mm_os 3.3.0 → 4.0.0

package/middleware/waf/index.js

@@ -1,348 +0,0 @@
-/**
- * 使用正则表达式，检测字符串是否含有攻击特征，检测到攻击特征返回true，没检测到返回false
- * @param {String} url 网址
- */
-function waf_check(url) {
-	// 基本防御
-	var rule = [
-		/select.+(from|limit)/i,
-		/(?:(union(.*?)select))/i,
-		/sleep\((\s*)(\d*)(\s*)\)/i,
-		/group\s+by.+\(/i,
-		/(?:from\W+information_schema\W)/i,
-		/(?:(?:current_)user|database|schema|connection_id)\s*\(/i,
-		/\s*or\s+.*=.*/i,
-		/order\s+by\s+.*--$/i,
-		/benchmark\((.*)\,(.*)\)/i,
-		/base64_decode\(/i,
-		/(?:(?:current_)user|database|version|schema|connection_id)\s*\(/i,
-		/(?:etc\/\W*passwd)/i,
-		/into(\s+)+(?:dump|out)file\s*/i,
-		/xwork.MethodAccessor/i,
-		/(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(/i,
-		/\<(iframe|script|body|img|layer|div|meta|style|base|object|input)/i,
-		/(onmouseover|onmousemove|onerror|onload)\=/i,
-		/javascript:/i,
-		// 增强的路径遍历检测规则
-		/\.\.\//i,              // 基础 ../
-		/\.\.\\/i,             // Windows格式 ..\
-		/\%2e\%2e\//i,          // URL编码 ../
-		/\%2e%2e\//i,           // URL编码 ../
-		/\%252e%252e%2f/i,       // 双重URL编码 ../
-		/\%252e\%252e\%2f/i,    // 双重URL编码 ../
-		/\.\%2e\//i,           // 混合编码
-		/\%2e\./i,              // 变体形式
-		/\%5c/i,                 // 反斜杠URL编码
-		/\%255c/i,               // 反斜杠双重URL编码
-		// 系统文件路径检测
-		/(?:\/etc|\/proc|\/sys|\/dev|C:\\Windows|C:\\winnt|C:\\Program Files)/i,
-		// 命令注入检测
-		/\|\|.*(?:ls|pwd|whoami|ll|ifconfog|ipconfig|&&|chmod|cd|mkdir|rmdir|cp|mv)/i,
-		/(?:ls|pwd|whoami|ll|ifconfog|ipconfig|&&|chmod|cd|mkdir|rmdir|cp|mv).*\|\|/i,
-		/(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\//i
-	];
-	for (var i = 0; i < rule.length; i++) {
-		if (rule[i].test(url) == true) {
-			return rule[i];
-		}
-	}
-	return null;
-}
-
-/**
- * 检查路径是否包含路径遍历攻击
- * @param {String} path 路径
- * @returns {Boolean} 是否包含路径遍历
- */
-function checkPathTraversal(path) {
-	// 规范化路径以处理各种编码
-	let normalizedPath = path;
-	
-	// 处理URL编码变体
-	const urlDecoded = decodeURIComponent(path);
-	const doubleUrlDecoded = decodeURIComponent(urlDecoded);
-	
-	// 检查路径是否包含危险模式
-	const dangerousPatterns = [
-		'../', '../../', '../../../', // Unix/Linux格式
-		'..\\', '..\\\\', '..\\\\\\', // Windows格式
-		'/%2e%2e/', '/%2e%2e%2f', // URL编码变体
-		'\\%2e%2e\\', '\\%2e%2e\\\\' // Windows URL编码变体
-	];
-	
-	// 检查系统关键文件路径（绝对路径攻击）
-	const systemPaths = [
-		'/etc/passwd', '/etc/shadow', '/etc/group', '/etc/hosts',
-		'/proc/', '/sys/', '/dev/', '/bin/', '/usr/bin/',
-		'C:\\Windows\\', 'C:\\winnt\\', 'C:\\Program Files\\'
-	];
-	
-	// 检查原始路径、单次解码和双重解码后的路径
-	// 1. 检查相对路径遍历模式
-	const hasTraversalPattern = dangerousPatterns.some(pattern => 
-		path.includes(pattern) || 
-		urlDecoded.includes(pattern) || 
-		doubleUrlDecoded.includes(pattern)
-	);
-	
-	// 2. 检查绝对路径攻击（包含系统关键文件路径）
-	const hasAbsoluteAttack = systemPaths.some(systemPath => 
-		path.toLowerCase().includes(systemPath.toLowerCase()) || 
-		urlDecoded.toLowerCase().includes(systemPath.toLowerCase()) || 
-		doubleUrlDecoded.toLowerCase().includes(systemPath.toLowerCase())
-	);
-	
-	// 3. 检查是否以/开头的绝对路径（排除正常的网站路径）
-	const startsWithSlash = path.startsWith('/') && 
-		!path.startsWith('/api') && 
-		!path.startsWith('/static') && 
-		!path.startsWith('/public') && 
-		!path.startsWith('/assets') && 
-		!path.startsWith('/favicon.ico') && 
-		!path.startsWith('/robots.txt');
-	
-	// 4. 检查是否包含敏感的系统文件扩展名
-	const hasSensitiveExtension = /\.(conf|ini|log|env|git|svn|htpasswd|htaccess|bashrc|bash_history|ssh|key|pem|cer|crt|pfx|p12)$/i.test(path) || 
