twikoo-func 1.7.14 → 1.7.16

package/index.js

@@ -38,6 +38,13 @@ const {
   checkCommentOwnership,
   isValidEmail
 } = require('./utils')
+const {
+  createCap,
+  tcbStorage,
+  createChallenge,
+  redeemChallenge,
+  isBuiltinCap
+} = require('./utils/cap')
 const {
   jsonParse,
   commentImportValine,
@@ -151,6 +158,12 @@ exports.main = async (event, context) => {
       case 'COMMENT_DELETE_FOR_USER':
         res = await commentDeleteForUser(event)
         break
+      case 'CAP_CHALLENGE': // embedded Cap.js
+        res = await capChallenge()
+        break
+      case 'CAP_REDEEM':
+        res = await capRedeem(event)
+        break
       default:
         if (event.event) {
           res.code = RES_CODE.EVENT_NOT_EXIST
@@ -760,6 +773,14 @@ async function checkCaptcha (comment) {
       geeTestPassToken: comment.geeTestPassToken,
       geeTestGenTime: comment.geeTestGenTime
     })
+  } else if (provider === 'Cap' && isBuiltinCap(config)) {
+    if (!comment.capToken) {
+      throw new Error('验证码 token 缺失，请刷新页面重试')
+    }
+    await checkCapCaptcha({
+      capToken: comment.capToken,
+      cap: createCap(tcbStorage(db))
+    })
   } else if (provider === 'Cap' && config.CAP_API_ENDPOINT && config.CAP_SECRET_KEY) {
     if (!comment.capToken) {
       throw new Error('验证码 token 缺失，请刷新页面重试')
@@ -770,7 +791,7 @@ async function checkCaptcha (comment) {
       capApiEndpoint: config.CAP_API_ENDPOINT
     })
   } else if (provider === 'Cap') {
-    throw new Error('Cap 验证码配置不完整，请联系管理员')
+    throw new Error('Cap 验证码配置不完整：内嵌模式无需额外配置，外部模式需填写 CAP_API_ENDPOINT 与 CAP_SECRET_KEY')
   } else if (provider) {
     throw new Error(`不支持的验证码类型: ${provider}`)
   }
@@ -1027,9 +1048,27 @@ function isRecursion (context) {
   return envObj.TCB_SOURCE.substr(-3, 3) === 'scf'
 }
 
+async function capChallenge () {
+  if (!isBuiltinCap(config)) {
+    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
+  }
+  const cap = createCap(tcbStorage(db))
+  const data = await createChallenge(cap)
+  return { code: RES_CODE.SUCCESS, ...data }
+}
+
+async function capRedeem (event) {
+  if (!isBuiltinCap(config)) {
+    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
+  }
+  const cap = createCap(tcbStorage(db))
+  const data = await redeemChallenge(cap, event)
+  return { code: RES_CODE.SUCCESS, ...data }
+}
+
 // 建立数据库 collections
 async function createCollections () {
-  const collections = ['comment', 'config', 'counter']
+  const collections = ['comment', 'config', 'counter', 'cap_challenges', 'cap_tokens']
   const res = {}
   for (const collection of collections) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-func",
-  "version": "1.7.14",
+  "version": "1.7.16",
   "description": "A simple comment system.",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",
@@ -11,6 +11,10 @@
   },
   "homepage": "https://twikoo.js.org",
   "dependencies": {
+    "@xsai/generate-text": "0.2.2",
+    "@xsai/shared": "0.2.2",
+    "@xsai/shared-chat": "0.2.2",
+    "@cap.js/server": "^4.0.5",
     "@cloudbase/manager-node": "^3.9.0",
     "@cloudbase/node-sdk": "^2.5.0",
     "@imaegoo/node-ip2region": "^2.1.1",
@@ -20,12 +24,11 @@
     "bowser": "^2.11.0",
     "cheerio": "1.0.0-rc.5",
     "crypto-js": "^4.0.0",
-    "dompurify": "^2.2.6",
+    "dompurify": "^2.5.9",
     "form-data": "^4.0.0",
     "jsdom": "^16.4.0",
     "marked": "^4.0.12",
-    "nodemailer": "^7.0.11",
-    "openai": "^6.45.0",
+    "nodemailer": "^9.0.5",
     "pushoo": "latest",
     "tencentcloud-sdk-nodejs": "^4.0.65",
     "xml2js": "^0.6.0"

