chanjs 2.7.10 → 2.7.11

package/middleware/waf.js

@@ -1,16 +1,10 @@
-import crypto from "crypto";
 import { getIp } from "../utils/ip.js";
 import { checkKeywords } from "../security/checker.js";
 import { filterXSS } from "../security/xss-filter.js";
 import { createRateLimitMiddleware } from "../security/rate-limit.js";
-import { store } from "../storage/store.js";
 import { CODE_BLOCKED } from "../response/code.js";
 import logger from "../utils/logger.js";
 
-const BLOCK_KEY_PREFIX = "waf:block:";
-const STRIKE_KEY_PREFIX = "waf:strike:";
-
-// 放行路径白名单
 const WAF_PATH_WHITELIST = [
   "/.well-known/appspecific/",
   "/.well-known/change-password",
@@ -22,14 +16,13 @@ const WAF_PATH_WHITELIST = [
 
 const TRUSTED_IPS = new Set(["127.0.0.1", "::1"]);
 
-const DEFAULT_BLOCK = {
-  BLOCK_DURATION: 30 * 60 * 1000,
-  STRIKE_THRESHOLD: 3,
-  STRIKE_WINDOW: 60 * 60 * 1000,
-};
+// URL/query 关键词检测保留的分类——只保留真正危险、几乎不会在正常 URL 中出现的攻击特征。
+// 去掉 wholeWord / extensions / directories / sensitiveIdentifiers / commandInjection，
+// 这些在正常 URL（?debug=1、/internal/、/.well-known/、wget/scp/dd 等）极易误伤正常请求。
+const URL_SCAN_CATEGORIES = ["sqlInjection", "xss", "pathTraversal", "encoding"];
 
 /**
- * 判断本机回环可信IP：仅 127.0.0.1 / ::1 无条件放行 WAF。
+ * 判断本机回环可信IP：仅 127.0.0.1 / ::1 无条件放行 WAF 的 query 关键词检测与 XSS 净化。
  * 不再放行整个内网段（如 10.x、192.168.x、172.16-31.x），
  * 否则当 Nginx 部署在另一台内网机、Express 未解析 XFF 时，全站 WAF 会静默失效。
  */
@@ -43,12 +36,6 @@ const isTrustedIp = ip => {
  */
 const isWhitelistedPath = path => WAF_PATH_WHITELIST.some(p => path === p || path.startsWith(p));
 
-/**
- * IP+UA指纹 sha256(前32位)
- */
-const buildFingerprint = (ip, ua = "") =>
-  crypto.createHash("sha256").update(`${ip}|${ua}`).digest("hex").slice(0, 32);
-
 /**
  * 覆盖Express5只读req.query
  */
@@ -68,22 +55,8 @@ const respondWaf = (res, status, msg, data) =>
   res.status(status).json({ code: CODE_BLOCKED, success: false, msg, data });
 
 /**
- * 关键词命中计数+封禁逻辑
+ * 限流，返回是否已响应
  */
-async function handleStrike(fingerprint, clientIp, keyword, blockCfg) {
-  const strikeKey = `${STRIKE_KEY_PREFIX}${fingerprint}`;
-  const strikes = await store.incrAndExpire(strikeKey, blockCfg.STRIKE_WINDOW);
-
-  if (strikes >= blockCfg.STRIKE_THRESHOLD) {
-    const blockKey = `${BLOCK_KEY_PREFIX}${fingerprint}`;
-    await store.set(blockKey, { ip: clientIp, reason: keyword, expireAt: Date.now() + blockCfg.BLOCK_DURATION }, blockCfg.BLOCK_DURATION);
-    logger.error(`[WAF封禁] IP:${clientIp} 累计命中:${strikes}次 封禁${blockCfg.BLOCK_DURATION / 60000}分钟`);
-    return { blocked: true, strikes };
-  }
-  return { blocked: false, strikes };
-}
-
-/** 执行限流，返回是否已响应 */
 const runRateLimit = (rateLimit, req, res) =>
   new Promise(resolve => rateLimit(req, res, resolve)).then(() => res.headersSent);
 
