w` or `h` must be provided to resize'));
+          return;
+        }
+      }
+      if (dimensions.width || dimensions.height) {
+        pipeline.resize({ ...dimensions, fit: mode, withoutEnlargement: true });
+      }
+      if (imageFilter === 'crop') {
+        pipeline.extract(dimensions);
+      }
 
-    const pipeline = sharp({ animated: true, limitInputPixels: 0 }).timeout({ seconds: 60 });
-    if (rotate) {
-      pipeline.rotate(rotate);
-    }
-    if (imageFilter === 'resize') {
-      if (!dimensions.width && !dimensions.height) {
-        reject(new CustomError(400, 'At least one of `w` or `h` must be provided to resize'));
+      if (sharpen) {
+        pipeline.sharpen(sharpen);
+      }
+      if (blur) {
+        pipeline.blur(blur);
+      }
+      if (greyscale) {
+        pipeline.greyscale();
+      }
+      if (transparency) {
+        pipeline.ensureAlpha();
+      } else {
+        pipeline.removeAlpha();
+      }
+      if (negative) {
+        pipeline.negate();
+      }
+
+      const processFn = pipeline[format || EXTENSIONS[extension]];
+      // 如果 sharp 实例中不包含目标 extension 的转换方法，则将源文件直接写入目标地址
+      if (!processFn || processFn instanceof Function === false) {
+        srcStream.pipe(out);
         return;
       }
-    }
-    if (dimensions.width || dimensions.height) {
-      pipeline.resize({ ...dimensions, fit: mode, withoutEnlargement: true });
-    }
-    if (imageFilter === 'crop') {
-      pipeline.extract(dimensions);
-    }
 
-    if (sharpen) {
-      pipeline.sharpen(sharpen);
-    }
-    if (blur) {
-      pipeline.blur(blur);
-    }
-    if (greyscale) {
-      pipeline.greyscale();
-    }
-    if (transparency) {
-      pipeline.ensureAlpha();
-    } else {
-      pipeline.removeAlpha();
+      // HACK: 这里不能使用 processFn 来替代，会导致图片处理出错(猜测是 this 指针的问题)
+      pipeline[format || EXTENSIONS[extension]]({ quality, progressive: !!progressive, dither: 0, force: true });
+
+      pipeline.on('error', (err) => {
+        reject(err);
+      });
+
+      // run the pipeline
+      srcStream.pipe(pipeline).pipe(out);
+    } catch (err) {
+      logger.error('image filter failed', {
+        error: err,
+        filterParams,
+        srcPath,
+        destPath,
+        extension,
+      });
+      srcStream.pipe(out);
     }
-    if (negative) {
-      pipeline.negate();
-    }
-
-    pipeline[format || EXTENSIONS[extension]]({ quality, progressive: !!progressive, dither: 0, force: true });
-
-    pipeline.on('error', (err) => {
-      reject(err);
-    });
-
-    // run the pipeline
-    src.pipe(pipeline).pipe(out);
   }).catch((err) => {
-    rmSync(dest, { force: true });
+    rmSync(destPath, { force: true });
     throw err;
   });
 };
 
 const tasks = {};
-const processAndRespond = (req, res, cacheDir, getSrc, ext, sendOptions = { maxAge: '356d', immutable: true }) => {
+const processAndRespond = (
+  req,
+  res,
+  {
+    srcPath,
+    cacheDir,
+    getSrc,
+    extension: ext,
+    sendOptions = {
+      maxAge: '356d',
+      immutable: true,
+    },
+  }
+) => {
   if (fs.existsSync(cacheDir) === false) {
     fs.mkdirSync(cacheDir, { recursive: true });
   }
@@ -255,6 +298,7 @@ const processAndRespond = (req, res, cacheDir, getSrc, ext, sendOptions = { maxA
 
   const cacheKey = md5(stringify({ target: req.target, path: req.originalUrl, params }));
   const destPath = getCacheFilePath(cacheDir, `${cacheKey}.${params.f || extension}`);
+
   if (fs.existsSync(destPath)) {
     res.header('Content-Type', getImageContentType(params.f || extension));
     res.sendFile(destPath, sendOptions);
@@ -263,7 +307,17 @@ const processAndRespond = (req, res, cacheDir, getSrc, ext, sendOptions = { maxA
 
