@jayfong/x-server 1.34.3 → 1.34.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/_cjs/core/server.js +11 -1
- package/lib/core/server.js +12 -2
- package/package.json +1 -1
package/lib/_cjs/core/server.js
CHANGED
|
@@ -162,7 +162,17 @@ class Server {
|
|
|
162
162
|
method: 'POST',
|
|
163
163
|
url: '/@',
|
|
164
164
|
handler: async (req, res) => {
|
|
165
|
-
|
|
165
|
+
let requestPath = req.headers['x-path'] || '';
|
|
166
|
+
|
|
167
|
+
if (!requestPath.startsWith('/')) {
|
|
168
|
+
const [_requestPath, _time] = (0, _vtils.base64UrlDecode)((0, _vtils.rot13)(requestPath)).split('#');
|
|
169
|
+
|
|
170
|
+
if (!_time || Date.now() / 1000 - Number(_time) > 5 * 60) {
|
|
171
|
+
throw new _http_error.HttpError.Forbidden();
|
|
172
|
+
}
|
|
173
|
+
|
|
174
|
+
requestPath = _requestPath;
|
|
175
|
+
}
|
|
166
176
|
|
|
167
177
|
if (!requestPath || !routeMap[requestPath]) {
|
|
168
178
|
throw new _http_error.HttpError.NotFound();
|
package/lib/core/server.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import Fastify from 'fastify';
|
|
2
|
-
import { castArray, keyBy, noop } from 'vtils';
|
|
2
|
+
import { base64UrlDecode, castArray, keyBy, noop, rot13 } from 'vtils';
|
|
3
3
|
import { HandlerMethodToHttpMethod } from "./http_method";
|
|
4
4
|
import { HttpError } from "./http_error";
|
|
5
5
|
import { x } from "../x";
|
|
@@ -147,7 +147,17 @@ export class Server {
|
|
|
147
147
|
method: 'POST',
|
|
148
148
|
url: '/@',
|
|
149
149
|
handler: async (req, res) => {
|
|
150
|
-
|
|
150
|
+
let requestPath = req.headers['x-path'] || '';
|
|
151
|
+
|
|
152
|
+
if (!requestPath.startsWith('/')) {
|
|
153
|
+
const [_requestPath, _time] = base64UrlDecode(rot13(requestPath)).split('#');
|
|
154
|
+
|
|
155
|
+
if (!_time || Date.now() / 1000 - Number(_time) > 5 * 60) {
|
|
156
|
+
throw new HttpError.Forbidden();
|
|
157
|
+
}
|
|
158
|
+
|
|
159
|
+
requestPath = _requestPath;
|
|
160
|
+
}
|
|
151
161
|
|
|
152
162
|
if (!requestPath || !routeMap[requestPath]) {
|
|
153
163
|
throw new HttpError.NotFound();
|