chanjs 2.7.3 → 2.7.5

package/security/jwt.js

@@ -1,175 +1,102 @@
 import jwt from "jsonwebtoken";
 import { store } from "../storage/store.js";
+import logger from "../utils/logger.js";
 
-/**
- * JWT 黑名单 Key 前缀（store 适配层，内存/Redis 双后端）
- * 用于实现 token 主动失效机制
- */
-const REVOKED_KEY_PREFIX = 'jwt:revoked:';
+const REVOKED_KEY_PREFIX = "jwt:revoked:";
+const ALLOWED_ALGORITHMS = ["HS256"];
+
+const JWT_ERR_MSG = {
+  TokenExpiredError: "令牌已过期",
+  JsonWebTokenError: "无效的令牌",
+  default: "令牌验证失败",
+};
 
 /**
- * 默认签名算法白名单（强制 HS256，防止 alg=none 绕过）
+ * 校验token是否在黑名单（fail-open：存储异常直接放行）
  */
-const ALLOWED_ALGORITHMS = ['HS256'];
+const isTokenRevoked = async token => {
+  if (!token) return false;
+  try { return !!await store.get(`${REVOKED_KEY_PREFIX}${token}`); }
+  catch { return false; }
+};
 
 /**
- * 生成 JWT 令牌
- * @param {Object} data - 要编码到令牌中的数据
- * @param {string} secretKey - JWT 密钥
- * @param {string} [time="7d"] - 令牌过期时间，默认 7 天
- * @returns {string|null} 生成的 JWT 令牌，失败时返回 null
- * @description
- * 使用 HS256 算法生成 JWT 令牌
- * 如果 secretKey 未配置，会输出安全错误并返回 null
- * @example
- * const token = setToken({ userId: 123 }, 'my-secret-key', '1h');
- * console.log(token); // eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+ * 签发JWT令牌
+ * @param {object} data 载荷数据
+ * @param {string} secretKey 签名密钥
+ * @param {string} [expire='7d'] 有效期
+ * @returns {string|null}
  */
-export function setToken(data = {}, secretKey, time = "7d") {
+export const setToken = (data = {}, secretKey, expire = "7d") => {
   if (!secretKey) {
-    console.error('[安全错误] JWT_SECRET 必须配置');
+    logger.error("[安全错误] JWT_SECRET 未配置");
     return null;
   }
   try {
-    return jwt.sign(data, secretKey, {
-      expiresIn: time,
-      algorithm: "HS256",
-    });
-  } catch (error) {
-    console.error("令牌生成失败:", error.message);
+    return jwt.sign(data, secretKey, { algorithm: "HS256", expiresIn: expire });
+  } catch (err) {
+    logger.error("令牌生成失败", err.message);
     return null;
   }
-}
+};
 
 /**
- * 验证并解析 JWT 令牌（异步）
- * @async
- * @param {string} token - 要验证的 JWT 令牌
- * @param {string} secretKey - JWT 密钥
- * @returns {Promise<Object|null>} 解码后的令牌数据，验证失败时返回 null
- * @description
- * 验证 JWT 令牌的有效性并返回解码后的数据
- * - 强制校验 algorithms: ['HS256']，防止 alg=none 攻击
- * - 自动检查黑名单，已撤销的 token 返回 null
- * 支持的错误类型：
- * - TokenExpiredError: 令牌已过期
- * - JsonWebTokenError: 无效的令牌格式
- * @example
- * const data = await getToken('eyJhbGciOiJIUzI1NiIs...', 'my-secret-key');
- * if (data) {
- *   console.log(data.userId); // 123
- * }
+ * 校验并解析JWT，先校验黑名单
+ * @param {string} token
+ * @param {string} secretKey
+ * @returns {Promise<{valid:boolean, reason:string, payload?:object, error?:Error}>}
  */
-export async function getToken(token, secretKey) {
-  if (!secretKey) {
-    console.error('[安全错误] JWT_SECRET 必须配置');
-    return null;
-  }
-  // 黑名单校验：已撤销的 token 直接拒绝
-  if (await isTokenRevoked(token)) {
-    console.error('[安全错误] 令牌已被撤销');
-    return null;
-  }
-  return new Promise((resolve) => {
-    // 强制指定算法白名单，防止 alg=none 等绕过
-    jwt.verify(token, secretKey, { algorithms: ALLOWED_ALGORITHMS }, (err, decode) => {
-      if (err) {
-        let errorMessage = "令牌验证失败";
-        if (err.name === "TokenExpiredError") {
-          errorMessage = "令牌已过期";
-        } else if (err.name === "JsonWebTokenError") {
-          errorMessage = "无效的令牌";
-        }
-        console.error(errorMessage, "令牌异常信息:", err.message);
-        resolve(null);
-      } else {
-        resolve(decode);
-      }
-    });
-  });
-}
+export const verifyToken = async (token, secretKey) => {
+  if (!secretKey) return { valid: false, reason: "missing_secret" };
+  if (!token) return { valid: false, reason: "missing" };
 