-		/\.(conf|ini|log|env|git|svn|htpasswd|htaccess|bashrc|bash_history|ssh|key|pem|cer|crt|pfx|p12)$/i.test(urlDecoded) || 
-		/\.(conf|ini|log|env|git|svn|htpasswd|htaccess|bashrc|bash_history|ssh|key|pem|cer|crt|pfx|p12)$/i.test(doubleUrlDecoded);
-	
-	return hasTraversalPattern || hasAbsoluteAttack || startsWithSlash || hasSensitiveExtension;
-}
-
-/**
- * 检查请求路径是否规范化，防止路径遍历攻击
- * @param {String} path 请求路径
- * @returns {Boolean} 是否为安全路径
- */
-function isSafePath(path) {
-	// 特殊处理根路径，直接返回安全
-	if (path === '/') {
-		return true;
-	}
-	
-	// 获取规范化的路径
-	const normalizedPath = path.split('/')
-		.filter(segment => segment !== '')
-		.reduce((acc, segment) => {
-			// 防止路径回溯
-			if (segment === '..') {
-				acc.pop();
-			} else if (segment !== '.') {
-				acc.push(segment);
-			}
-			return acc;
-		}, [])
-		.join('/');
-	
-	// 重新构建规范化的完整路径
-	const safePath = '/' + normalizedPath;
-	
-	// 检查规范化后的路径长度是否小于原始路径（表示存在路径回溯）
-	return safePath.length >= path.length - 2; // 允许末尾的 '/' 差异
-}
-
-function getClientIP(req) {
-	return req.headers['x-forwarded-for'] || req.headers['X-Forwarded-For'] ||
-		req.connection.remoteAddress ||
-		req.socket.remoteAddress ||
-		req.connection.socket.remoteAddress;
-};
-
-/**
- * 检查IP是否在白名单中
- * @param {String} ip IP地址
- * @param {Object} config WAF配置
- * @returns {Boolean} 是否在白名单中
- */
-function isInWhitelist(ip, config) {
-	// 获取配置中的白名单，如果不存在则使用默认白名单
-	const whitelist = config && config.ip_whitelist && Array.isArray(config.ip_whitelist)
-		? config.ip_whitelist
-		: ['127.0.0.1', '::1', 'localhost', '192.168.31.5'];
-	
-	return whitelist.includes(ip);
-}
-
-/**
- * 检查路径是否在白名单中
- * @param {String} path 请求路径
- * @param {Object} config WAF配置
- * @returns {Boolean} 是否在白名单中
- */
-function isPathWhitelisted(path, config) {
-	// 获取配置中的路径白名单，如果不存在则使用默认路径白名单
-	const pathWhitelist = config && config.path_whitelist && Array.isArray(config.path_whitelist)
-		? config.path_whitelist
-		: ['/static', '/favicon.ico', '/api', '/public', '/assets'];
-	
-	// 检查路径是否以白名单中的任何路径开头
-	return pathWhitelist.some(whitelistPath => path.startsWith(whitelistPath));
-}
-
-/**
- * web防火墙
- * @param {Object} server 服务
- * @param {Object} config 配置参数
- */
-module.exports = function(server, config) {
-	// 设置默认配置
-	const defaultConfig = {
-		log: true,
-		ip_whitelist: ['127.0.0.1', '::1', 'localhost', '192.168.31.5'],
-		path_whitelist: ['/static', '/favicon.ico', '/api', '/public', '/assets']
-	};
-	
-	// 强制输出初始化日志
-	console.log('WAF MIDDLEWARE INITIALIZED');
-	
-	// 获取全局配置中的middleware.waf配置
-	let wafConfig = defaultConfig;
-	try {
-		// 尝试从全局配置中获取middleware.waf配置
-		const fs = require('fs');
-		const path = require('path');
-		const configPath = path.resolve(process.cwd(), 'config.json');
-		if (fs.existsSync(configPath)) {
-			const globalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-			if (globalConfig.middleware && globalConfig.middleware.waf) {
-				// 安全地合并默认配置和全局配置
-				wafConfig = Object.assign({}, defaultConfig, globalConfig.middleware.waf);
-				console.log('WAF using global config from config.json');
-			} else {
-				console.log('WAF using default config (no middleware.waf in config.json)');
-			}
-		}
-	} catch (error) {
-		console.error('Error loading global WAF config:', error.message);
-		// 出错时使用默认配置
-		wafConfig = defaultConfig;
-	}
-	
-	// 确保白名单数组存在且为数组类型
-	if (!Array.isArray(wafConfig.ip_whitelist)) {
-		wafConfig.ip_whitelist = defaultConfig.ip_whitelist;
-	}
-	if (!Array.isArray(wafConfig.path_whitelist)) {
-		wafConfig.path_whitelist = defaultConfig.path_whitelist;
-	}
-	
-	// 合并传入的config和全局配置
