mm_os 2.8.8 → 2.8.9

package/middleware/waf/index.js

@@ -1,64 +1,64 @@
-/**
- * 使用正则表达式，检测字符串是否含有攻击特征，检测到攻击特征返回true，没检测到返回false
- * @param {String} url 网址
- */
-function waf_check(url) {
-	// 基本防御
-	var rule = [
-		/select.+(from|limit)/i,
-		/(?:(union(.*?)select))/i,
-		/sleep\((\s*)(\d*)(\s*)\)/i,
-		/group\s+by.+\(/i,
-		/(?:from\W+information_schema\W)/i,
-		/(?:(?:current_)user|database|schema|connection_id)\s*\(/i,
-		/\s*or\s+.*=.*/i,
-		/order\s+by\s+.*--$/i,
-		/benchmark\((.*)\,(.*)\)/i,
-		/base64_decode\(/i,
-		/(?:(?:current_)user|database|version|schema|connection_id)\s*\(/i,
-		/(?:etc\/\W*passwd)/i,
-		/into(\s+)+(?:dump|out)file\s*/i,
-		/xwork.MethodAccessor/i,
-		/(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(/i,
-		/\<(iframe|script|body|img|layer|div|meta|style|base|object|input)/i,
-		/(onmouseover|onmousemove|onerror|onload)\=/i,
-		/javascript:/i,
-		/\.\.\/\.\.\//i,
-		/\|\|.*(?:ls|pwd|whoami|ll|ifconfog|ipconfig|&&|chmod|cd|mkdir|rmdir|cp|mv)/i,
-		/(?:ls|pwd|whoami|ll|ifconfog|ipconfig|&&|chmod|cd|mkdir|rmdir|cp|mv).*\|\|/i,
-		/(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\//i
-	];
-	for (var i = 0; i < rule.length; i++) {
-		if (rule[i].test(url) == true) {
-			return rule[i];
-		}
-	}
-	return null;
-}
-
-function getClientIP(req) {
-	return req.headers['x-forwarded-for'] || req.headers['X-Forwarded-For'] ||
-		req.connection.remoteAddress ||
-		req.socket.remoteAddress ||
-		req.connection.socket.remoteAddress;
-};
-
-/**
- * 应用
- * @param {Object} server 服务
- * @param {Object} config 配置参数
- */
-module.exports = function(server, config) {
-	/* WAF（web防火墙） */
-	server.use(async (ctx, next) => {
-		var url = ctx.url;
-		var danger = waf_check(url);
-		if (danger) {
-			var ip = getClientIP(ctx.req);
-			$.log.warn(`检测到来自IP ${ip} 的攻击`, "规则:", danger.toString());
-		} else {
-			await next();
-		}
-	});
-	return server;
-};
+/**
+ * 使用正则表达式，检测字符串是否含有攻击特征，检测到攻击特征返回true，没检测到返回false
+ * @param {String} url 网址
+ */
+function waf_check(url) {
+	// 基本防御
+	var rule = [
+		/select.+(from|limit)/i,
+		/(?:(union(.*?)select))/i,
+		/sleep\((\s*)(\d*)(\s*)\)/i,
+		/group\s+by.+\(/i,
+		/(?:from\W+information_schema\W)/i,
+		/(?:(?:current_)user|database|schema|connection_id)\s*\(/i,
+		/\s*or\s+.*=.*/i,
+		/order\s+by\s+.*--$/i,
+		/benchmark\((.*)\,(.*)\)/i,
+		/base64_decode\(/i,
+		/(?:(?:current_)user|database|version|schema|connection_id)\s*\(/i,
+		/(?:etc\/\W*passwd)/i,
+		/into(\s+)+(?:dump|out)file\s*/i,
+		/xwork.MethodAccessor/i,
+		/(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(/i,
+		/\<(iframe|script|body|img|layer|div|meta|style|base|object|input)/i,
+		/(onmouseover|onmousemove|onerror|onload)\=/i,
+		/javascript:/i,
+		/\.\.\/\.\.\//i,
+		/\|\|.*(?:ls|pwd|whoami|ll|ifconfog|ipconfig|&&|chmod|cd|mkdir|rmdir|cp|mv)/i,
+		/(?:ls|pwd|whoami|ll|ifconfog|ipconfig|&&|chmod|cd|mkdir|rmdir|cp|mv).*\|\|/i,
+		/(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\//i
+	];
+	for (var i = 0; i < rule.length; i++) {
+		if (rule[i].test(url) == true) {
+			return rule[i];
+		}
+	}
+	return null;
+}
+
+function getClientIP(req) {
+	return req.headers['x-forwarded-for'] || req.headers['X-Forwarded-For'] ||
+		req.connection.remoteAddress ||
+		req.socket.remoteAddress ||
+		req.connection.socket.remoteAddress;
+};
+
+/**
+ * 应用
+ * @param {Object} server 服务
+ * @param {Object} config 配置参数
+ */
+module.exports = function(server, config) {
+	/* WAF（web防火墙） */
+	server.use(async (ctx, next) => {
+		var url = ctx.url;
+		var danger = waf_check(url);
+		if (danger) {
+			var ip = getClientIP(ctx.req);
+			$.log.warn(`检测到来自IP ${ip} 的攻击`, "规则:", danger.toString());
+		} else {
+			await next();
+		}
+	});
+	return server;
+};

