@zhangfengshun/dsh-remote-ssh 2.3.6 → 2.3.8

package/lib/index.js

@@ -216,7 +216,7 @@ class CommandSession {
     });
     const onEnd = () => {
       this.alive = false;
-      const errMsg = "ssh 会话已关闭" + (this.errBuf.trim() ? ": " + this.errBuf.trim().slice(-300) : "");
+      const errMsg = "ssh 会话已关闭" + (this.errBuf.trim() ? ": " + stripPqBanner(this.errBuf).trim().slice(-300) : "");
       if (this.current) { this.current.reject(new Error(errMsg)); this.current = null; }
       while (this.queue.length) this.queue.shift().reject(new Error(errMsg));
     };
@@ -336,7 +336,7 @@ class CommandSession {
   }
 }
 
-function sshArgv(p, remoteCmd, tty) {
+function sshArgv(p, remoteCmd, tty, extraOpts) {
   const opts = ["ssh"];
   if (tty) opts.push("-tt");
   opts.push("-p", String(p.port || 22));
@@ -356,6 +356,7 @@ function sshArgv(p, remoteCmd, tty) {
     opts.push("-o", "BatchMode=yes");
     opts.push("-o", "PreferredAuthentications=publickey");
   }
+  if (Array.isArray(extraOpts) && extraOpts.length) opts.push(...extraOpts);
   const target = String(p.user || "") + "@" + String(p.host || "");
   const head = (p.authMethod === "password" && p.password) ? ["sshpass", "-p", String(p.password)] : [];
   const argv = head.concat(opts, [target]);
@@ -363,12 +364,23 @@ function sshArgv(p, remoteCmd, tty) {
   return argv;
 }
 
-async function runRemote(subprocess, p, remoteCmd, stdinData, maxBytes) {
+/** 过滤 OpenSSH 客户端的“后量子 KEX”警告横幅（stderr 噪音，与认证成败无关，
+ *  混进错误信息会误导用户以为是不支持加密算法）。 */
+function stripPqBanner(text) {
+  return String(text || "")
+    .split("\n")
+    .filter(function (line) {
+      return !/^\s*\*\*\s*(WARNING: connection is not using a post-quantum|This session may be vulnerable to .?store now|The server may need to be upgraded)/i.test(line);
+    })
+    .join("\n");
+}
+
+async function runRemote(subprocess, p, remoteCmd, stdinData, maxBytes, extraOpts) {
   const max = maxBytes || MAX_BYTES;
   let handle;
   try {
     handle = subprocess.spawn({
-      argv: sshArgv(p, remoteCmd, false),
+      argv: sshArgv(p, remoteCmd, false, extraOpts),
       cwd: process.cwd(),
       stdio: {
         stdin: stdinData !== undefined ? { data: String(stdinData) } : "ignore",
@@ -389,7 +401,7 @@ async function runRemote(subprocess, p, remoteCmd, stdinData, maxBytes) {
   const so = (handle.collected && handle.collected.stdout) ? handle.collected.stdout.readFrom(0) : { text: "", nextOffset: 0, lossy: false };
   const se = (handle.collected && handle.collected.stderr) ? handle.collected.stderr.readFrom(0) : { text: "", nextOffset: 0, lossy: false };
   const outText = so.text;
-  const errText = se.text;
+  const errText = stripPqBanner(se.text);
   let error = "";
   if (outcome.exitCode !== 0 && !outText && !errText) {
     error = "ssh 退出码 " + outcome.exitCode + (outcome.signal ? " (signal " + outcome.signal + ")" : "");
@@ -933,13 +945,18 @@ function normExec(r) {
 // HTTP 工具
 // ---------------------------------------------------------------------------
 
-function isTrusted(req) {
+function isTrusted(req, requireRequestedWith) {
   const secFetchSite = req.headers["sec-fetch-site"];
   if (secFetchSite === "cross-site") return false;
   const host = req.headers["host"];
   if (!host) return false;
   const hostname = String(host).split(":")[0].replace(/^\[/, "").replace(/\]$/, "");
-  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0") return true;
+  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0") {
+    // CSRF 加固（PR #4 的服务端半边）：/remote-ssh/api/* 仅由本插件客户端调用，
+    // 其请求必带 x-requested-with；跨站 no-cors POST 无法携带非简单头，预检也会被拒。
+    if (requireRequestedWith && String(req.headers["x-requested-with"] || "").trim() !== "XMLHttpRequest") return false;
+    return true;
+  }
   return false;
 }
 