-/**
- * 验证 JWT 令牌（同步）
- * @param {string} token - 要验证的 JWT 令牌
- * @param {string} secretKey - JWT 密钥
- * @returns {Object|null} 解码后的令牌数据，验证失败时返回 null
- * @description
- * 同步版本的令牌验证方法
- * - 强制校验 algorithms: ['HS256']
- * - 注意：同步版本无法检查黑名单（黑名单走异步 store），如需校验请用 getToken
- * 如果令牌无效或过期，静默返回 null
- * @example
- * const data = verifyToken('eyJhbGciOiJIUzI1NiIs...', 'my-secret-key');
- * if (data) {
- *   console.log('令牌有效:', data);
- * }
- */
-export function verifyToken(token, secretKey) {
+  // 先验签（无效/过期/伪造 token 不查 Redis）
+  let payload;
   try {
-    // 强制指定算法白名单，防止 alg=none 等绕过
-    return jwt.verify(token, secretKey, { algorithms: ALLOWED_ALGORITHMS });
+    payload = await new Promise((resolve, reject) => {
+      jwt.verify(token, secretKey, { algorithms: ALLOWED_ALGORITHMS }, (err, decoded) => {
+        err ? reject(err) : resolve(decoded);
+      });
+    });
   } catch (err) {
-    return null;
+    const reason = err.name === "TokenExpiredError" ? "expired" : "invalid";
+    logger.error(JWT_ERR_MSG[err.name] ?? JWT_ERR_MSG.default, err.message);
+    return { valid: false, reason, error: err };
   }
-}
+
+  // 签名合法后再查黑名单
+  if (await isTokenRevoked(token)) {
+    logger.error("[安全拦截] 令牌已注销");
+    return { valid: false, reason: "revoked" };
+  }
+  return { valid: true, reason: "ok", payload };
+};
 
 /**
- * 生成 JWT 令牌（setToken 的别名）
- * @param {Object} data - 要编码到令牌中的数据
- * @param {string} secretKey - JWT 密钥
- * @param {string} [expiresIn="7d"] - 令牌过期时间，默认 7 天
- * @returns {string|null} 生成的 JWT 令牌，失败时返回 null
- * @description
- * setToken 函数的别名，提供更语义化的函数名
- * @example
- * const token = generateToken({ userId: 123 }, 'my-secret-key', '1h');
+ * 校验并解析JWT，成功返回载荷
  */
-export function generateToken(data, secretKey, expiresIn = "7d") {
-  return setToken(data, secretKey, expiresIn);
-}
+export const getToken = async (token, secretKey) => {
+  const { valid, payload } = await verifyToken(token, secretKey);
+  return valid ? payload : null;
+};
 