@@ -92,7 +65,6 @@ const runRateLimit = (rateLimit, req, res) =>
  */
 const createWafMiddleware = wafConfig => {
   const rateLimit = createRateLimitMiddleware(wafConfig.rateLimit);
-  const blockCfg = { ...DEFAULT_BLOCK, ...wafConfig.block };
 
   return async (req, res, next) => {
     try {
@@ -100,8 +72,6 @@ const createWafMiddleware = wafConfig => {
 
       const clientIp = getIp(req);
       const path = req.path || "";
-      const ua = req.headers["user-agent"] || "";
-      const fp = buildFingerprint(clientIp, ua);
       const whitePath = isWhitelistedPath(path);
 
       // 可信IP直接放行，仅做query XSS过滤
@@ -113,32 +83,24 @@ const createWafMiddleware = wafConfig => {
       // 限流
       if (await runRateLimit(rateLimit, req, res)) return;
 
-      // 已封禁直接拦截
-      const blockInfo = await store.get(`${BLOCK_KEY_PREFIX}${fp}`);
-      if (blockInfo) {
-        logger.error(`[WAF拦截封禁] IP:${clientIp} UA:${ua.slice(0, 50)}`);
-        return respondWaf(res, 403, "检测到恶意访问，您的访问已被限制", { retryAfter: Math.ceil(blockCfg.BLOCK_DURATION / 1000) });
-      }
-
       // 白名单路径跳过关键词检测
       if (whitePath) {
         if (req.query && Object.keys(req.query).length) overrideQuery(req, filterXSS(req.query));
         return next();
       }
 
-      // 路径+query拼接检测恶意关键词
+      // 路径+query拼接检测恶意关键词（仅保留真正危险分类，避免 debug/secret/internal/.env 等正常词误伤）
       let checkText = path;
       if (Object.keys(req.query ?? {}).length) {
         const queryStr = Object.entries(req.query).map(([k, v]) => `${k}=${v}`).join(" ");
         checkText += ` ${queryStr}`;
       }
-      const hit = checkKeywords(checkText);
+      const hit = checkKeywords(checkText, { categories: URL_SCAN_CATEGORIES });
       if (hit) {
         const { keyword, category } = hit;
         logger.error(`[WAF拦截-URL] IP:${clientIp} Path:${path} Key:${keyword} Type:${category}`);
-        const { blocked, strikes } = await handleStrike(fp, clientIp, keyword, blockCfg);
-        if (blocked) return respondWaf(res, 403, "检测到恶意访问，您的访问已被限制", { retryAfter: Math.ceil(blockCfg.BLOCK_DURATION / 1000) });
-        return respondWaf(res, 403, "检测到非法内容，请求已被拦截", { strikes, threshold: blockCfg.STRIKE_THRESHOLD });
+        // 仅当次拦截，不再累计封禁 IP（避免误报把整 IP 锁 30 分钟）
+        return respondWaf(res, 403, "检测到非法内容，请求已被拦截");
       }
 
       // query XSS净化
@@ -156,19 +118,10 @@ const createWafMiddleware = wafConfig => {
   };
 };
 
-/**
- * 已登录用户的管理接口路径前缀（跳过 body 关键词检测，避免误杀富文本/代码内容）
- * 可通过 waf 配置 bodySkipPrefixes 字段自定义，默认包含常见管理模块前缀
- */
-const DEFAULT_BODY_SKIP_PREFIXES = ["/cms/", "/base/", "/member/", "/book/", "/oss/", "/vip/"];
-
 /**
  * Body层WAF中间件（body解析后）
  */
 const createWafBodyMiddleware = wafConfig => {
-  const blockCfg = { ...DEFAULT_BLOCK, ...wafConfig.block };
-  const bodySkipPrefixes = wafConfig.bodySkipPrefixes ?? DEFAULT_BODY_SKIP_PREFIXES;
-
   return async (req, res, next) => {
     try {
       if (!wafConfig.enabled) return next();
@@ -182,35 +135,18 @@ const createWafBodyMiddleware = wafConfig => {
       // 空body直接放行
       if (!req.body || (typeof req.body === "object" && !Object.keys(req.body).length)) return next();
 