@@ -1054,12 +1071,12 @@ function apply(ctx, config) {
   }
   /** 把 SSH 常见失败翻译成带修复建议的中文提示。 */
   function sshErrorHint(text) {
-    const t = String(text || "");
+    const t = stripPqBanner(String(text || ""));
     if (/remote port forwarding failed for listen port (\d+)/i.test(t)) {
       const m = t.match(/remote port forwarding failed for listen port (\d+)/i);
       return "SSH 端口转发失败（本地端口 " + m[1] + " 已被占用）。这通常由 ~/.ssh/config 里的 RemoteForward 造成：远端该端口被上次会话占用时，ExitOnForwardFailure yes 会让 ssh 直接退出。本插件已对该连接加 ClearAllForwardings，若仍出现请检查 ssh config。原始信息: " + t.trim().slice(0, 300);
     }
-    if (/permission denied \(publickey/i.test(t)) return "公钥认证失败：请检查 keyPath 私钥路径是否正确、远端 ~/.ssh/authorized_keys 是否包含对应公钥。原始信息: " + t.trim().slice(0, 300);
+    if (/permission denied \(publickey/i.test(t)) return "公钥认证失败（服务器拒绝了公钥）。请依次检查：① keyPath 指向的私钥是否正确、是否带口令——测试连接以批处理模式运行无法交互输口令，可先 ssh-add 加载或改用无口令密钥；② 远端是否收录对应公钥——Windows 主机且目标用户在 Administrators 组时需写入 C:\\ProgramData\\ssh\\administrators_authorized_keys；③ profile 的用户名写法与手动连接是否一致（user / .\\user / user@domain 在 Windows sshd 中解析不同）。原始信息: " + t.trim().slice(0, 300);
     if (/connection refused/i.test(t)) return "连接被拒绝：请确认远端 sshd 已启动且端口正确。原始信息: " + t.trim().slice(0, 300);
     if (/connection timed out|timed out/i.test(t)) return "连接超时：请确认网络可达、端口开放，或检查 ProxyJump 配置。原始信息: " + t.trim().slice(0, 300);
     if (/could not resolve hostname/i.test(t)) return "无法解析主机名：请检查连接配置中的 host 拼写。原始信息: " + t.trim().slice(0, 300);
@@ -1239,7 +1256,26 @@ function apply(ctx, config) {
     testConnection: async (args) => {
       const p = getProfile(args && args.id);
       if (!p) return { ok: false, error: "未找到连接配置" };
-      return await runRemote(subprocess, p, "echo __DSH_OK__; hostname; whoami; pwd; uname -a", undefined, 256 * 1024);
+      // 认证探测只用跨平台 echo：Windows host 无 uname/pwd，且默认 shell 语义各异
+      // （旧命令尾部 uname -a 会让认证成功的 Windows host 也误报失败）。
+      const r = await runRemote(subprocess, p, "echo __DSH_OK__", undefined, 16 * 1024);
+      if (r.ok) return r;
+      const baseErr = sshErrorHint([r.error, stripPqBanner(r.stderr).trim()].filter(Boolean).join(" ") || ("ssh 退出码 " + r.exitCode));
+      // 认证类失败：带 ssh -v 重跑一次握手 + 认证，抽取关键诊断行
+      // （私钥加载 / 公钥提供 / 服务器拒绝方法），定位 Windows 常见坑。
+      let error = baseErr;
+      if (/permission denied|publickey/i.test(baseErr + " " + stripPqBanner(r.stderr))) {
+        const diag = await runRemote(subprocess, p, "exit 0", undefined, 16 * 1024, ["-v"]);
+        const diagText = String(diag.stderr || "")
+          .split("\n")
+          .filter(function (l) {
+            return /debug1: (Offering public key|Authentications that can continue|Server accepts key|Trying private key|no such identity)|Load key|Permission denied|passphrase/i.test(l);
+          })
+          .join("\n")
+          .slice(0, 1200);
+        if (diagText) error = baseErr + "\n\nssh -v 诊断:\n" + diagText;
+      }
+      return { ok: false, exitCode: r.exitCode, signal: r.signal, stdout: r.stdout, stderr: r.stderr, truncated: r.truncated, error: error };
     },
     listWorkspaces: async () => ({ ok: true, workspaces: settingsFace.read().workspaces }),
     createRemoteWorkspace: async (args) => {
@@ -1472,7 +1508,9 @@ function apply(ctx, config) {
     kind: "prefix",
     path: "/remote-ssh/api",
     handler: async (req, res) => {
-      if (!isTrusted(req)) { writeError(res, new Error("forbidden"), 403); return; }
+      // CSRF 加固：/remote-ssh/api/* 仅由本插件客户端调用，强制校验其必带的
+      // x-requested-with 头（跨站攻击者无法在 no-cors POST 中携带非简单头）。
+      if (!isTrusted(req, true)) { writeJson(res, 403, { ok: false, error: { code: "csrf", message: "missing x-requested-with header" } }); return; }
       if (req.method !== "POST") { writeError(res, new Error("method not allowed"), 405); return; }
       const pathname = new URL(req.url || "/", "http://dsh.internal").pathname;
       if (!pathname.startsWith(API_BASE)) { writeError(res, new Error("not-found"), 404); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhangfengshun/dsh-remote-ssh",
-  "version": "2.3.6",
+  "version": "2.3.8",
   "description": "DSH web plugin: VSCode Remote-SSH-like remote development (SSH to supercomputers/servers, remote workspace, file explorer, integrated terminal), integrated with dsh-better-sidebar and DSH settings.",
   "keywords": [
     "dsh",