 /**
- * 撤销 JWT 令牌（写入黑名单）
- * @async
- * @param {string} token - 要撤销的令牌
- * @param {number} [ttlMs] - 黑名单保留时长（毫秒），默认与 token 剩余有效期对齐
- * @returns {Promise<boolean>} 是否撤销成功
- * @description
- * 将 token 写入黑名单，使其立即失效
- * 用于：用户登出、修改密码、踢人下线等场景
- * @example
- * await revokeToken(token, 7 * 24 * 60 * 60 * 1000);
+ * 注销令牌，加入黑名单
+ * @param {string} token
+ * @param {number} ttl 令牌剩余有效毫秒数
+ * @returns {Promise<boolean>}
  */
-export async function revokeToken(token, ttlMs = 7 * 24 * 60 * 60 * 1000) {
-  if (!token || typeof token !== 'string') return false;
-  try {
-    const key = `${REVOKED_KEY_PREFIX}${token}`;
-    await store.set(key, { revokedAt: Date.now() }, ttlMs);
+export const revokeToken = async (token, ttl) => {
+  if (!token) return false;
+  if (!ttl || ttl <= 0) {
+    logger.info("[JWT] token 已过期或无剩余有效期，无需注销");
     return true;
-  } catch (err) {
-    console.error('[JWT] 撤销令牌失败:', err.message);
-    return false;
   }
-}
-
-/**
- * 检查 token 是否在黑名单中
- * @async
- * @param {string} token - 待检查的令牌
- * @returns {Promise<boolean>} true 表示已被撤销
- * @description
- * 用于在 verify 前主动检查 token 是否已撤销
- * 异常时返回 false（fail-open，避免 store 故障导致所有用户登出）
- */
-export async function isTokenRevoked(token) {
-  if (!token || typeof token !== 'string') return false;
   try {
-    const key = `${REVOKED_KEY_PREFIX}${token}`;
-    const v = await store.get(key);
-    return !!v;
-  } catch {
-    // fail-open：store 异常时放行，避免误伤所有用户
+    await store.set(`${REVOKED_KEY_PREFIX}${token}`, 1, ttl);
+    return true;
+  } catch (err) {
+    logger.error("令牌注销失败", err.message);
     return false;
   }
-}
+};

package/security/keywords.js

@@ -1,179 +1,75 @@
 /**
- * 安全关键词规则定义
- * 定义各类恶意攻击的关键词检测规则
- *
- * 性能优化：
- * 1. 每类关键词合并成一个大正则做预检（单次 test 完成整类匹配）
- * 2. 预检命中后再遍历该类的具体关键词定位命中项
- * 3. 正常请求：8 个大正则 test，比原版 80+ 次正则 test 快 10 倍
- * 4. 恶意请求：大正则 + 该类关键词遍历，开销略增但可接受
+ * 安全检测恶意关键词规则库
  */
-
-/**
- * 关键词规则定义
- * @type {Object}
- */
-export const KEYWORD_RULES = {
-  /**
-   * 整词匹配规则（需完整匹配）
-   */
+const KEYWORD_RULES = Object.freeze({
   wholeWord: [
-    "netcat", "nc", "php-cgi", "process", "require","exec","import",
+    "netcat", "nc", "php-cgi", "process", "require", "exec", "import",
     "child_process", "execSync", "mainModule"
   ],
-  /**
-   * 敏感文件扩展名
-   */
   extensions: [
     ".php", ".asp", ".aspx", ".jsp", ".jspx", ".do", ".action", ".cgi",
-    ".py", ".pl", ".cfm", ".jhtml", ".shtml",".sql",".env",".git"
+    ".py", ".pl", ".cfm", ".jhtml", ".shtml", ".sql", ".env", ".git"
   ],
-  /**
-   * 敏感目录名称
-   */
   directories: [
     "/administrator", "/wp-admin", "phpMyAdmin", "cgi-bin",
     "setup", "staging", "internal", "debug", "metadata", "secret"
   ],
-  /**
-   * SQL 注入关键词
-   * 已移除过于宽泛的词：benchmark( concat( version( 等正常业务可能出现的字符
-   * 仅保留强 SQL 注入特征词
-   */
   sqlInjection: [
     "sleep(", "extractvalue(", "updatexml(",
     "union select", "union all", "select @@", "drop ", "alter ", "truncate ",
     "(select", "information_schema", "load_file(", "into outfile", "into dumpfile"
   ],
-  /**
-   * 命令注入关键词
-   * 已移除过宽词：kill / su / ssh / chmod / halt / reboot / mount / ln -s / benchmark( / concat( / version(
-   * 这些词在正常业务字符串中频繁出现，误伤率高
-   * 保留强命令注入特征词
-   */
   commandInjection: [
     "cmd=", "system(", "exec(", "shell_exec(", "passthru(",
     "eval(", "assert(", "preg_replace", "bash -i", "rm -rf",
     "wget ", "curl ", "base64_decode", "phpinfo()",
-    "killall", "shutdown", "fdisk",
-    "mkfs", "dd ", "scp ", "rsync", "nc ",
-    "netcat", "nmap", "iptables", "systemctl", "service",
-    "crontab", "sudo", "useradd",
-    "userdel", "usermod", "groupadd", "groupdel", "passwd",
-    "chpasswd"
+    "killall", "shutdown", "fdisk", "mkfs", "dd ",
+    "scp ", "rsync", "nc ", "netcat", "nmap", "iptables",
+    "systemctl", "service", "crontab", "sudo", "useradd",
+    "userdel", "usermod", "groupadd", "groupdel", "passwd", "chpasswd"
   ],
-  /**
-   * 路径遍历关键词
-   */
   pathTraversal: [
     "../", "..\\", "/etc/passwd", "/etc/shadow", "/etc/hosts",
-    "/etc/", "/var/www/", "/app/", "/root/", "__dirname", "__filename"
+    "/root/", "__dirname", "__filename"
   ],
-  /**
-   * XSS 攻击关键词
-   */
   xss: [
     "<script", "javascript:", "onerror=", "onload=", "onclick=",
     "alert(", "document.cookie", "document.write"
   ],
-  /**
-   * 编码绕过关键词
-   */
-  encoding: [
-    "0x7e", "UNION%20SELECT", "%27OR%27", "{{", "}}", "${", "1+1"
-  ],
-  /**
-   * 敏感标识符
-   */
+  encoding: ["0x7e", "UNION%20SELECT", "%27OR%27"],
   sensitiveIdentifiers: [
-    "wp-", "smtp", "redirect", "configs", ".well-known/",
+    "wp-", ".well-known/",
     "fs.readFile", "fs.existsSync", "process.env", "process.argv"
   ],
-};
+});
 