package/middleware/waf/middleware.json

@@ -1,9 +1,9 @@
-{
-	"name": "web_waf",
-	"title": "web防火墙",
-	"description": "用于防止sql注入、脚本注入等",
-	"version": "1.0",
-	"type": "web",
-	"process_type": "common_before",
-	"sort": 3
+{
+	"name": "web_waf",
+	"title": "web防火墙",
+	"description": "用于防止sql注入、脚本注入等",
+	"version": "1.0",
+	"type": "web",
+	"process_type": "common_before",
+	"sort": 3
 }

package/middleware/waf_ip/index.js

@@ -1,116 +1,116 @@
-const os = require('os');
-const {
-	exec
-} = require('child_process');
-const platform = os.platform();
-
-/**
- * 获取客户端IP
- * @param {Object} req 请求对象
- * @returns {String} 返回真实IP
- */
-function getClientIP(req) {
-	var ip = req.headers['x-forwarded-for'] || req.headers['X-Forwarded-For'] || req.headers['x-real-ip'] ||
-		req.connection.remoteAddress ||
-		req.socket.remoteAddress ||
-		req.connection.socket.remoteAddress;
-	if (ip && ip.split(',').length > 0) {
-		ip = ip.split(',')[0]; // 取第一个IP地址
-	}
-	return ip;
-};
-
-/**
- * 设置黑名单
- * @param {String} ip IP地址
- */
-function setting_blacklist(ip) {
-	var cmd;
-	if (platform == "win32") {
-		// window 系统
-		cmd =
-			`netsh advfirewall firewall add rule name="Blacklist ${ip}" dir=in action=block remoteip="${ip}" protocol=any`
-	} else {
-		// linux 系统
-		cmd = `sudo iptables -A INPUT -s ${ip} -j DROP`;
-	}
-
-	exec(cmd, (error, stdout, stderr) => {
-		if (error) {
-			console.error(`执行的错误: ${error}`);
-			return;
-		}
-		$.log.info(`加入黑名单: ${ip}`);
-		if (stderr) {
-			console.error(`标准错误输出: ${stderr}`);
-		}
-	});
-}
-
-/**
- * 应用
- * @param {Object} server 服务
- * @param {Object} config 配置参数
- */
-module.exports = function(server, config) {
-	var limit = config.request_limit || 0;
-	var duration = config.request_duration || 0;
-	var block = config.request_block || false;
-
-	if (limit && duration) {
-		/* WAF（web防火墙） */
-		server.use(async (ctx, next) => {
-			var pass = true;
-			// 获取IP
-			var ip = getClientIP(ctx.req);
-			var num = 1;
-			var now = new Date();
-			var date = now.toStr('yyyy-MM-dd');
-			var time;
-			var str = await $.cache.get("ip_" + ip);
-			var json;
-			if (str) {
-				if (typeof(str) === "string") {
-					json = JSON.parse(str);
-				} else {
-					json = str;
-				}
-				if (json.date !== date) {
-					num = 1;
-				} else {
-					// 判断时间间隔是否在范围外
-					if (json.time.toTime().interval(now) > duration) {
-						num = 1;
-					} else {
-						// 如果是在周期内，访问次数+1，并判断是否超出上限
-						num = json.num + 1;
-						if (num > limit) {
-							// 超出上限禁止访问，并加入黑名单
-							pass = false;
-							if (block) {
-								setting_blacklist(ip);
-							}
-						}
-					}
-				}
-			}
-			if (!time) {
-				time = now.toStr('yyyy-MM-dd hh:mm:ss');
-			}
-			if (pass) {
-				await $.cache.set("ip_" + ip, JSON.stringify({
-					date,
-					time,
-					num
-				}), duration);
-				ctx.request.ip = ip;
-				ctx.ip = ip;
-				await next();
-			} else {
-				ctx.status = 429;
-				ctx.body = '请求频率过高，请稍后再试。';
-			}
-		});
-	}