-      // 已登录用户的管理接口：跳过关键词检测（富文本/代码内容会误杀），仅做 XSS 过滤
-      const isAuthedAdmin = req.user?.uid && bodySkipPrefixes.some(p => path.startsWith(p));
-
-      if (!isAuthedAdmin) {
-        // 序列化body文本，截断1w字符防绕过
-        let bodyText = "";
-        try {
-          bodyText = (typeof req.body === "string" ? req.body : JSON.stringify(req.body)).slice(0, 10000);
-        } catch (e) {
-          logger.error(`[WAF警告] body序列化失败 IP:${clientIp} Err:${e.message}`);
-        }
-
-        // body关键词检测拦截（scope='body' 跳过路径/文件特征类规则，降低正文误报）
-        if (bodyText) {
-          const hit = checkKeywords(bodyText, { scope: 'body' });
-          if (hit) {
-            const { keyword, category } = hit;
-            const fp = buildFingerprint(clientIp, req.headers["user-agent"] || "");
-            logger.error(`[WAF拦截-Body] IP:${clientIp} Path:${path} Key:${keyword} Type:${category}`);
-            const { blocked, strikes } = await handleStrike(fp, clientIp, keyword, blockCfg);
-            if (blocked) return respondWaf(res, 403, "检测到恶意访问，您的访问已被限制", { retryAfter: Math.ceil(blockCfg.BLOCK_DURATION / 1000) });
-            return respondWaf(res, 403, "检测到非法内容，请求已被拦截", { strikes, threshold: blockCfg.STRIKE_THRESHOLD });
-          }
-        }
-      }
+      // 请求体关键词拦截已移除：
+      // 项目 DB 全部走 knex 参数化查询（天然防 SQL 注入），后端也无任何
+      // 把用户输入交给 shell 执行的路径；而关键词扫描对留言/评论/注册等正常正文
+      // 误报极高（drop / select / alert / onclick 等普通词都会被拦），代价远大于收益。
+      // XSS 防护由下方 filterXSS 负责（输出编码），SQL 注入由参数化查询负责。
 
       // body XSS过滤
+      // 例外：base/config 系统配置写入接口跳过 XSS 过滤——sys_config 配置值须原样存储
+      // （含「名称 <邮箱>」发件人格式、HTML 邮件模板等），且该接口仅管理员可访问，
+      // 配置值由后端逻辑消费而非直接反射到页面，无 XSS 风险。
       try {
-        if (typeof req.body === "object") req.body = filterXSS(req.body);
+        if (typeof req.body === "object" && !path.startsWith("/base/config")) req.body = filterXSS(req.body);
       } catch (e) {
         logger.error(`[WAF警告] body过滤失败 IP:${clientIp} Err:${e.message}`);
       }

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "chanjs",
-  "version": "2.7.10",
+  "version": "2.7.11",
   "description": "chanjs基于express5 纯js研发的轻量级mvc框架。",
   "main": "index.js",
   "module": "index.js",

package/security/checker.js

@@ -15,21 +15,28 @@ const BODY_EXCLUDED_CATEGORIES = [
 ];
 
 /**
- * 恶意关键词检测：单次遍历预排序的分类列表，利用捕获组直接定位命中关键词
+ * 恶意关键词检测：单次遍历分类列表，利用捕获组直接定位命中关键词
  * @param {string} fullText 待检测文本
- * @param {{scope?: 'body'|'url'}} [options] scope='body' 时跳过路径/文件特征类规则，降低正文误报
+ * @param {{scope?: 'body'|'url', categories?: string[]}} [options]
+ *   - scope='body' 时跳过路径/文件特征类规则，降低正文误报；
+ *   - categories 显式指定要扫描的分类（用于 URL 场景，只保留真正危险分类，避免正常词误伤）；
+ *   - 二者都不传则扫描全部分类。
  * @returns {{category: string; keyword: string}|null}
  */
-export const checkKeywords = (fullText, { scope } = {}) => {
+export const checkKeywords = (fullText, { scope, categories } = {}) => {
   const text = fullText?.trim();
   if (!text) return null;
 