-/**
- * 转义正则特殊字符 + 空格转 \s
- * @private
- */
-const REGEX_SPECIAL_CHARS = /[.*+?^${}()|[\]\\]/g;
-function escapeKeyword(keyword, isWholeWord = false) {
-  const escaped = keyword.replace(REGEX_SPECIAL_CHARS, "\\$&").replace(/ /g, "\\s");
-  return isWholeWord ? `\\b${escaped}\\b` : escaped;
-}
+const REGEX_SPECIAL = /[.*+?^${}()|[\]\\]/g;
+const PRIORITY = ["sqlInjection", "xss", "commandInjection"];
 
-/**
- * 把同类的关键词数组合并成一个大正则（用 | 连接）
- * 用 (?:...) 非捕获组，避免捕获组过多影响性能
- * @param {Array<string>} keywords - 关键词数组
- * @param {boolean} isWholeWord - 是否整词匹配
- * @returns {RegExp|null} 合并后的大正则，空数组返回 null
- * @private
- */
-function buildMergedRegex(keywords, isWholeWord = false) {
-  if (!keywords || !keywords.length) return null;
-  const parts = keywords.map(k => escapeKeyword(k, isWholeWord));
-  // 合并成一个大正则，用非捕获组 (?:...) 避免 capture 开销
-  return new RegExp(`(?:${parts.join('|')})`, 'i');
-}
+const escapeKeyword = (keyword, wholeWord = false) => {
+  const str = keyword.replace(REGEX_SPECIAL, "\\$&").replace(/ /g, "\\s");
+  return wholeWord ? `\\b${str}\\b` : str;
+};
 
 /**
- * 关键词检测缓存（双层结构）
- * - mergedRegex: 该类别所有关键词合并的大正则，用于快速预检
- * - patterns: 原始关键词数组 + 各自正则，用于命中后定位具体关键词
- * @type {Object}
+ * 预构建每个分类的合并正则（priority 在前，其余按原顺序）
  */
-export let keywordRegexCache = (() => {
-  const cache = {};
-
-  for (const [category, keywords] of Object.entries(KEYWORD_RULES)) {
-    if (!Array.isArray(keywords)) continue;
-
-    const isWholeWord = category === 'wholeWord';
-
-    // 单关键词正则（命中后定位用）
-    const patterns = keywords.map((keyword) => ({
-      keyword,
-      regex: new RegExp(
-        isWholeWord ? `\\b${escapeKeyword(keyword)}\\b` : escapeKeyword(keyword),
-        "i"
-      ),
-    }));
-
-    // 合并大正则（预检用）
-    const mergedRegex = buildMergedRegex(keywords, isWholeWord);
+const buildCategoryRegex = (cat, words) => {
+  const wholeWord = cat === "wholeWord";
+  return new RegExp(words.map(k => `(${escapeKeyword(k, wholeWord)})`).join("|"), "i");
+};
 
