@tencentcloudadp/cli 0.1.1 → 0.1.2

package/dist/cli.js

@@ -1688,6 +1688,7 @@ function createLocalCredentialForm() {
 }
 async function openForm(input) {
   const token = randomBytes(32).toString("base64url");
+  const csrf = randomBytes(32).toString("base64url");
   const expectedPath = `/login/${token}`;
   let host = "";
   let state = "open";
@@ -1699,7 +1700,7 @@ async function openForm(input) {
   const server = createServer((req, res) => {
     void handle(req, res).catch(() => {
       if (!res.headersSent) {
-        send(res, 500, page({ error: "Internal error" }));
+        send(res, 500, page({ error: "Internal error", csrf }));
       }
     });
   });
@@ -1718,19 +1719,15 @@ async function openForm(input) {
       return;
     }
     if (req.method === "GET") {
-      send(res, 200, page({ site: input.defaultSite }));
+      send(res, 200, page({ site: input.defaultSite, csrf }));
       return;
     }
     if (req.method !== "POST") {
       send(res, 405, "Method not allowed", "text/plain");
       return;
     }
-    if (!isSameOrigin(req, host)) {
-      send(res, 403, "Cross-origin request rejected", "text/plain");
-      return;
-    }
     if (state === "verifying") {
-      send(res, 409, page({ error: "A submission is already being verified. Wait a moment and reload." }));
+      send(res, 409, page({ error: "A submission is already being verified. Wait a moment and reload.", csrf }));
       return;
     }
     const body = await readBody(req);
@@ -1738,9 +1735,17 @@ async function openForm(input) {
       send(res, 413, "Request body too large", "text/plain");
       return;
     }
-    const parsed = parseSubmission(new URLSearchParams(body));
+    const params = new URLSearchParams(body);
+    if (!isSameOrigin(req, host) && !sameSecret(params.get("csrf") ?? "", csrf)) {
+      send(res, 403, page({
+        error: "\u6D4F\u89C8\u5668\u628A\u8FD9\u6B21\u63D0\u4EA4\u5F53\u6210\u4E86\u8DE8\u7AD9\u8BF7\u6C42\u3002\u8BF7\u5728\u672C\u9875\u91CD\u65B0\u586B\u5199\u5E76\u70B9\u300C\u9A8C\u8BC1\u5E76\u4FDD\u5B58\u300D\u3002",
+        csrf
+      }));
+      return;
+    }
+    const parsed = parseSubmission(params);
     if ("error" in parsed) {
-      send(res, 400, page({ error: parsed.error, site: parsed.site, secretId: parsed.secretId }));
+      send(res, 400, page({ error: parsed.error, site: parsed.site, secretId: parsed.secretId, csrf }));
       return;
     }
     state = "verifying";
@@ -1749,7 +1754,7 @@ async function openForm(input) {
     } catch (error) {
       state = "open";
       const message = error instanceof Error ? error.message : "Verification failed";
-      send(res, 400, page({ error: message, site: parsed.credential.site, secretId: parsed.credential.secretId }));
+      send(res, 400, page({ error: message, site: parsed.credential.site, secretId: parsed.credential.secretId, csrf }));
       return;
     }
     state = "done";
@@ -1850,6 +1855,11 @@ body{font:14px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;max-wi
 label{display:block;margin:14px 0 4px;font-weight:600}input,select{width:100%;padding:8px;box-sizing:border-box;border:1px solid #c9cdd4;border-radius:6px;font:inherit}
