@maiyunnet/kebab 9.14.2 → 9.15.0

package/index.d.ts

@@ -5,7 +5,7 @@
  * --- 本文件用来定义每个目录实体地址的常量 ---
  */
 /** --- 当前系统版本号 --- */
-export declare const VER = "9.14.2";
+export declare const VER = "9.15.0";
 /** --- 框架根目录，以 / 结尾  --- */
 export declare const ROOT_PATH: string;
 /** --- 框架的 LIB，以 / 结尾 --- */

package/index.js

@@ -6,7 +6,7 @@
  * --- 本文件用来定义每个目录实体地址的常量 ---
  */
 /** --- 当前系统版本号 --- */
-export const VER = '9.14.2';
+export const VER = '9.15.0';
 // --- 服务端用的路径 ---
 const imu = decodeURIComponent(import.meta.url).replace('file://', '').replace(/^\/(\w:)/, '$1');
 /** --- /xxx/xxx --- */

package/lib/core.d.ts

@@ -127,6 +127,8 @@ export declare function ips(ctr: sCtr.Ctr | http.IncomingHttpHeaders): {
 export declare const REAL_IP_X = "x-forwarded-for";
 /** --- 使用的是 Cloudflare --- */
 export declare const REAL_IP_CF = "cf-connecting-ip";
+/** --- 使用的是 EO --- */
+export declare const REAL_IP_EO = "eo-connecting-ip";
 /**
  * --- 获取直连 IP（安全 IP） ---
  * @param ctr

package/lib/core.js

@@ -8,6 +8,7 @@ import * as http2 from 'http2';
 import * as stream from 'stream';
 import * as os from 'os';
 import * as net from 'net';
+import * as crypto from 'crypto';
 import Ajv from 'ajv';
 import addFormats from 'ajv-formats';
 import * as kebab from '#kebab/index.js';
@@ -110,7 +111,7 @@ export function random(length = 8, source = RANDOM_LN, block = '') {
     }
     let temp = '';
     for (let i = 0; i < length; ++i) {
-        temp += source[rand(0, len - 1)];
+        temp += source[crypto.randomInt(len)];
     }
     return temp;
 }
@@ -337,6 +338,8 @@ export function ips(ctr) {
 export const REAL_IP_X = 'x-forwarded-for';
 /** --- 使用的是 Cloudflare --- */
 export const REAL_IP_CF = 'cf-connecting-ip';
+/** --- 使用的是 EO --- */
+export const REAL_IP_EO = 'eo-connecting-ip';
 /**
  * --- 规范化 IP 地址 ---
  * --- 将 IPv4-mapped IPv6（如 ::ffff:127.0.0.1）转换为纯 IPv4，原生 IPv6 保持不变 ---
@@ -1153,24 +1156,36 @@ export function clone(obj) {
     const keys = isArray ? obj.keys() : Object.keys(obj);
     for (const key of keys) {
         const val = obj[key];
+        let clonedValue;
         if (val instanceof Date) {
-            newObj[key] = new Date(val.getTime());
+            clonedValue = new Date(val.getTime());
         }
         else if (val instanceof FormData) {
             const fd = new FormData();
             for (const item of val) {
                 fd.append(item[0], item[1]);
             }
-            newObj[key] = fd;
+            clonedValue = fd;
         }
         else if (val === null) {
-            newObj[key] = null;
+            clonedValue = null;
         }
         else if (typeof val === 'object') {
-            newObj[key] = clone(val);
+            clonedValue = clone(val);
         }
         else {
-            newObj[key] = val;
+            clonedValue = val;
+        }
+        if (!isArray && ((key === '__proto__') || (key === 'prototype') || (key === 'constructor'))) {
+            Object.defineProperty(newObj, key, {
+                'configurable': true,
+                'enumerable': true,
+                'value': clonedValue,
+                'writable': true,
+            });
+        }
+        else {
+            newObj[key] = clonedValue;
         }
     }
     return newObj;

package/lib/crypto.js

@@ -14,7 +14,7 @@ import * as lCore from '#kebab/lib/core.js';
  * @param options 参数
  */
 export function generateKeyPair(type, options = {}) {
-    return new Promise((resolve) => {
+    return new Promise(resolve => {
         options.modulusLength ??= 2048;
         if (options.namedCurve !== undefined) {
             options.namedCurve = options.namedCurve.toUpperCase();

