chanjs 2.7.6 → 2.7.7

package/core/Repository.js

@@ -152,7 +152,7 @@ class Repository extends BaseComponent {
     this._checkDB();
     if (!Object.keys(data).length) return { success:false, code:CODE_PARAM_MISSING, msg:"参数缺失", data:{} };
     const res = await this.db(this.tableName).insert(this.#formatDate(data));
-    return { success:true, code:CODE_OK, msg:"插入成功", data:{ insertId:res[0], affectedRows:res.length } };
+    return { success:true, code:CODE_OK, msg:"插入成功", data:{ insertId:res[0], affectedRows:1 } };
   }
 
   /** 批量插入 */
@@ -161,13 +161,18 @@ class Repository extends BaseComponent {
     if (!records.length) return { success:false, code:CODE_PARAM_MISSING, msg:"参数缺失", data:{} };
     const list = records.map(r => this.#formatDate(r));
     const res = await this.db(this.tableName).insert(list);
-    return { success:true, code:CODE_OK, msg:"批量插入成功", data:{ insertId:res[0], affectedRows:res.length } };
+    return { success:true, code:CODE_OK, msg:"批量插入成功", data:{ insertId:res[0], affectedRows:records.length } };
   }
 
   /** 条件删除 */
   async del(query={}) {
     this._checkDB();
     if (!Object.keys(query).length) return { success:false, code:CODE_PARAM_MISSING, msg:"参数缺失", data:{} };
+    // 防御纵深：若传入的查询条件字段全部非法（被 applyQuery 静默丢弃），
+    // 会生成不带 WHERE 的全表删除，这里 fail-closed 拒绝执行。
+    if (!Object.keys(query).some(f => SORT_FIELD_REGEX.test(f))) {
+      return { success:false, code:CODE_PARAM_INVALID, msg:"删除条件非法", data:{} };
+    }
     const rows = await applyQuery(this.db(this.tableName), query).del();
     return { success:true, code:CODE_OK, msg:"删除成功", data:{ affectedRows:rows } };
   }
@@ -191,6 +196,10 @@ class Repository extends BaseComponent {
     if (!query || !data || !Object.keys(query).length || !Object.keys(data).length) {
       return { success:false, code:CODE_PARAM_INVALID, msg:"参数无效", data:{} };
     }
+    // 防御纵深：与 del 同理，条件字段全部非法时会生成无 WHERE 的全表更新，fail-closed 拒绝。
+    if (!Object.keys(query).some(f => SORT_FIELD_REGEX.test(f))) {
+      return { success:false, code:CODE_PARAM_INVALID, msg:"更新条件非法", data:{} };
+    }
     const rows = await applyQuery(this.db(this.tableName), query).update(this.#formatDate(data));
     return { success:true, code:CODE_OK, msg:"更新成功", data:{ affectedRows:rows } };
   }

package/middleware/static.js

@@ -14,6 +14,6 @@ export const staticMw = async (app, statics) => {
       logger.error(`[Static] 不安全目录拦截：${dir}`);
       return;
     }
-    app.use(prefix, express.static(dir, { maxAge: maxAge ?? 0, dotfile: "deny" }));
+    app.use(prefix, express.static(dir, { maxAge: maxAge ?? 0, dotfiles: "deny" }));
   });
 };

package/middleware/validate.js

@@ -62,6 +62,7 @@ export function validate(schema, source = 'body') {
  * @returns {Function} Express 中间件
  */
 export function validateAll(schemas) {
+  const aggregated = {};
   return (req, res, next) => {
     for (const [source, schema] of Object.entries(schemas)) {
       if (!schema) continue;
@@ -73,7 +74,10 @@ export function validateAll(schemas) {
         return next(err);
       }
       setValidated(req, source, result.data);
+      aggregated[source] = result.data;
     }
+    // 聚合多来源校验结果，避免用单一来源覆盖已校验数据（修复原末行用 req.body 覆盖问题）
+    req.validated = aggregated;
     next();
   };
 }

package/middleware/waf.js

@@ -198,9 +198,9 @@ const createWafBodyMiddleware = wafConfig => {
           logger.error(`[WAF警告] body序列化失败 IP:${clientIp} Err:${e.message}`);
         }
 
-        // body关键词检测拦截
+        // body关键词检测拦截（scope='body' 跳过路径/文件特征类规则，降低正文误报）
         if (bodyText) {
-          const hit = checkKeywords(bodyText);
+          const hit = checkKeywords(bodyText, { scope: 'body' });
           if (hit) {
             const { keyword, category } = hit;
             const fp = buildFingerprint(clientIp, req.headers["user-agent"] || "");

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "chanjs",
-  "version": "2.7.6",
+  "version": "2.7.7",
   "description": "chanjs基于express5 纯js研发的轻量级mvc框架。",
   "main": "index.js",
   "module": "index.js",

package/response/code.js

@@ -60,7 +60,7 @@ export const DB_ERROR = Object.freeze({
   ER_BAD_FIELD_ERROR: 6004,
   ER_DUP_ENTRY: 6005,
   ER_NO_SUCH_TABLE: 6006,
-  ETIMEOUT: 6007,
+  ETIMEDOUT: 6007,
   ER_TABLE_EXISTS_ERROR: 1005,
 });
 

package/security/checker.js

@@ -1,15 +1,34 @@
 import { KEYWORD_RULES, keywordRegexCache, SORTED_CATEGORIES } from "./keywords.js";
 
+/**
+ * Body 扫描时应跳过的分类：这些规则主要描述 URL/路径/文件特征
+ * （如 secret/debug/metadata/setup 等英文词、.env/.git 后缀、wholeWord 代码特征），
+ * 在正文（评论/文章/会员资料）里极易误杀正常内容，而真实攻击已由
+ * sqlInjection / xss / commandInjection / pathTraversal 覆盖。
+ */
+const BODY_EXCLUDED_CATEGORIES = [
+  "wholeWord",
+  "extensions",
+  "directories",
+  "sensitiveIdentifiers",
+  "encoding",
+];
+
 /**
  * 恶意关键词检测：单次遍历预排序的分类列表，利用捕获组直接定位命中关键词
  * @param {string} fullText 待检测文本
+ * @param {{scope?: 'body'|'url'}} [options] scope='body' 时跳过路径/文件特征类规则，降低正文误报
  * @returns {{category: string; keyword: string}|null}
  */
-export const checkKeywords = fullText => {
+export const checkKeywords = (fullText, { scope } = {}) => {
   const text = fullText?.trim();
   if (!text) return null;
 
-  for (const cat of SORTED_CATEGORIES) {
+  const cats = scope === 'body'
+    ? SORTED_CATEGORIES.filter(c => !BODY_EXCLUDED_CATEGORIES.includes(c))
+    : SORTED_CATEGORIES;
+
+  for (const cat of cats) {
     const match = keywordRegexCache[cat].merged.exec(text);
     if (!match) continue;
     // capture[0]是整体匹配，capture[1..]是每个关键词的捕获组