 button{margin-top:20px;padding:9px 18px;border:0;border-radius:6px;background:#0052d9;color:#fff;font:inherit;cursor:pointer}
 .err{background:#fff1f0;border:1px solid #ffccc7;padding:8px 12px;border-radius:6px}.hint{color:#646a73;font-size:13px}
+.site-hint,.endpoint-field{display:none}
+form:has(#site option[value="cloud"]:checked) .hint-cloud,
+form:has(#site option[value="independent"]:checked) .hint-independent,
+form:has(#site option[value="custom"]:checked) .hint-custom,
+form:has(#site option[value="custom"]:checked) .endpoint-field{display:block}
 </style></head><body>${body}</body></html>`;
 }
 function form(input) {
@@ -1859,15 +1869,20 @@ function form(input) {
 <p class="hint">\u51ED\u636E\u53EA\u4FDD\u5B58\u5728\u672C\u673A\uFF08~/.adp/profiles\uFF0C\u6743\u9650 0600\uFF09\uFF0C\u4E0D\u4F1A\u53D1\u9001\u5230\u5BF9\u8BDD\u3002\u8BF7\u4E0D\u8981\u628A\u5BC6\u94A5\u7C98\u8D34\u5230\u804A\u5929\u91CC\u3002</p>
 ${input.error ? `<p class="err">${escapeHtml(input.error)}</p>` : ""}
 <form method="post" autocomplete="off">
+<input type="hidden" name="csrf" value="${escapeHtml(input.csrf ?? "")}">
 <label for="site">\u7AD9\u70B9</label>
 <select id="site" name="site">${option("cloud", "\u516C\u6709\u4E91\uFF08adp.tencentcloudapi.com\uFF09")}${option("independent", "\u72EC\u7ACB\u7AD9\uFF08capi.adp.tencent.com\uFF09")}${option("custom", "\u81EA\u5B9A\u4E49\u5730\u5740")}</select>
-<label for="endpoint">\u81EA\u5B9A\u4E49\u5730\u5740\uFF08\u4EC5\u81EA\u5B9A\u4E49\u7AD9\u70B9\uFF09</label>
+<div class="endpoint-field">
+<label for="endpoint">\u81EA\u5B9A\u4E49\u5730\u5740</label>
 <input id="endpoint" name="endpoint" placeholder="capi.internal.example.com">
+</div>
 <label for="secretId">SecretId</label>
-<input id="secretId" name="secretId" required value="${escapeHtml(input.secretId ?? "")}" placeholder="\u516C\u6709\u4E91 CAM \u5BC6\u94A5\u4EE5 AKID \u5F00\u5934">
+<input id="secretId" name="secretId" required value="${escapeHtml(input.secretId ?? "")}">
 <label for="secretKey">SecretKey</label>
 <input id="secretKey" name="secretKey" type="password" required>
-<p class="hint">\u516C\u6709\u4E91\u5BC6\u94A5\u5728 <a href="https://console.cloud.tencent.com/cam/capi" target="_blank" rel="noreferrer">CAM \u63A7\u5236\u53F0</a> \u521B\u5EFA\u3002</p>
+<p class="hint site-hint hint-cloud">\u516C\u6709\u4E91\u5BC6\u94A5\u5728 <a href="https://console.cloud.tencent.com/cam/capi" target="_blank" rel="noreferrer">CAM \u63A7\u5236\u53F0</a> \u521B\u5EFA\uFF0CSecretId \u4EE5 AKID \u5F00\u5934\u3002</p>
+<p class="hint site-hint hint-independent">\u72EC\u7ACB\u7AD9\u5BC6\u94A5\u5728 <a href="https://adp.tencent.com/adp#/key-manage" target="_blank" rel="noreferrer">\u4F01\u4E1A\u7BA1\u7406 \u2192 \u5BC6\u94A5\u7BA1\u7406 \u2192 \u65B0\u5EFAAPI\u5BC6\u94A5</a>\uFF0C\u4E0D\u8981\u6C42 AKID \u524D\u7F00\u3002</p>
+<p class="hint site-hint hint-custom">\u4F7F\u7528\u76EE\u6807\u73AF\u5883\u7B7E\u53D1\u7684 SecretId / SecretKey\u3002</p>
 <button type="submit">\u9A8C\u8BC1\u5E76\u4FDD\u5B58</button>
 </form>`;
 }