@moonquake2004/dsh-security 0.1.6 → 0.2.0

package/src/checks/sp12-config-as-code-tag.mjs

@@ -0,0 +1,125 @@
+/**
+ * SP12: `!!js` 配置即代码标签 + `dsh.bundle.patch` 路径健全性
+ *
+ * 威胁（#454 / #587 / #3354）：宿主用 js-yaml 解析 patch，并**支持 `!!js` 标签**——
+ * 该标签会在**加载期求值任意 JavaScript**。也就是说一个插件的 cordis.patch.yml 里写
+ *   mode: !!js <任意表达式>
+ * 就能在 boot 时执行代码（已实测的宿主 RCE 面）。SP4 的正则只看投毒关键词，**不识别 `!!js` 标签本身**，
+ * 也不区分"第三方层"与"用户自己写的 patch"。
+ *
+ * 另查 `dsh.bundle.patch` 的路径健全性：声明的 patch 必须存在且不逃出包目录（`../` 逃逸 = 越权读宿主文件）。
+ *
+ * 分级：第三方 bundle → error（用户未同意）；用户自有 patch → 提示（用户有权自己写 JS）。
+ * Severity: CRITICAL  Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync, realpathSync, readdirSync } from 'node:fs';
+import { join, resolve, relative } from 'node:path';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { collectPatchLayers } from './sp11-patch-security-override.mjs';
+
+/** 找出 `!!js` 标签出现处（行级，带上下文），排除注释行 */
+export function jsTagHits(text) {
+  const hits = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i].trim();
+    if (!t || t.startsWith('#')) continue;
+    if (/!!js\b/.test(t)) hits.push({ line: i + 1, text: t.slice(0, 120) });
+  }
+  return hits;
+}
+
+/** 检查每个已装 bundle 的 dsh.bundle.patch 是否健在且未逃出包目录。 */
+export function bundlePatchIssues(profileDir) {
+  const issues = [];
+  const nmDir = join(profileDir, 'node_modules');
+  if (!existsSync(nmDir)) return issues;
+  let entries = [];
+  try { entries = readdirSync(nmDir, { withFileTypes: true }); } catch { return issues; }
+
+  const checkPkg = (dir, name) => {
+    const manifest = join(dir, 'package.json');
+    if (!existsSync(manifest)) return;
+    let pkg;
+    try { pkg = JSON.parse(readFileSync(manifest, 'utf8')); } catch { return; }
+    const declared = pkg?.dsh?.bundle?.patch ?? pkg?.dsh?.bundle;
+    const rel = typeof declared === 'string' ? declared : (declared && typeof declared.patch === 'string' ? declared.patch : null);
+    if (!rel) return;
+    const target = resolve(dir, rel);
+    if (!existsSync(target)) { issues.push(`${name}: dsh.bundle.patch 指向的 ${rel} 不存在（安装不完整）`); return; }
+    // 两侧都必须做 realpath：macOS 的 /var → /private/var 等 symlink 会让单侧解析出假的 `../..`
+    let realDir = resolve(dir);
+    let realTarget = target;
+    try { realDir = realpathSync(dir); } catch { /* 用 resolve 结果 */ }
+    try { realTarget = realpathSync(target); } catch { /* 用 resolve 结果 */ }
+    if (relative(realDir, realTarget).startsWith('..')) {
+      issues.push(`${name}: dsh.bundle.patch 指向包目录之外（${rel}）——可读宿主任意文件`);
+    }
+  };
+
+  for (const entry of entries) {
+    if (entry.name.startsWith('.')) continue;
+    if (entry.name.startsWith('@')) {
+      const scopeDir = join(nmDir, entry.name);
+      let pkgs = [];
+      try { pkgs = readdirSync(scopeDir, { withFileTypes: true }); } catch { continue; }
+      for (const p of pkgs) checkPkg(join(scopeDir, p.name), `${entry.name}/${p.name}`);
+    } else {
+      checkPkg(join(nmDir, entry.name), entry.name);
+    }
+  }
+  return issues;
+}
+
+export async function run(profileDir) {
+  const id = 'SP12';
+  if (!profileDir || !existsSync(profileDir)) {
+    return skip(id, Severity.CRITICAL, '无 profile 目录，跳过 !!js 配置即代码检测');
+  }
+
+  const layers = collectPatchLayers(profileDir);
+  const bundleHits = [];
+  const userHits = [];
+  for (const { file, layer, pkg } of layers) {
+    let text;
+    try { text = readFileSync(file, 'utf8'); } catch { continue; }
+    const hits = jsTagHits(text);
+    if (!hits.length) continue;
+    const sample = hits.slice(0, 3).map((h) => `行${h.line}: ${h.text}`).join('; ');
+    if (layer === 'bundle') bundleHits.push(`${pkg || file}（${sample}）`);
+    else userHits.push(`${file}（${sample}）`);
+  }
+
+  const patchIssues = bundlePatchIssues(profileDir);
+
+  if (bundleHits.length > 0 || patchIssues.length > 0) {
+    const parts = [];
+    if (bundleHits.length) {
+      parts.push(`第三方 patch 使用 !!js 标签（**加载期执行任意 JavaScript**，#454/#587/#3354）：\n  ${bundleHits.join('\n  ')}`);
+    }
+    if (patchIssues.length) parts.push(`dsh.bundle.patch 路径异常：\n  ${patchIssues.join('\n  ')}`);
+    return fail(id, Severity.CRITICAL,
+      parts.join('\n') + (userHits.length ? `\n（用户自有 patch 另有 !!js ${userHits.length} 处，属用户自主配置）` : ''),
+      '要求该插件移除 !!js 标签（改用静态配置值）；若确需动态配置，应由用户在自己的 profile patch 里写。'
+      + '同时修正 dsh.bundle.patch 指向，使其存在于包内',
+      ['#454', '#587', '#3354']
+    );
+  }
+
+  const note = userHits.length ? `；用户自有 patch 含 ${userHits.length} 处 !!js（用户自主配置，仅提示）` : '';
+  return pass(id, Severity.CRITICAL,
+    `扫描 ${layers.length} 个 patch 层：第三方层无 !!js 标签；${patchIssues.length === 0 ? 'dsh.bundle.patch 路径均健全' : ''}${note}`);
+}
+
+export const sp12Check = {
+  id: 'SP12',
+  name: 'config-as-code-tag',
+  severity: Severity.CRITICAL,
+  phase: CheckPhase.POST_INSTALL,
+  description: '!!js 配置即代码（加载期执行 JS，实测宿主 RCE 面）+ dsh.bundle.patch 路径健全性（#454/#587/#3354）',
+  src: 'builtin',
+  runner: (profileDir) => run(profileDir),
+};