mioku-service-webui 4.4.1 → 4.4.3

package/auth.ts

@@ -2,6 +2,16 @@ import * as crypto from "node:crypto";
 import type { Context, Next } from "hono";
 import type { AuthConfig } from "./types";
 import { AUTH_PATH, WEEK_MS, readJsonFile, writeJsonFile } from "./utils";
+import { notifyOwnersAuthTokenRefreshed } from "./system";
+
+function safeEqual(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(bufA, bufB);
+}
 
 export function ensureAuthConfig(): AuthConfig {
   const now = Date.now();
@@ -14,6 +24,10 @@ export function ensureAuthConfig(): AuthConfig {
       expiresAt: now + WEEK_MS,
     };
     writeJsonFile(AUTH_PATH, generated);
+    void notifyOwnersAuthTokenRefreshed(
+      generated.token,
+      generated.expiresAt,
+    ).catch(() => {});
     return generated;
   }
 
@@ -28,7 +42,7 @@ export function verifyAuthHeader(c: Context): boolean {
   }
 
   const authConfig = ensureAuthConfig();
-  return token === authConfig.token && Date.now() < authConfig.expiresAt;
+  return safeEqual(token, authConfig.token) && Date.now() < authConfig.expiresAt;
 }
 
 export async function requireAuth(c: Context, next: Next): Promise<Response | void> {
@@ -40,7 +54,7 @@ export async function requireAuth(c: Context, next: Next): Promise<Response | vo
 
 export function loginWithToken(inputToken: string): { ok: boolean; expiresAt?: number } {
   const authConfig = ensureAuthConfig();
-  if (inputToken !== authConfig.token) {
+  if (!safeEqual(inputToken, authConfig.token)) {
     return { ok: false };
   }
 

package/index.ts

@@ -61,6 +61,16 @@ class WebUIRuntime {
       );
     });
 
+    this.app.use("*", async (c, next) => {
+      await next();
+      c.header("X-Robots-Tag", "noindex, nofollow");
+    });
+
+    this.app.get("/robots.txt", (c) => {
+      c.header("content-type", "text/plain");
+      return c.body("User-agent: *\nDisallow: /\n");
+    });
+
     this.app.notFound((c) => {
       if (c.req.path.startsWith("/api/")) {
         return c.json({ ok: false, error: "API_NOT_FOUND" }, 404);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mioku-service-webui",
-  "version": "4.4.1",
+  "version": "4.4.3",
   "description": "Mioku WebUI 服务",
   "main": "index.ts",
   "type": "module",

package/routes/data-management.ts

@@ -122,25 +122,38 @@ function resolveBackupFile(name: string): string {
   return fullPath;
 }
 
-async function pathSize(target: string): Promise<SizeResult> {
+async function pathSize(
+  target: string,
+  visited: Set<string> = new Set(),
+): Promise<SizeResult> {
   let stat: fs.Stats;
   try {
-    stat = await fs.promises.lstat(target);
+    stat = await fs.promises.stat(target);
   } catch {
     return { size: 0, files: 0, directories: 0 };
   }
 
-  if (stat.isSymbolicLink()) {
-    return { size: 0, files: 0, directories: 0 };
-  }
-
   if (!stat.isDirectory()) {
     return { size: stat.size, files: 1, directories: 0 };
   }
 
+  // Follow symlinks to their real target. In a bun workspace, node_modules
+  // entries are symlinks into packages/* — skipping them reported 0B. Guard
+  // against cycles / repeated targets via realpath.
+  let real: string;
+  try {
+    real = await fs.promises.realpath(target);
+  } catch {
+    return { size: 0, files: 0, directories: 0 };
+  }
+  if (visited.has(real)) {
+    return { size: 0, files: 0, directories: 0 };
+  }
+  visited.add(real);
+
   const entries = await fs.promises.readdir(target).catch(() => []);
   const results = await Promise.all(
-    entries.map((entry) => pathSize(path.join(target, entry))),
+    entries.map((entry) => pathSize(path.join(target, entry), visited)),
   );
   return results.reduce<SizeResult>(
     (total, item) => ({

package/routes/db.ts

@@ -187,6 +187,18 @@ export function createPluginConfigRoutes() {
 export function createMemeRoutes() {
   const app = new Hono();
 
+  const memeRoot = path.resolve(CHAT_DATA_DIR, "meme");
+  const isInsideMeme = (target: string): boolean => {
+    const resolved = path.resolve(target);
+    return resolved === memeRoot || resolved.startsWith(`${memeRoot}${path.sep}`);
+  };
+  const isSafeSegment = (value: string): boolean =>
+    Boolean(value) &&
+    !value.includes("/") &&
+    !value.includes("\\") &&
+    value !== "." &&
+    value !== "..";
+
   app.get("/tree", (c) =>
     c.json({ ok: true, data: listMemeTree() }),
   );
@@ -200,11 +212,22 @@ export function createMemeRoutes() {
       return c.json({ ok: false, error: "FILE_REQUIRED" }, 400);
     }
 
-    const dir = path.join(CHAT_DATA_DIR, "meme", character, emotion);
-    fs.mkdirSync(dir, { recursive: true });
-
     const fileName = file.name || `upload-${Date.now()}.png`;
+    if (
+      !isSafeSegment(character) ||
+      !isSafeSegment(emotion) ||
+      !isSafeSegment(fileName)
+    ) {
+      return c.json({ ok: false, error: "INVALID_NAME" }, 400);
+    }
+
+    const dir = path.join(memeRoot, character, emotion);
     const filePath = path.join(dir, fileName);
+    if (!isInsideMeme(filePath)) {
+      return c.json({ ok: false, error: "INVALID_PATH" }, 400);
+    }
+
+    fs.mkdirSync(dir, { recursive: true });
     const buffer = Buffer.from(await file.arrayBuffer());
     fs.writeFileSync(filePath, buffer);
 