package/lib/fs.js

@@ -26,10 +26,9 @@ export async function getContent(path, options) {
     const encoding = options.encoding;
     const start = options.start;
     const end = options.end;
-    if (start ?? end) {
+    if ((start !== undefined) || (end !== undefined)) {
         return new Promise(function (resolve) {
             const rs = createReadStream(path, {
-                'encoding': encoding,
                 'start': start,
                 'end': end
             });

package/lib/kv.d.ts

@@ -118,6 +118,11 @@ export declare class Kv {
      * @param key
      */
     getJson(key: string): Promise<any | false | null>;
+    /**
+     * --- 原子获取并删除 JSON 对象 ---
+     * @param key 键
+     */
+    getDelJson(key: string): Promise<any | false | null>;
     /**
      * --- 删除已存在的值 ---
      * @param keys

package/lib/kv.js

@@ -37,7 +37,7 @@ export class Kv {
         if (!conn) {
             return false;
         }
-        return conn.pipeline();
+        return conn.createPipelineClient();
     }
     /**
      * --- 设定一个值 ---
@@ -272,6 +272,26 @@ end`;
         const r = lText.parseJson(v);
         return r;
     }
+    /**
+     * --- 原子获取并删除 JSON 对象 ---
+     * @param key 键
+     */
+    async getDelJson(key) {
+        const conn = await this._getConnection();
+        if (!conn) {
+            return false;
+        }
+        try {
+            const value = await conn.getAndDel(this._etc.pre + key);
+            if (value === null) {
+                return null;
+            }
+            return lText.parseJson(value);
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * --- 删除已存在的值 ---
      * @param keys

package/lib/net/formdata.d.ts

@@ -1,83 +1,4 @@
 /**
- * Project: Kebab, User: JianSuoQiYue
- * Date: 2020-04-07 23:45:03
- * Last: 2020-04-07 23:45:07, 2022-09-10 01:35:25
+ * --- 兼容旧版 net 模块的 FormData 导出，统一复用 undici 实现 ---
  */
-import * as stream from 'stream';
-/** --- Item 对象 --- */
-export type IItem = {
-    /** --- key 键 --- */
-    'key': string;
-    'type': 'string';
-    /** --- 字符串值 --- */
-    'value': string;
-    'path': '';
-} | {
-    /** --- key 键 --- */
-    'key': string;
-    'type': 'file';
-    /** --- 文件名 --- */
-    'value': string;
-    /** --- 文件路径 --- */
-    'path': string;
-} | {
-    /** --- key 键 --- */
-    'key': string;
-    'type': 'buffer';
-    /** --- 文件名 --- */
-    'value': string;
-    /** --- Buffer 数据 --- */
-    'path': Buffer;
-};
-export declare class FormData extends stream.Readable {
-    /** --- read 调用次数 --- */
-    private _num;
-    /** --- 要编译的数据 --- */
-    private readonly _data;
-    /** --- 分隔符 --- */
-    private readonly _boundary;
-    /** --- 正在读取文件吗 --- */
-    private _fileReading;
-    /** --- 是否已经结束 --- */
-    private _close;
-    /** --- 总字节长度 --- */
-    private _length;
-    /** --- 已发送字节长度 --- */
-    private _sent;
-    /**
-     * --- 添加字符串 ---
-     * @param key 键
-     * @param val 值
-     */
-    putString(key: string, val: string): void;
-    /**
-     * --- 添加文件 ---
-     * @param key 键
-     * @param path 路径
-     * @param fname 可选，文件名
-     */
-    putFile(key: string, path: string, fname?: string): Promise<boolean>;
-    /**
-     * --- 添加 Buffer 数据 ---
-     * @param key 键
-     * @param buffer Buffer 数据
-     * @param fname 文件名
-     */
-    putBuffer(key: string, buffer: Buffer, fname: string): void;
-    /**
-     * --- 获取 boundary ---
-     */
-    getBoundary(): string;
-    /**
-     * --- 获取总字节长度 ---
-     */
-    getLength(): number;
-    /**
-     * --- 获取已发送的字节长度 ---
-     */
-    getSent(): number;
-    /**
-     * --- 间隔读取（on data 或 pipe 触发）---
-     */
-    _read(): void;
-}
+export * from '#kebab/lib/undici/formdata.js';