-	return server;
+const os = require('os');
+const {
+	exec
+} = require('child_process');
+const platform = os.platform();
+
+/**
+ * 获取客户端IP
+ * @param {Object} req 请求对象
+ * @returns {String} 返回真实IP
+ */
+function getClientIP(req) {
+	var ip = req.headers['x-forwarded-for'] || req.headers['X-Forwarded-For'] || req.headers['x-real-ip'] ||
+		req.connection.remoteAddress ||
+		req.socket.remoteAddress ||
+		req.connection.socket.remoteAddress;
+	if (ip && ip.split(',').length > 0) {
+		ip = ip.split(',')[0]; // 取第一个IP地址
+	}
+	return ip;
+};
+
+/**
+ * 设置黑名单
+ * @param {String} ip IP地址
+ */
+function setting_blacklist(ip) {
+	var cmd;
+	if (platform == "win32") {
+		// window 系统
+		cmd =
+			`netsh advfirewall firewall add rule name="Blacklist ${ip}" dir=in action=block remoteip="${ip}" protocol=any`
+	} else {
+		// linux 系统
+		cmd = `sudo iptables -A INPUT -s ${ip} -j DROP`;
+	}
+
+	exec(cmd, (error, stdout, stderr) => {
+		if (error) {
+			console.error(`执行的错误: ${error}`);
+			return;
+		}
+		$.log.info(`加入黑名单: ${ip}`);
+		if (stderr) {
+			console.error(`标准错误输出: ${stderr}`);
+		}
+	});
+}
+
+/**
+ * 应用
+ * @param {Object} server 服务
+ * @param {Object} config 配置参数
+ */
+module.exports = function(server, config) {
+	var limit = config.request_limit || 0;
+	var duration = config.request_duration || 0;
+	var block = config.request_block || false;
+
+	if (limit && duration) {
+		/* WAF（web防火墙） */
+		server.use(async (ctx, next) => {
+			var pass = true;
+			// 获取IP
+			var ip = getClientIP(ctx.req);
+			var num = 1;
+			var now = new Date();
+			var date = now.toStr('yyyy-MM-dd');
+			var time;
+			var str = await $.cache.get("ip_" + ip);
+			var json;
+			if (str) {
+				if (typeof(str) === "string") {
+					json = JSON.parse(str);
+				} else {
+					json = str;
+				}
+				if (json.date !== date) {
+					num = 1;
+				} else {
+					// 判断时间间隔是否在范围外
+					if (json.time.toTime().interval(now) > duration) {
+						num = 1;
+					} else {
+						// 如果是在周期内，访问次数+1，并判断是否超出上限
+						num = json.num + 1;
+						if (num > limit) {
+							// 超出上限禁止访问，并加入黑名单
+							pass = false;
+							if (block) {
+								setting_blacklist(ip);
+							}
+						}
+					}
+				}
+			}
+			if (!time) {
+				time = now.toStr('yyyy-MM-dd hh:mm:ss');
+			}
+			if (pass) {
+				await $.cache.set("ip_" + ip, JSON.stringify({
+					date,
+					time,
+					num
+				}), duration);
+				ctx.request.ip = ip;
+				ctx.ip = ip;
+				await next();
+			} else {
+				ctx.status = 429;
+				ctx.body = '请求频率过高，请稍后再试。';
+			}
+		});
+	}
+	return server;
 };

package/middleware/waf_ip/middleware.json

@@ -1,10 +1,10 @@
-{
-	"name": "web_waf_ip",
-	"title": "IP防火墙",
-	"description": "用于防止DOS攻击",
-	"version": "1.0",
-	"type": "web",
-	"process_type": "common_before",
-	"sort": 1,
-	"state": 0
+{
+	"name": "web_waf_ip",
+	"title": "IP防火墙",
+	"description": "用于防止DOS攻击",
+	"version": "1.0",
+	"type": "web",
+	"process_type": "common_before",
+	"sort": 1,
+	"state": 0
 }