@@ -213,7 +236,10 @@ export function createMemeRoutes() {
 
   app.delete("/", async (c) => {
     const body = await c.req.json();
-    const filePath = path.join(process.cwd(), String(body.path || ""));
+    const filePath = path.resolve(process.cwd(), String(body.path || ""));
+    if (!isInsideMeme(filePath)) {
+      return c.json({ ok: false, error: "INVALID_PATH" }, 400);
+    }
     if (!fs.existsSync(filePath)) {
       return c.json({ ok: false, error: "NOT_FOUND" }, 404);
     }

package/system.ts

@@ -625,10 +625,10 @@ function readInstalledWebUIVersion(): string {
     }
   }
 
-  // Fallback: read from mioku-webui package.json directly
-  // mioku-webui is at repo root, which is ../../ from packages/mioku-service-webui
-  // but since service runs from example/, we need example/../../mioku-webui
-  const webuiProjectDir = path.join(process.cwd(), "..", "..", "mioku-webui");
+  // Fallback: read from mioku-webui package.json directly.
+  // The service runs from example/, so mioku-webui at the repo root is one
+  // level up — same resolution as resolveWebUIProjectDir().
+  const webuiProjectDir = resolveWebUIProjectDir();
   const webuiPkgPath = path.join(webuiProjectDir, "package.json");
   if (fs.existsSync(webuiPkgPath)) {
     const pkg = readPackageJson(webuiProjectDir);
@@ -1688,7 +1688,12 @@ async function fetchLatestMiokuUpdate(
   const job = (async () => {
     const cwd = process.cwd();
     const rootPkg = readRootPackageJson() || {};
-    const currentVersion = normalizeVersionSpec(rootPkg?.version || "unknown");
+    // example/package.json has no version field; read the installed mioku
+    // package so the current version matches what the dashboard reports.
+    const miokuPkg = readMiokuPackageJson();
+    const currentVersion = normalizeVersionSpec(
+      miokuPkg?.version || rootPkg?.version || "unknown",
+    );
 
     // Get latest version from npm registry
     let latestVersion = currentVersion;
@@ -1814,6 +1819,57 @@ async function notifyOwnerWebUIDownloaded(version: string): Promise<void> {
   }
 }
 
+export async function notifyOwnersAuthTokenRefreshed(
+  token: string,
+  expiresAt: number,
+): Promise<void> {
+  const owners = getMiokuConfig()?.owners || [];
+  if (owners.length === 0) {
+    return;
+  }
+
+  const MAX_ATTEMPTS = 24;
+  const RETRY_INTERVAL_MS = 5000;
+
+  let bots: any[] = [];
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt += 1) {
+    bots = Array.from(connectedBots.values()).filter(Boolean);
+    if (bots.length > 0) {
+      break;
+    }
+    await sleep(RETRY_INTERVAL_MS);
+  }
+
+  if (bots.length === 0) {
+    logger.warn("[webui] 密钥已刷新，但暂无在线 Bot，未能通知主人");
+    return;
+  }
+
+  const bot = bots[0];
+  const settings = getWebUISettings();
+  const url = `http://${settings.host}:${settings.port}`;
+  const expireText = new Date(expiresAt).toLocaleString("zh-CN");
+  const message = [
+    "🔑 WebUI 鉴权密钥已更新",
+    `地址: ${url}`,
+    `新密钥: ${token}`,
+    `有效期至: ${expireText}`,
+  ].join("\n");
+
+  for (const ownerId of owners) {
+    try {
+      await bot.api("send_private_msg", {
+        user_id: Number(ownerId),
+        message,
+      });
+    } catch (err: any) {
+      logger.warn(
+        `[webui] 通知主人 ${ownerId} 密钥更新失败: ${err?.message || err}`,
+      );
+    }
+  }
+}
+
 export async function updateWebUIDistFromRelease(): Promise<
   Record<string, any>
 > {

package/utils.ts

@@ -36,7 +36,7 @@ export const BACKUP_DIR = path.join(process.cwd(), "backup");
 
 export const defaultWebUISettings: WebUISettings = {
   port: 3339,
-  host: "0.0.0.0",
+  host: "127.0.0.1",
   packageManager: "bun" as PackageManager,
 };
 
@@ -125,8 +125,32 @@ export function normalizePackageManager(): PackageManager {
 }
 
 export function isValidRepoUrl(url: string): boolean {
-  const gitLike = /^(https?:\/\/|git@|ssh:\/\/).+/;
-  return gitLike.test(url.trim());
+  const trimmed = url.trim();
+  // 拒绝空白字符：堵 `ssh://host -o ProxyCommand=...` 之类参数注入
+  if (!trimmed || /\s/.test(trimmed)) {
+    return false;
+  }
+
+  if (/^https?:\/\//.test(trimmed)) {
+    try {
+      const parsed = new URL(trimmed);
+      return Boolean(parsed.hostname) && !parsed.hostname.startsWith("-");
+    } catch {
+      return false;
+    }
+  }
+
+  const sshMatch = trimmed.match(/^ssh:\/\/(?:[^@/]+@)?([^/:]+)/);
+  if (sshMatch) {
+    return !sshMatch[1].startsWith("-");
+  }
+
+  const scpMatch = trimmed.match(/^git@([^:]+):.+/);
+  if (scpMatch) {
+    return !scpMatch[1].startsWith("-");
+  }
+
+  return false;
 }
 
 export function isNpmPackageName(name: string): boolean {