package/lib/net/formdata.js

@@ -1,166 +1,4 @@
 /**
- * Project: Kebab, User: JianSuoQiYue
- * Date: 2020-04-07 23:45:03
- * Last: 2020-04-07 23:45:07, 2022-09-10 01:35:25
+ * --- 兼容旧版 net 模块的 FormData 导出，统一复用 undici 实现 ---
  */
-import * as stream from 'stream';
-import * as mime from '@litert/mime';
-import * as core from '#kebab/lib/core.js';
-import * as fs from '#kebab/lib/fs.js';
-export class FormData extends stream.Readable {
-    /** --- read 调用次数 --- */
-    _num = 0;
-    /** --- 要编译的数据 --- */
-    _data = [];
-    /** --- 分隔符 --- */
-    _boundary = '----Kebab' + core.random(29, core.RANDOM_LUN);
-    /** --- 正在读取文件吗 --- */
-    _fileReading = false;
-    /** --- 是否已经结束 --- */
-    _close = false;
-    /** --- 总字节长度 --- */
-    _length = 4 + this._boundary.length;
-    /** --- 已发送字节长度 --- */
-    _sent = 0;
-    /**
-     * --- 添加字符串 ---
-     * @param key 键
-     * @param val 值
-     */
-    putString(key, val) {
-        this._data.push({
-            'key': key,
-            'type': 'string',
-            'value': val,
-            'path': ''
-        });
-        this._length += this._boundary.length + 49 + Buffer.byteLength(key) + Buffer.byteLength(val);
-    }
-    /**
-     * --- 添加文件 ---
-     * @param key 键
-     * @param path 路径
-     * @param fname 可选，文件名
-     */
-    async putFile(key, path, fname) {
-        path = path.replace(/\\/g, '/');
-        const stat = await fs.stats(path);
-        if (!stat) {
-            return false;
-        }
-        if (!fname) {
-            const lio = path.lastIndexOf('/');
-            fname = lio === -1 ? path : path.slice(lio + 1);
-        }
-        this._data.push({
-            'key': key,
-            'type': 'file',
-            'value': fname,
-            'path': path
-        });
-        this._length += this._boundary.length +
-            76 + Buffer.byteLength(key) + Buffer.byteLength(fname) +
-            mime.getMime(fname).length + stat.size + 2;
-        return true;
-    }
-    /**
-     * --- 添加 Buffer 数据 ---
-     * @param key 键
-     * @param buffer Buffer 数据
-     * @param fname 文件名
-     */
-    putBuffer(key, buffer, fname) {
-        this._data.push({
-            'key': key,
-            'type': 'buffer',
-            'value': fname,
-            'path': buffer
-        });
-        this._length += this._boundary.length +
-            76 + Buffer.byteLength(key) + Buffer.byteLength(fname) +
-            mime.getMime(fname).length + buffer.byteLength + 2;
-    }
-    /**
-     * --- 获取 boundary ---
-     */
-    getBoundary() {
-        return this._boundary;
-    }
-    /**
-     * --- 获取总字节长度 ---
-     */
-    getLength() {
-        return this._length;
-    }
-    /**
-     * --- 获取已发送的字节长度 ---
-     */
-    getSent() {
-        return this._sent;
-    }
-    /**
-     * --- 间隔读取（on data 或 pipe 触发）---
-     */
-    // eslint-disable-next-line @typescript-eslint/naming-convention
-    _read() {
-        if (this._close) {
-            // --- 结束了 ---
-            this.push(null);
-            return;
-        }
-        // --- 文件读取中 ---
-        if (this._fileReading) {
-            // --- 等待下面 fileReadable 的 on data 或 end 事件 ---
-            return;
-        }
-        // --- 获取当前 item ---
-        const item = this._data[this._num];
-        if (!item) {
-            this._close = true;
-            const push = `--${this._boundary}--`;
-            this._sent += Buffer.byteLength(push);
-            this.push(push);
-            return;
-        }
-        if (item.type === 'buffer') {
-            // --- Buffer 数据 ---
-            const push = `--${this._boundary}\r\nContent-Disposition: form-data; name="${item.key}"; filename="${item.value}"\r\nContent-Type: ${mime.getMime(item.value)}\r\n\r\n`;
-            this._sent += Buffer.byteLength(push);
-            this.push(push);
-            this._sent += item.path.byteLength;
-            this.push(item.path);
-            const pushEnd = '\r\n';
-            this._sent += Buffer.byteLength(pushEnd);
-            this.push(pushEnd);
-        }
-        else if (item.type === 'string') {
-            // --- 字段 ---
-            const push = `--${this._boundary}\r\nContent-Disposition: form-data; name="${item.key}"\r\n\r\n${item.value}\r\n`;
-            this._sent += Buffer.byteLength(push);
-            this.push(push);
-        }
-        else {
-            // --- 文件 ---
-            const push = `--${this._boundary}\r\nContent-Disposition: form-data; name="${item.key}"; filename="${item.value}"\r\nContent-Type: ${mime.getMime(item.value)}\r\n\r\n`;
-            this._sent += Buffer.byteLength(push);
-            this.push(push);
-            // --- 创建流 ---
-            this._fileReading = true;
-            const fileReadable = fs.createReadStream(item.path);
-            fileReadable.on('data', (chunk) => {
-                if (!(chunk instanceof Buffer)) {
-                    return;
-                }
-                this._sent += chunk.byteLength;
-                this.push(chunk);
-            });
-            fileReadable.on('end', () => {
-                this._fileReading = false;
-                const push = '\r\n';
-                this._sent += Buffer.byteLength(push);
-                this.push(push);
-            });
-        }
-        ++this._num;
-    }
-}
+export * from '#kebab/lib/undici/formdata.js';