-  const cats = scope === 'body'
-    ? SORTED_CATEGORIES.filter(c => !BODY_EXCLUDED_CATEGORIES.includes(c))
-    : SORTED_CATEGORIES;
+  const cats = Array.isArray(categories)
+    ? categories
+    : (scope === 'body'
+      ? SORTED_CATEGORIES.filter(c => !BODY_EXCLUDED_CATEGORIES.includes(c))
+      : SORTED_CATEGORIES);
 
   for (const cat of cats) {
-    const match = keywordRegexCache[cat].merged.exec(text);
+    const re = keywordRegexCache[cat]?.merged;
+    if (!re) continue;
+    const match = re.exec(text);
     if (!match) continue;
     // capture[0]是整体匹配，capture[1..]是每个关键词的捕获组
     const idx = match.findIndex((g, i) => i > 0 && g);

package/utils/pages.js

@@ -1,12 +1,8 @@
 /**
  * 分页工具函数
- * 样式采用 Tailwind CSS 原子类，紧凑精致布局
+ * 输出无 ul/li 的干净 HTML：普通页码直接用 <a>，当前页/禁用/省略号用 <span class="current|disabled|ellipsis">
+ * 样式由项目 CSS（如 .blince-pagination）统一维护，不依赖 Tailwind 等第三方框架
  */
-const LI_DISABLED = 'inline-flex items-center px-3 py-1.5 text-sm text-slate-400 cursor-not-allowed rounded-md border border-slate-100 bg-slate-50';
-const LI_ELLIPSIS = 'inline-flex items-center px-2 py-1.5 text-sm text-slate-400';
-const LI_CURRENT = 'inline-flex items-center px-3 py-1.5 text-sm font-medium text-white bg-lime-600 border border-lime-600 rounded-md';
-const LI_LINK = 'inline-flex items-center text-sm text-slate-700 bg-white border border-slate-200 rounded-md hover:border-lime-600 hover:text-lime-600 transition-colors';
-const A_LINK = 'block px-3 py-1.5';
 
 /**
  * 渲染分页HTML
@@ -26,8 +22,13 @@ export function pages(current, total, pageSize, href, query = '') {
   if (totalPage <= 1) return '';
   if (current > totalPage) current = totalPage;
 
-  const pageLink = (i, text) => `<li class="${i === current ? LI_CURRENT : LI_LINK}"><a class="${A_LINK}" href='${href}${i}.html${query}'>${text || i}</a></li>`;
-  const navLink = (i, text) => i ? pageLink(i, text) : `<li class="${LI_DISABLED}">${text}</li>`;
+  const pageLink = (i, text) => i === current
+    ? `<span class="current">${text || i}</span>`
+    : `<a href="${href}${i}.html${query}">${text || i}</a>`;
+  const navLink = (i, text) => i
+    ? pageLink(i, text)
+    : `<span class="disabled">${text}</span>`;
+  const ellipsis = () => `<span class="ellipsis">...</span>`;
   const items = [];
 
   // 上一页
@@ -38,14 +39,14 @@ export function pages(current, total, pageSize, href, query = '') {
     for (let i = 1; i <= totalPage; i++) items.push(pageLink(i));
   } else if (current <= 4) {
     for (let i = 1; i <= 5; i++) items.push(pageLink(i));
-    items.push(`<li class="${LI_ELLIPSIS}">...</li>`, pageLink(totalPage));
+    items.push(ellipsis(), pageLink(totalPage));
   } else if (current >= totalPage - 3) {
-    items.push(pageLink(1), `<li class="${LI_ELLIPSIS}">...</li>`);
+    items.push(pageLink(1), ellipsis());
     for (let i = totalPage - 4; i <= totalPage; i++) items.push(pageLink(i));
   } else {
-    items.push(pageLink(1), `<li class="${LI_ELLIPSIS}">...</li>`);
+    items.push(pageLink(1), ellipsis());
     for (let i = current - 1; i <= current + 1; i++) items.push(pageLink(i));
-    items.push(`<li class="${LI_ELLIPSIS}">...</li>`, pageLink(totalPage));
+    items.push(ellipsis(), pageLink(totalPage));
   }
 
   // 下一页