-    cache[category] = { mergedRegex, patterns };
+const keywordRegexCache = (() => {
+  const cache = {};
+  for (const [cat, words] of Object.entries(KEYWORD_RULES)) {
+    cache[cat] = { merged: buildCategoryRegex(cat, words) };
   }
-
   return cache;
 })();
 
-/**
- * 更新关键词缓存
- * @param {Object} newRules - 新的关键词规则
- * @description
- * 允许动态添加或更新关键词检测规则
- * @example
- * updateKeywordCache({
- *   customKeywords: ['malicious', 'attack']
- * });
- */
-export function updateKeywordCache(newRules = {}) {
-  for (const [category, keywords] of Object.entries(newRules)) {
-    if (!Array.isArray(keywords)) continue;
+const SORTED_CATEGORIES = [
+  ...PRIORITY,
+  ...Object.keys(KEYWORD_RULES).filter(c => !PRIORITY.includes(c)),
+];
 
-    const isWholeWord = category === 'wholeWord';
-    const patterns = keywords.map((keyword) => ({
-      keyword,
-      regex: new RegExp(
-        isWholeWord ? `\\b${escapeKeyword(keyword)}\\b` : escapeKeyword(keyword),
-        "i"
-      ),
-    }));
-
-    keywordRegexCache[category] = {
-      mergedRegex: buildMergedRegex(keywords, isWholeWord),
-      patterns,
-    };
-  }
-}
+export { KEYWORD_RULES, keywordRegexCache, SORTED_CATEGORIES };

package/security/rate-limit.js

@@ -1,105 +1,63 @@
 import { isIgnored } from "./checker.js";
 import { getIp } from "../utils/ip.js";
 import { store } from "../storage/store.js";
+import { CODE_RATE_LIMIT } from "../response/code.js";
+import logger from "../utils/logger.js";
+
+const TIME_UNIT = { s: 1000, m: 60 * 1000, h: 60 * 60 * 1000, d: 24 * 60 * 60 * 1000 };
+const DEFAULT_MAX = 60;
+const DEFAULT_WINDOW_MS = 60 * 1000;
+const KEY_PREFIX = "ratelimit:";
 
 /**
- * 访问频率限制工具
- * 改用服务端存储（Map+TTL 或 Redis），按 IP 维度限流
- * 彻底废弃 Cookie 存储方案（旧版可被任意绕过）
+ * 解析限流时间窗口，支持数字毫秒 / 1s/1m/1h/1d 字符串
  */
+const parseWindowMs = time => {
+  if (typeof time === "number") return time;
+  if (typeof time !== "string") return DEFAULT_WINDOW_MS;
+  const m = time.match(/^(\d+)([smhd])$/);
+  return m ? Number(m[1]) * TIME_UNIT[m[2]] : DEFAULT_WINDOW_MS;
+};
 
 /**
- * 解析时间窗口参数
- * @private
+ * 限流拦截响应
  */
-function parseWindowMs(time) {
-  if (typeof time === 'number') return time;
-  if (typeof time !== 'string') return 60 * 1000;
-
-  const match = time.match(/^(\d+)([smhd])$/);
-  if (!match) return 60 * 1000;
-
-  const value = parseInt(match[1], 10);
-  const unit = match[2];
-  const multipliers = {
-    's': 1000,
-    'm': 60 * 1000,
-    'h': 60 * 60 * 1000,
-    'd': 24 * 60 * 60 * 1000,
-  };
-  return value * (multipliers[unit] || 1000);
-}
+const deny = (res, retryAfter, msg) =>
+  res.status(429).json({ success: false, code: CODE_RATE_LIMIT, msg, data: { retryAfter } });
 