   // do the convert
   tasks[cacheKey] ??= getSrc(req)
-    .then(([src, _extension]) => processImage(src, toLower(_extension), destPath, params))
+    .then(([src, _extension]) =>
+      processImage(
+        src,
+        {
+          extension: toLower(_extension),
+          destPath,
+          srcPath,
+        },
+        params
+      )
+    )
     .finally(() => {
       setTimeout(() => {
         delete tasks[cacheKey];

package/api/routes/blocklet.js

@@ -74,17 +74,16 @@ module.exports = {
 
     const attachSendLogoFn = (req, res, next) => {
       res.sendLogoFile = (fileName, options) => {
-        if (isImageRequest(req)) {
+        if (isImageRequest(req, fileName)) {
           logger.info('send logo with image service', { fileName, options });
           const appDir = path.join(req.blocklet.env.cacheDir, '.services', 'image-filter');
-          processAndRespond(
-            req,
-            res,
-            appDir,
-            () => Promise.resolve([fs.createReadStream(fileName), path.extname(fileName).slice(1)]),
-            path.extname(fileName).slice(1),
-            req.sendOptions
-          );
+          processAndRespond(req, res, {
+            srcPath: fileName,
+            cacheDir: appDir,
+            getSrc: () => Promise.resolve([fs.createReadStream(fileName), path.extname(fileName).slice(1)]),
+            extension: path.extname(fileName).slice(1),
+            sendOptions: req.sendOptions,
+          });
         } else {
           logger.info('send logo with file', { fileName, options });
           res.sendFile(fileName, options);
@@ -165,20 +164,24 @@ module.exports = {
           }
         }
 
-        const avatarFile = getAvatarFile(dataDir, fileName);
-        if (!fs.existsSync(avatarFile)) {
+        const avatarFilePath = getAvatarFile(dataDir, fileName);
+        if (!fs.existsSync(avatarFilePath)) {
           res.status(404).send('Avatar Not Found');
           return;
         }
 
         if (isImageAccepted(req) && isImageRequest(req)) {
           const appDir = path.join(cacheDir, '.services', 'image-filter');
-          processAndRespond(req, res, appDir, () => {
-            stream = fs.createReadStream(avatarFile);
-            return Promise.resolve([stream, path.extname(avatarFile).slice(1)]);
+          processAndRespond(req, res, {
+            srcPath: avatarFilePath,
+            cacheDir: appDir,
+            getSrc: () => {
+              stream = fs.createReadStream(avatarFilePath);
+              return Promise.resolve([stream, path.extname(avatarFilePath).slice(1)]);
+            },
           });
         } else {
-          res.sendFile(avatarFile, { maxAge: '365d', immutable: true });
+          res.sendFile(avatarFilePath, { maxAge: '365d', immutable: true });
         }
       } catch (err) {
         stream?.destroy();
@@ -561,7 +564,7 @@ module.exports = {
           info.ogImageHash = encodeURIComponent(ogImage.split('/').slice(-1)[0].slice(0, 7));
         }
 
-        const sourceFile = await getOgImage({
+        const sourceFilePath = await getOgImage({
           input: req.query,
           info,
           format,
@@ -570,12 +573,16 @@ module.exports = {
         });
         if (format === 'png' && isImageAccepted(req) && isImageRequest(req)) {
           const appDir = getAppImageCacheDir(blocklet.env.cacheDir);
-          processAndRespond(req, res, appDir, () => {
-            stream = fs.createReadStream(sourceFile);
-            return Promise.resolve([stream, path.extname(sourceFile).slice(1)]);
+          processAndRespond(req, res, {
+            srcPath: sourceFilePath,
+            cacheDir: appDir,
+            getSrc: () => {
+              stream = fs.createReadStream(sourceFilePath);
+              return Promise.resolve([stream, path.extname(sourceFilePath).slice(1)]);
+            },
           });
         } else {
-          res.sendFile(sourceFile, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
+          res.sendFile(sourceFilePath, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
         }
       } catch (err) {
         stream?.destroy();
@@ -591,17 +598,21 @@ module.exports = {
         const blocklet = await req.getBlocklet();
         const appSplash = get(blocklet, `environmentObj.BLOCKLET_APP_SPLASH_${type.toUpperCase()}`);
         if (appSplash) {
-          const splashFile = path.join(get(blocklet, 'env.dataDir'), appSplash);
-          if (fs.existsSync(splashFile)) {
+          const splashFilePath = path.join(get(blocklet, 'env.dataDir'), appSplash);
+          if (fs.existsSync(splashFilePath)) {
             if (isImageRequest(req)) {
               const appDir = getAppImageCacheDir(blocklet.env.cacheDir);
-              processAndRespond(req, res, appDir, () => {
-                stream = fs.createReadStream(splashFile);
-                return Promise.resolve([stream, path.extname(splashFile).slice(1)]);
+              processAndRespond(req, res, {
+                srcPath: splashFilePath,
+                cacheDir: appDir,
+                getSrc: () => {
+                  stream = fs.createReadStream(splashFilePath);
+                  return Promise.resolve([stream, path.extname(splashFilePath).slice(1)]);
+                },
               });
             } else {
               const cache = req.query.nocache !== '1';
-              res.sendFile(splashFile, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
+              res.sendFile(splashFilePath, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
             }
           } else {
             res.sendFile(`/images/splash-${type}.png`, { root: staticDir, maxAge: '1h' });
@@ -622,17 +633,21 @@ module.exports = {
         const blocklet = await req.getBlocklet();
         const appOgImage = get(blocklet, 'environmentObj.BLOCKLET_APP_OG_IMAGE');
         if (appOgImage) {
-          const ogImageFile = path.join(get(blocklet, 'env.dataDir'), appOgImage);
-          if (fs.existsSync(ogImageFile)) {
+          const ogImageFilePath = path.join(get(blocklet, 'env.dataDir'), appOgImage);
+          if (fs.existsSync(ogImageFilePath)) {
             if (isImageRequest(req)) {
               const appDir = getAppImageCacheDir(blocklet.env.cacheDir);
-              processAndRespond(req, res, appDir, () => {
-                stream = fs.createReadStream(ogImageFile);
-                return Promise.resolve([stream, path.extname(ogImageFile).slice(1)]);
+              processAndRespond(req, res, {
+                srcPath: ogImageFilePath,
+                cacheDir: appDir,
+                getSrc: () => {
+                  stream = fs.createReadStream(ogImageFilePath);
+                  return Promise.resolve([stream, path.extname(ogImageFilePath).slice(1)]);
+                },
               });
             } else {
               const cache = req.query.nocache !== '1';
-              res.sendFile(ogImageFile, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
+              res.sendFile(ogImageFilePath, cache ? { maxAge: '365d', immutable: true } : { maxAge: 0 });
             }
           } else {
             res.sendFile('/images/og-image.jpg', { root: staticDir, maxAge: '1h' });