package/lib/net.js

@@ -436,7 +436,17 @@ export async function request(u, data, opt = {}) {
         return res;
     }
     // --- 哦，要追踪 ---
-    headers['referer'] = u;
+    const nextUrl = lText.urlResolve(u, req.headers['location']);
+    if (lText.isSameOrigin(u, nextUrl)) {
+        headers['referer'] = u;
+    }
+    else {
+        // --- 跨域跳转不得携带来源站点凭据 ---
+        delete headers['authorization'];
+        delete headers['proxy-authorization'];
+        delete headers['cookie'];
+        delete headers['referer'];
+    }
     let nextMethod = method;
     let nextData = data;
     const status = res.headers['http-code'];
@@ -444,7 +454,11 @@ export async function request(u, data, opt = {}) {
         nextMethod = 'GET';
         nextData = undefined;
     }
-    return request(lText.urlResolve(u, req.headers['location']), nextData, {
+    if (nextData instanceof stream.Readable) {
+        return res;
+    }
+    req.getStream().resume();
+    return request(nextUrl, nextData, {
         'method': nextMethod,
         'type': type,
         'timeout': timeout,

package/lib/ratelimit.js

@@ -8,8 +8,8 @@ import * as lCore from '#kebab/lib/core.js';
  * @returns 返回结果对象
  */
 export async function check(kv, key, opt = {}) {
-    const window = opt.window ?? 60;
-    const max = opt.max ?? 60;
+    const window = Math.max(Math.floor(opt.window ?? 60), 1);
+    const max = Math.max(Math.floor(opt.max ?? 60), 1);
     const pre = opt.pre ?? 'rl:';
     const now = lTime.stamp();
     /** --- 将窗口分为 6 个子段 --- */
@@ -20,7 +20,7 @@ export async function check(kv, key, opt = {}) {
     const segCount = Math.ceil(window / segSize);
     /** --- 统计各段请求数总和 --- */
     let total = 0;
-    for (let i = 0; i < segCount; ++i) {
+    for (let i = 1; i < segCount; ++i) {
         const segKey = `${pre}${key}:${segId - i}`;
         const val = await kv.get(segKey);
         if (val) {
@@ -43,7 +43,7 @@ export async function check(kv, key, opt = {}) {
     if (count === 1) {
         await kv.expire(currentSegKey, window + segSize);
     }
-    total += 1;
+    total += count;
     const allowed = total <= max;
     return {
         'allowed': allowed,
@@ -59,8 +59,8 @@ export async function check(kv, key, opt = {}) {
  * @param opt 限速选项
  */
 export async function checkFixed(kv, key, opt = {}) {
-    const window = opt.window ?? 60;
-    const max = opt.max ?? 60;
+    const window = Math.max(Math.floor(opt.window ?? 60), 1);
+    const max = Math.max(Math.floor(opt.max ?? 60), 1);
     const pre = opt.pre ?? 'rl:';
     const now = lTime.stamp();
     const rkey = pre + key;

package/lib/scan.js

@@ -84,8 +84,15 @@ export class Scan {
                 this._sql.delete(this._name).where({
                     'id': data['id']
                 });
-                const r = lText.parseJson(data['data']);
-                return r === false ? -3 : r;
+                const parsed = lText.parseJson(data['data']);
+                if (parsed === false) {
+                    return -3;
+                }
+                const deleted = await this._link.execute(this._sql.getSql(), this._sql.getData());
+                if (deleted.error || !deleted.packet?.affected) {
+                    return -3;
+                }
+                return parsed;
             }
             else if (data['time_update'] > 0) {
                 // --- 已被扫描 ---
@@ -109,9 +116,15 @@ export class Scan {
             }
             this._timeLeft = ttl;
             if (data['data'] !== null) {
-                // --- 已经写入数据了，删除数据库条目并返回写入的数据内容 ---
-                await this._link.del('scan-' + this._name + '_' + this._token);
-                return data;
+                // --- 原子获取并删除，确保并发轮询时结果只被消费一次 ---
+                const consumed = await this._link.getDelJson('scan-' + this._name + '_' + this._token);
+                if ((consumed === false) ||
+                    (consumed === null) ||
+                    (typeof consumed !== 'object') ||
+                    (consumed['data'] === null)) {
+                    return -3;
+                }
+                return consumed['data'];
             }
             else if (data['time_update'] > 0) {
                 // --- 已被扫描 ---