 /**
- * 创建限流中间件
- * @param {Object} rateLimitConfig - 限流配置
- * @param {number|string} rateLimitConfig.windowMs - 时间窗口
- * @param {number} rateLimitConfig.max - 最大请求次数
- * @param {Array<string>} [rateLimitConfig.ignorePaths] - 忽略的路径数组
- * @returns {Function} Express 中间件函数
- * @description
- * 基于 IP 的限流算法，状态存储在服务端
- * - Redis 模式（启用时）：跨实例共享，适合多机部署
- * - 内存模式（默认）：Map+TTL+LRU，上限 10 万条/约 20MB，单机可用
- *
- * @example
- * const rateLimiter = createRateLimitMiddleware({
- *   windowMs: '1m',
- *   max: 60,
- *   ignorePaths: ['/health']
- * });
+ * 生成IP+UID双维度限流中间件
  */
-export function createRateLimitMiddleware(rateLimitConfig) {
-  const config = {
-    windowMs: parseWindowMs(rateLimitConfig?.windowMs),
-    max: rateLimitConfig?.max || 60,
-    ignorePaths: rateLimitConfig?.ignorePaths || [],
-  };
-
-  const KEY_PREFIX = 'ratelimit:';
+export const createRateLimitMiddleware = cfg => {
+  const windowMs = parseWindowMs(cfg?.windowMs);
+  const max = cfg?.max ?? DEFAULT_MAX;
+  const ignorePaths = cfg?.ignorePaths ?? [];
 
   return async (req, res, next) => {
     try {
-      if (isIgnored(req.path, config.ignorePaths)) {
-        return next();
-      }
+      if (isIgnored(req.path, ignorePaths)) return next();
 
-      const ip = getIp(req);
-      // 双维度限流：IP + uid（登录用户），避免分布式 IP 攻击时单 IP 维度失效
-      // - 未登录用户：仅按 IP 限流
-      // - 登录用户：IP 和 uid 各自独立计数，任一超限即拒绝
+      const ip = getIp(req) || "unknown";
       const uid = req.user?.uid;
       const ipKey = `${KEY_PREFIX}ip:${ip}`;
       const uidKey = uid ? `${KEY_PREFIX}uid:${uid}` : null;
 
-      // IP 维度自增
-      const ipCount = await store.incrAndExpire(ipKey, config.windowMs);
-      // uid 维度自增（登录用户才走）
-      const uidCount = uidKey ? await store.incrAndExpire(uidKey, config.windowMs) : 0;
+      // 计数自增（一次操作完成限流判定，存储异常 fail-close 拦截）
+      const [ipCount, uidCount] = await Promise.all([
+        store.incrAndExpire(ipKey, windowMs),
+        uidKey ? store.incrAndExpire(uidKey, windowMs) : 0,
+      ]);
 
-      if (ipCount > config.max || uidCount > config.max) {
-        // 返回窗口剩余等待时间（秒）
-        const retryAfter = Math.ceil(config.windowMs / 1000);
-        const dim = ipCount > config.max ? 'IP' : 'UID';
-
-        console.error(`[WAF 限流拦截] 路径:${req.path} 维度:${dim} IP计数:${ipCount}/${config.max} UID计数:${uidCount}/${config.max} IP:${ip} UID:${uid || '-'}`);
-        return res.status(429).json({
-          code: 429,
-          success: false,
-          msg: '请求过于频繁，请稍后重试',
-          retryAfter,
-        });
+      if (ipCount > max || uidCount > max) {
+        const dim = ipCount > max ? "IP" : "UID";
+        logger.error(`[WAF限流] path:${req.path} dim:${dim} ipCnt:${ipCount}/${max} uidCnt:${uidCount}/${max} ip:${ip} uid:${uid ?? "-"}`);
+        return deny(res, Math.ceil(windowMs / 1000), "请求过于频繁，请稍后重试");
       }
-
       next();
-    } catch (error) {
-      console.error(`[WAF 限流异常] 路径:${req.path} 错误:${error.message}`);
-      // 异常时拒绝请求，避免限流服务故障时被绕过
-      return res.status(429).json({
-        code: 429,
-        success: false,
-        msg: '限流服务暂时不可用',
-      });
+    } catch (err) {
+      logger.error(`[WAF限流异常] path:${req.path} err:${err.message}`);
+      // fail-close：存储异常直接拦截
+      return res.status(429).json({ success: false, code: CODE_RATE_LIMIT, msg: "限流服务暂时不可用" });
     }
   };
-}
+};