package/api/routes/csp-proxy.js

@@ -1,52 +1,160 @@
-const { getChainClient } = require('@abtnode/util/lib/get-chain-client');
-const { MAIN_CHAIN_ENDPOINT } = require('@abtnode/constant');
 const { WELLKNOWN_SERVICE_PATH_PREFIX } = require('@abtnode/constant');
 const { default: axios } = require('axios');
 const isUrl = require('is-url');
+const isPrivateIP = require('private-ip');
 
 const logger = require('../libs/logger')('blocklet-services:csp-proxy');
 
 const PREFIX = WELLKNOWN_SERVICE_PATH_PREFIX;
 
-module.exports = {
-  init(server) {
-    const chainClient = getChainClient(MAIN_CHAIN_ENDPOINT);
+// 允许的图片内容类型和 JSON 内容类型
+const ALLOWED_CONTENT_TYPES = [
+  'image/jpeg',
+  'image/png',
+  'image/gif',
+  'image/webp',
+  'image/svg+xml',
+  'image/avif',
+  'image/bmp',
+  'image/x-icon',
+  'application/json',
+];
+
+/**
+ * 检查请求来源是否合法
+ */
+function checkReferer(req) {
+  const referer = req.get('referer');
+  if (!referer) {
+    return false;
+  }
+
+  try {
+    const refererUrl = new URL(referer);
+    const currentHost = req.get('host');
 
-    if (!chainClient) {
-      logger.error('get chain client failed');
-      return;
-    }
+    // 检查referer是否来自当前站点
+    return refererUrl.hostname === currentHost || refererUrl.hostname === currentHost.split(':')[0]; // 处理端口号情况
+  } catch {
+    return false;
+  }
+}
 
+/**
+ * 检查内容类型是否为允许的图片类型
+ */
+function isAllowedContentType(contentType) {
+  if (!contentType) return false;
+  const lowerContentType = contentType.toLowerCase();
+  return ALLOWED_CONTENT_TYPES.some((type) => lowerContentType.startsWith(type));
+}
+
+module.exports = {
+  init(server) {
     server.get(`${PREFIX}/proxy`, async (req, res) => {
       const { url } = req.query;
 
       if (!url) {
-        res.status(400).send('Missing resource URL');
+        res.status(400).send('Invalid parameter');
+        return;
       }
 
       if (!isUrl(url)) {
-        res.status(400).send('Invalid resource URL');
+        res.status(400).send('Invalid parameter');
+        return;
+      }
+
+      // 检查referer来源
+      if (!checkReferer(req)) {
+        res.status(403).send('Invalid parameter');
         return;
       }
 
       try {
         const tmp = new URL(url);
         if (tmp.protocol !== 'https:') {
-          res.status(400).send('Invalid resource URL');
+          res.status(400).send('Invalid parameter');
           return;
         }
 