package/lib/session.js

@@ -177,6 +177,8 @@ export class Session {
             'ttl': this._ttl,
             'domain': opt.domain,
             'ssl': ssl,
+            'httponly': true,
+            'samesite': 'Lax',
         });
         return true;
     }

package/lib/text.d.ts

@@ -19,6 +19,12 @@ export declare function parseHost(host: string): {
  * @param url
  */
 export declare function parseUrl(url: string): kebab.IUrlParse;
+/**
+ * --- 判断两个 URL 是否属于同源地址 ---
+ * @param from 来源 URL
+ * @param to 目标 URL
+ */
+export declare function isSameOrigin(from: string, to: string): boolean;
 /**
  * --- 将相对路径根据基准路径进行转换 ---
  * @param from 基准路径

package/lib/text.js

@@ -118,6 +118,24 @@ export function parseUrl(url) {
     rtn['path'] = rtn['pathname'] + (rtn['query'] ? '?' + rtn['query'] : '');
     return rtn;
 }
+/**
+ * --- 判断两个 URL 是否属于同源地址 ---
+ * @param from 来源 URL
+ * @param to 目标 URL
+ */
+export function isSameOrigin(from, to) {
+    const fromUri = parseUrl(from);
+    const toUri = parseUrl(to);
+    const getPort = (uri) => {
+        if (uri.port) {
+            return uri.port;
+        }
+        return uri.protocol === 'https:' ? '443' : '80';
+    };
+    return ((fromUri.protocol === toUri.protocol) &&
+        (fromUri.hostname === toUri.hostname) &&
+        (getPort(fromUri) === getPort(toUri)));
+}
 /** --- 限定结果不能逃逸出基准路径 --- */
 function urlResolveLimit(from, limit, rtn) {
     if (!limit) {
@@ -422,15 +440,25 @@ export function queryParse(query) {
         catch {
             value = pos === -1 ? '' : i.slice(pos + 1);
         }
-        if (arrayKeys[key]) {
+        if (Object.hasOwn(arrayKeys, key)) {
             ret[key].push(value);
         }
-        else if (undefined === ret[key]) {
-            ret[key] = value;
+        else if (!Object.hasOwn(ret, key)) {
+            Object.defineProperty(ret, key, {
+                'configurable': true,
+                'enumerable': true,
+                'value': value,
+                'writable': true,
+            });
         }
         else {
             ret[key] = [ret[key], value];
-            arrayKeys[key] = true;
+            Object.defineProperty(arrayKeys, key, {
+                'configurable': true,
+                'enumerable': true,
+                'value': true,
+                'writable': true,
+            });
         }
     }
     return ret;
@@ -444,7 +472,12 @@ export function htmlescape(html) {
     if (type !== 'string') {
         return '[' + type + ']';
     }
-    return html.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/'/g, '&quot;');
+    return html
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
 }
 /** --- CSV 特殊字符转换为实体字符 --- */
 export function csvescape(str) {
@@ -568,7 +601,7 @@ export function parseJson(str) {
             }
             const ints = v.slice(10);
             const int = parseInt(ints);
-            if (int <= Number.MAX_SAFE_INTEGER) {
+            if ((int >= Number.MIN_SAFE_INTEGER) && (int <= Number.MAX_SAFE_INTEGER)) {
                 return int;
             }
             return BigInt(ints);

package/lib/undici/response.js

@@ -70,7 +70,6 @@ export class Response {
     /**
      * --- 获取响应读取流对象 ---
      */
-    // eslint-disable-next-line @typescript-eslint/explicit-function-return-type
     getStream() {
         try {
             // --- 要解压 ---
@@ -103,7 +102,6 @@ export class Response {
     /**
      * --- 获取原生响应读取流对象 ---
      */
-    // eslint-disable-next-line @typescript-eslint/explicit-function-return-type
     getRawStream() {
         return this._req ? this._req.body : null;
     }