@zhangfengshun/dsh-remote-ssh 2.3.7 → 2.3.9

package/lib/index.js

@@ -336,8 +336,22 @@ class CommandSession {
   }
 }
 
+/** Windows 下优先解析系统自带 OpenSSH 的绝对路径：从 git-bash 启动 dsh web 时，
+ *  子进程 PATH 会把 Git 自带的 MSYS2 ssh 排在系统 OpenSSH 之前（HOME/config/agent
+ *  语义不同，导致密钥认证失败——issue：git-bash 启动场景）。System32\OpenSSH 是
+ *  Win10 1809+ 的标准安装位置，不存在则回落 PATH（维持旧行为）。结果模块级缓存。 */
+let cachedSshPath;
+function sshExecutablePath() {
+  if (cachedSshPath !== undefined) return cachedSshPath;
+  if (process.platform === "win32") {
+    const sysSsh = join(process.env.SystemRoot || "C:\\Windows", "System32", "OpenSSH", "ssh.exe");
+    if (existsSync(sysSsh)) return (cachedSshPath = sysSsh);
+  }
+  return (cachedSshPath = "ssh");
+}
+
 function sshArgv(p, remoteCmd, tty, extraOpts) {
-  const opts = ["ssh"];
+  const opts = [sshExecutablePath()];
   if (tty) opts.push("-tt");
   opts.push("-p", String(p.port || 22));
   opts.push("-o", "StrictHostKeyChecking=accept-new");
@@ -945,13 +959,18 @@ function normExec(r) {
 // HTTP 工具
 // ---------------------------------------------------------------------------
 
-function isTrusted(req) {
+function isTrusted(req, requireRequestedWith) {
   const secFetchSite = req.headers["sec-fetch-site"];
   if (secFetchSite === "cross-site") return false;
   const host = req.headers["host"];
   if (!host) return false;
   const hostname = String(host).split(":")[0].replace(/^\[/, "").replace(/\]$/, "");
-  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0") return true;
+  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0") {
+    // CSRF 加固（PR #4 的服务端半边）：/remote-ssh/api/* 仅由本插件客户端调用，
+    // 其请求必带 x-requested-with；跨站 no-cors POST 无法携带非简单头，预检也会被拒。
+    if (requireRequestedWith && String(req.headers["x-requested-with"] || "").trim() !== "XMLHttpRequest") return false;
+    return true;
+  }
   return false;
 }
 
@@ -1503,7 +1522,9 @@ function apply(ctx, config) {
     kind: "prefix",
     path: "/remote-ssh/api",
     handler: async (req, res) => {
-      if (!isTrusted(req)) { writeError(res, new Error("forbidden"), 403); return; }
+      // CSRF 加固：/remote-ssh/api/* 仅由本插件客户端调用，强制校验其必带的
+      // x-requested-with 头（跨站攻击者无法在 no-cors POST 中携带非简单头）。
+      if (!isTrusted(req, true)) { writeJson(res, 403, { ok: false, error: { code: "csrf", message: "missing x-requested-with header" } }); return; }
       if (req.method !== "POST") { writeError(res, new Error("method not allowed"), 405); return; }
       const pathname = new URL(req.url || "/", "http://dsh.internal").pathname;
       if (!pathname.startsWith(API_BASE)) { writeError(res, new Error("not-found"), 404); return; }
@@ -1847,10 +1868,13 @@ function apply(ctx, config) {
     "    const j = JSON.parse(fs.readFileSync(info, 'utf8'));",
     "    if (j.keyPath && j.keyPath !== '' && j.host && j.user) {",
     "      const port = j.port || 22;",
+    "      // Windows 下优先解析系统自带 OpenSSH 绝对路径（避免 git-bash 启动时解析到 MSYS2 ssh）",
+    "      const sysSsh = path.join(process.env.SystemRoot || 'C:\\\\Windows', 'System32', 'OpenSSH', 'ssh.exe');",
+    "      const sshBin = fs.existsSync(sysSsh) ? sysSsh : 'ssh';",
     "      // ExitOnForwardFailure=no：ssh config 里的 RemoteForward 端口被占时终端仍能打开",
     "      const args = ['-tt', '-o', 'StrictHostKeyChecking=no', '-o', 'ExitOnForwardFailure=no', '-p', String(port), '-i', j.keyPath, j.user + '@' + j.host];",
     "      if (j.proxyJump) { args.splice(2, 0, '-J', j.proxyJump); }",
-    "      const ssh = spawn('ssh', args, { stdio: 'inherit' });",
+    "      const ssh = spawn(sshBin, args, { stdio: 'inherit' });",
     "      ssh.on('exit', function(c) { process.exit(c == null ? 0 : c); });",
     "      return;",
     "    }",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhangfengshun/dsh-remote-ssh",
-  "version": "2.3.7",
+  "version": "2.3.9",
   "description": "DSH web plugin: VSCode Remote-SSH-like remote development (SSH to supercomputers/servers, remote workspace, file explorer, integrated terminal), integrated with dsh-better-sidebar and DSH settings.",
   "keywords": [
     "dsh",