-        // 使用流式请求和响应
+        // 检查是否为内网地址，防止SSRF攻击
+        if (isPrivateIP(tmp.hostname)) {
+          res.status(400).send('Invalid parameter');
+          return;
+        }
+
+        // 配置axios请求，确保不传递用户的cookie等认证信息
+        const requestConfig = {
+          maxRedirects: 0,
+          headers: {
+            'User-Agent': 'BlockletServer-CSP-Proxy/1.0',
+          },
+        };
+
+        // 直接发起GET请求，在响应头返回后立即检查content-type
         const response = await axios.get(url, {
+          ...requestConfig,
           responseType: 'stream',
         });
 
+        // 立即检查响应的content-type
+        const contentType = response.headers['content-type'];
+        if (!isAllowedContentType(contentType)) {
+          // 立即销毁stream并返回错误，避免继续下载
+          response.data.destroy();
+          res.status(400).send('Invalid parameter');
+          return;
+        }
+
         // 设置响应头
         res.set('Content-Type', response.headers['content-type']);
         if (response.headers['content-length']) {
           res.set('Content-Length', response.headers['content-length']);
         }
 
+        // 关键安全头：防止第三方内容获取本站cookie
+        const securityHeaders = {
+          // 防止浏览器MIME类型嗅探，严格按content-type处理
+          'X-Content-Type-Options': 'nosniff',
+          // 禁止发送referrer信息，保护隐私
+          'Referrer-Policy': 'no-referrer',
+          // 防止XSS攻击
+          'X-XSS-Protection': '1; mode=block',
+        };
+
+        // 根据内容类型设置不同的安全策略
+        const lowerContentType = contentType.toLowerCase();
+
+        if (lowerContentType.startsWith('application/json')) {
+          // JSON响应：严格禁止执行和嵌入
+          securityHeaders['Content-Security-Policy'] = "default-src 'none'; script-src 'none'; object-src 'none';";
+          securityHeaders['X-Frame-Options'] = 'DENY';
+        } else if (lowerContentType.startsWith('image/svg+xml')) {
+          // SVG图片：禁止脚本但允许样式，可能需要嵌入使用
+          securityHeaders['Content-Security-Policy'] =
+            "default-src 'none'; script-src 'none'; style-src 'unsafe-inline';";
+          securityHeaders['X-Frame-Options'] = 'SAMEORIGIN'; // 允许同源嵌入
+        } else if (lowerContentType.startsWith('image/')) {
+          // 普通图片：最宽松的策略，但仍防止脚本执行
+          securityHeaders['Content-Security-Policy'] = "script-src 'none';";
+          // 不设置X-Frame-Options，允许嵌入
+        }
+
+        // 仅在HTTPS环境下设置HSTS
+        if (req.secure || req.get('x-forwarded-proto') === 'https') {
+          securityHeaders['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains';
+        }
+
+        res.set(securityHeaders);
+
+        // 添加缓存控制头
+        res.set('Cache-Control', 'public, max-age=3600'); // 缓存1小时
+
+        // 确保不传递可能包含敏感信息的响应头
+        res.removeHeader('Set-Cookie');
+        res.removeHeader('Authorization');
+        res.removeHeader('WWW-Authenticate');
+
         // 直接将流管道传输到响应
         response.data.pipe(res);
 
@@ -59,7 +167,14 @@ module.exports = {
         });
       } catch (error) {
         logger.error('Error fetching the resource:', { error, url });
-        res.status(400).send(`Could not fetch the resource: ${error.message}`);
+
+        if (error.code === 'ECONNABORTED') {
+          res.status(408).send('Request timeout');
+        } else if (error.response && error.response.status) {
+          res.status(error.response.status).send(`Remote server error: ${error.response.status}`);
+        } else {
+          res.status(400).send('Invalid parameter');
+        }
       }
     });
   },

package/api/routes/user.js

@@ -988,12 +988,16 @@ module.exports = {
           const { token } = req;
           if (token) {
             const sessionTtl = jwtDecode(token).exp * 1000 - Date.now();
-            await cache.sessionToken.set(md5(token), { block: true }, { ttl: sessionTtl });
+            if (sessionTtl > 0) {
+              await cache.sessionToken.set(md5(token), { block: true }, { ttl: sessionTtl });
+            }
           }
           // 兼容旧版本，API 不会携带 refreshToken 的情况
           if (refreshToken) {
             const refreshTtl = jwtDecode(refreshToken).exp * 1000 - Date.now();
-            await cache.refreshToken.set(md5(refreshToken), { block: true }, { ttl: refreshTtl });
+            if (refreshTtl > 0) {
+              await cache.refreshToken.set(md5(refreshToken), { block: true }, { ttl: refreshTtl });
+            }
           }
         } catch (err) {
           logger.error('Failed to block session token & refresh token', { error: err });