package/middleware/web_base/index.js

@@ -1,66 +1,66 @@
-const xmlParser = require("mm_xml");
-const session = require('mm_session');
-const compress = require('koa-compress');
-const { koaBody } = require('koa-body');
-const send = require('koa-send');
-
-/**
- * 应用
- * @param {Object} server 服务
- * @param {Object} config 配置参数
- */
-module.exports = function(server, config) {
-	/**
-	 * 发送文件
-	 */
-	server.use(async (ctx, next) => {
-		ctx.send = async function(src) {
-			await send(ctx, src);
-		}
-		await next();
-	});
-	
-	// 设置session 保存时长2小时
-	server.use(session({
-		maxAge: $.login_period || config.maxAge || 7200
-	}));
-
-	// 使用压缩
-	if (config.compress) {
-		server.use(
-			compress({
-				filter: function(content_type) {
-					// 只有在请求的content-type中有gzip类型，我们才会考虑压缩，因为zlib是压缩成gzip类型的
-					return /text/i.test(content_type);
-				},
-				// 阀值，当数据超过1kb的时候，可以压缩
-				threshold: 1024,
-				// zlib是node的压缩模块
-				flush: require('zlib').Z_SYNC_FLUSH
-			})
-		);
-	}
-
-	// 解析 text/xml
-	server.use(xmlParser());
-
-	var func = koaBody({
-		jsonLimit: config.jsonLimit || '20mb',
-		multipart: true,
-		formidable: {
-			// 设置上传文件大小最大限制，默认20M
-			maxFileSize: 2000 * 1024 * 1024
-		}
-	});
-
-	// 解析 application/json、application/x-www-form-urlencoded、text/plain
-	// 接收主体
-	server.use(async (ctx, next) => {
-		if (!ctx.request.body) {
-			await func(ctx, next);
-		} else {
-			await next();
-		}
-	});
-	return server;
+const xmlParser = require("mm_xml");
+const session = require('mm_session');
+const compress = require('koa-compress');
+const { koaBody } = require('koa-body');
+const send = require('koa-send');
+
+/**
+ * 应用
+ * @param {Object} server 服务
+ * @param {Object} config 配置参数
+ */
+module.exports = function(server, config) {
+	/**
+	 * 发送文件
+	 */
+	server.use(async (ctx, next) => {
+		ctx.send = async function(src) {
+			await send(ctx, src);
+		}
+		await next();
+	});
+	
+	// 设置session 保存时长2小时
+	server.use(session({
+		maxAge: $.login_period || config.maxAge || 7200
+	}));
+
+	// 使用压缩
+	if (config.compress) {
+		server.use(
+			compress({
+				filter: function(content_type) {
+					// 只有在请求的content-type中有gzip类型，我们才会考虑压缩，因为zlib是压缩成gzip类型的
+					return /text/i.test(content_type);
+				},
+				// 阀值，当数据超过1kb的时候，可以压缩
+				threshold: 1024,
+				// zlib是node的压缩模块
+				flush: require('zlib').Z_SYNC_FLUSH
+			})
+		);
+	}
+
+	// 解析 text/xml
+	server.use(xmlParser());
+
+	var func = koaBody({
+		jsonLimit: config.jsonLimit || '20mb',
+		multipart: true,
+		formidable: {
+			// 设置上传文件大小最大限制，默认20M
+			maxFileSize: 2000 * 1024 * 1024
+		}
+	});
+
+	// 解析 application/json、application/x-www-form-urlencoded、text/plain
+	// 接收主体
+	server.use(async (ctx, next) => {
+		if (!ctx.request.body) {
+			await func(ctx, next);
+		} else {
+			await next();
+		}
+	});
+	return server;
 };

package/middleware/web_base/middleware.json

@@ -1,9 +1,9 @@
-{
-	"name": "web_base",
-	"title": "web基本功能",
-	"description": "用于网站常规功能",
-	"version": "1.0",
-	"type": "web",
-	"process_type": "common_before",
-	"sort": 12
+{
+	"name": "web_base",
+	"title": "web基本功能",
+	"description": "用于网站常规功能",
+	"version": "1.0",
+	"type": "web",
+	"process_type": "common_before",
+	"sort": 12
 }