-	const mergedConfig = { ...wafConfig, ...(config || {}) };
-	console.log('Merged WAF Config:', JSON.stringify(mergedConfig));
-	
-	/* WAF（web防火墙） */
-	server.use(async (ctx, next) => {
-		try {
-			// 获取客户端IP
-			var ip = getClientIP(ctx.req);
-			// 规范化IP格式，移除IPv6前缀
-			if (ip && ip.startsWith('::ffff:')) {
-				ip = ip.substring(7);
-			}
-			
-			// 获取请求路径
-			const path = ctx.path;
-			
-			// 强制输出请求处理日志
-			console.log('WAF PROCESSING REQUEST');
-			console.log('URL:', ctx.url);
-			console.log('Path:', path);
-			console.log('Method:', ctx.method);
-			console.log('IP:', ip);
-			
-			// 检查IP是否在白名单中，如果是则跳过所有检查
-			if (isInWhitelist(ip, mergedConfig)) {
-				console.log(`WAF: IP ${ip} in whitelist, skipping checks`);
-				await next();
-				return;
-			}
-			
-			// 检查路径是否在白名单中
-			if (isPathWhitelisted(path, mergedConfig)) {
-				console.log(`WAF: Path ${path} in whitelist, skipping checks`);
-				await next();
-				return;
-			}
-			
-			// 获取请求路径和完整URL
-			var url = ctx.url;
-			
-			// 1. 使用正则表达式检查基本攻击特征
-			console.log('Step 1: Basic attack pattern check');
-			var danger = waf_check(url);
-			console.log('WAF check result:', danger ? danger.toString() : 'safe');
-			if (danger) {
-				console.warn(`BLOCKED ATTACK from IP ${ip}:`, danger.toString());
-				// 阻止攻击请求，返回403禁止访问
-				ctx.status = 403;
-				ctx.body = {
-					code: 403,
-					msg: '访问被WAF阻止，请求包含潜在的攻击特征',
-					rule: danger.toString()
-				};
-				return;
-			}
-			
-			// 2. 专门检查路径遍历攻击
-			console.log('Step 2: Path traversal check');
-			const hasTraversal = checkPathTraversal(path);
-			const isSafe = isSafePath(path);
-			console.log('Path traversal check results:', { path, hasTraversal, isSafe });
-			
-			if (hasTraversal || !isSafe) {
-				console.warn(`BLOCKED PATH TRAVERSAL from IP ${ip}:`, path);
-				ctx.status = 403;
-				ctx.body = {
-					code: 403,
-					msg: '访问被WAF阻止，检测到路径遍历攻击尝试'
-				};
-				return;
-			}
-			
-			// 3. 检查请求参数中的路径遍历
-			console.log('Step 3: Query parameter traversal check');
-			const queryParams = ctx.query;
-			for (const [key, value] of Object.entries(queryParams)) {
-				if (typeof value === 'string') {
-					const paramHasTraversal = checkPathTraversal(value);
-					console.log('Param check:', { key, value, paramHasTraversal });
-					if (paramHasTraversal) {
-						console.warn(`BLOCKED PARAM TRAVERSAL from IP ${ip}:`, `${key}=${value}`);
-						ctx.status = 403;
-						ctx.body = {
-							code: 403,
-							msg: '访问被WAF阻止，请求参数中包含路径遍历攻击尝试'
-						};
-						return;
-					}
-				}
-			}
-			
-			// 4. 如果是POST请求，检查请求体
-			console.log('Step 4: POST body traversal check');
-			if (ctx.method === 'POST' && ctx.request.body) {
-				const bodyContent = JSON.stringify(ctx.request.body);
-				const bodyHasTraversal = checkPathTraversal(bodyContent);
-				console.log('Body check results:', bodyHasTraversal);
-				if (bodyHasTraversal) {
-					console.warn(`BLOCKED BODY TRAVERSAL from IP ${ip}`);
-					ctx.status = 403;
-					ctx.body = {
-						code: 403,
-						msg: '访问被WAF阻止，请求体中包含路径遍历攻击尝试'
-					};
-					return;
-				}
-			}
-			
-			console.log('WAF: All checks passed, continuing request');
-			// 所有检查通过，继续处理请求
-			await next();
-		} catch (error) {
-			console.error('WAF MIDDLEWARE ERROR:', error);
-			// 出错时默认允许请求继续处理
-			await next();
-		}
-	});
-	return server;
-};

package/middleware/waf/middleware.json

@@ -1,10 +0,0 @@
-{
-	"name": "web_waf",
-	"title": "web防火墙",
-	"description": "用于防止sql注入、脚本注入等",
-	"version": "1.0",
-	"type": "web",
-	"process_type": "common_before",
-	"sort": 20,
-	"state": 1
-}