package/utils/cap.js

@@ -0,0 +1,311 @@
+/**
+ * Embedded Cap.js (https://capjs.js.org) — no external Cap Standalone required.
+ * Storage adapters follow the same hooks as @cap.js/server / ink-battles.
+ */
+
+const Cap = require('@cap.js/server')
+const logger = require('./logger')
+
+const CHALLENGE_OPTS = {
+  challengeCount: 50,
+  challengeSize: 32,
+  challengeDifficulty: 4,
+  expiresMs: 600000 // 10 min
+}
+
+function memoryStorage () {
+  const challenges = new Map()
+  const tokens = new Map()
+  return {
+    challenges: {
+      store: async (token, data) => { challenges.set(token, data) },
+      read: async (token) => challenges.get(token) || null,
+      delete: async (token) => { challenges.delete(token) },
+      deleteExpired: async () => {
+        const now = Date.now()
+        for (const [k, v] of challenges) {
+          if (!v || v.expires < now) challenges.delete(k)
+        }
+      }
+    },
+    tokens: {
+      store: async (key, expires) => { tokens.set(key, expires) },
+      get: async (key) => {
+        const exp = tokens.get(key)
+        if (!exp) return null
+        if (exp < Date.now()) {
+          tokens.delete(key)
+          return null
+        }
+        return exp
+      },
+      delete: async (key) => { tokens.delete(key) },
+      deleteExpired: async () => {
+        const now = Date.now()
+        for (const [k, v] of tokens) {
+          if (v < now) tokens.delete(k)
+        }
+      }
+    }
+  }
+}
+
+/** MongoDB (native driver) — Vercel / self-hosted mongo */
+function mongoStorage (db) {
+  const challenges = () => db.collection('cap_challenges')
+  const tokens = () => db.collection('cap_tokens')
+  let indexed = false
+  const ensureIndex = () => {
+    if (indexed) return
+    indexed = true
+    challenges().createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch(() => {})
+    tokens().createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch(() => {})
+  }
+  return {
+    challenges: {
+      store: async (token, data) => {
+        ensureIndex()
+        await challenges().updateOne(
+          { token },
+          { $set: { token, challenge: data.challenge, expiresAt: new Date(data.expires) } },
+          { upsert: true }
+        )
+      },
+      read: async (token) => {
+        const doc = await challenges().findOne({ token, expiresAt: { $gt: new Date() } })
+        return doc ? { challenge: doc.challenge, expires: doc.expiresAt.getTime() } : null
+      },
+      delete: async (token) => { await challenges().deleteOne({ token }) },
+      deleteExpired: async () => { await challenges().deleteMany({ expiresAt: { $lte: new Date() } }) }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        ensureIndex()
+        await tokens().updateOne(
+          { key },
+          { $set: { key, expiresAt: new Date(expires) } },
+          { upsert: true }
+        )
+      },
+      get: async (key) => {
+        const doc = await tokens().findOne({ key, expiresAt: { $gt: new Date() } })
+        return doc ? doc.expiresAt.getTime() : null
+      },
+      delete: async (key) => { await tokens().deleteOne({ key }) },
+      deleteExpired: async () => { await tokens().deleteMany({ expiresAt: { $lte: new Date() } }) }
+    }
+  }
+}
+
+/** LokiJS — self-hosted default */
+function lokiStorage (db) {
+  const getCol = (name) => {
+    let col = db.getCollection(name)
+    if (!col) col = db.addCollection(name, { unique: ['key'] })
+    return col
+  }
+  // challenges use token field; tokens use key field
+  const getChallengeCol = () => {
+    let col = db.getCollection('cap_challenges')
+    if (!col) col = db.addCollection('cap_challenges', { unique: ['token'] })
+    return col
+  }
+  const getTokenCol = () => getCol('cap_tokens')
+  return {
+    challenges: {
+      store: async (token, data) => {
+        const col = getChallengeCol()
+        const existing = col.findOne({ token })
+        const row = { token, challenge: data.challenge, expires: data.expires }
+        if (existing) {
+          Object.assign(existing, row)
+          col.update(existing)
+        } else col.insert(row)
+      },
+      read: async (token) => {
+        const doc = getChallengeCol().findOne({ token })
+        if (!doc || doc.expires < Date.now()) return null
+        return { challenge: doc.challenge, expires: doc.expires }
+      },
+      delete: async (token) => { getChallengeCol().findAndRemove({ token }) },
+      deleteExpired: async () => {
+        getChallengeCol().findAndRemove({ expires: { $lte: Date.now() } })
+      }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        const col = getTokenCol()
+        const existing = col.findOne({ key })
+        const row = { key, expires }
+        if (existing) {
+          Object.assign(existing, row)
+          col.update(existing)
+        } else col.insert(row)
+      },
+      get: async (key) => {
+        const doc = getTokenCol().findOne({ key })
+        if (!doc || doc.expires < Date.now()) return null
+        return doc.expires
+      },
+      delete: async (key) => { getTokenCol().findAndRemove({ key }) },
+      deleteExpired: async () => {
+        getTokenCol().findAndRemove({ expires: { $lte: Date.now() } })
+      }
+    }
+  }
+}
+
+/** CloudBase / TCB database */
+function tcbStorage (db) {
+  const _ = db.command
+  return {
+    challenges: {
+      store: async (token, data) => {
+        const col = db.collection('cap_challenges')
+        try {
+          await col.doc(token).set({
+            token,
+            challenge: data.challenge,
+            expires: data.expires
+          })
+        } catch (e) {
+          // doc may exist
+          await col.doc(token).update({
+            challenge: data.challenge,
+            expires: data.expires
+          })
+        }
+      },
+      read: async (token) => {
+        try {
+          const res = await db.collection('cap_challenges').doc(token).get()
+          const doc = res.data && res.data[0]
+          if (!doc || doc.expires < Date.now()) return null
+          return { challenge: doc.challenge, expires: doc.expires }
+        } catch (e) {
+          return null
+        }
+      },
+      delete: async (token) => {
+        try { await db.collection('cap_challenges').doc(token).remove() } catch (e) {}
+      },
+      deleteExpired: async () => {
+        try {
+          await db.collection('cap_challenges').where({ expires: _.lte(Date.now()) }).remove()
+        } catch (e) {}
+      }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        // CloudBase doc id cannot contain ':'
+        const id = key.replace(/:/g, '_')
+        try {
+          await db.collection('cap_tokens').doc(id).set({ key, expires })
+        } catch (e) {
+          await db.collection('cap_tokens').doc(id).update({ key, expires })
+        }
+      },
+      get: async (key) => {
+        try {
+          const id = key.replace(/:/g, '_')
+          const res = await db.collection('cap_tokens').doc(id).get()
+          const doc = res.data && res.data[0]
+          if (!doc || doc.expires < Date.now()) return null
+          return doc.expires
+        } catch (e) {
+          return null
+        }
+      },
+      delete: async (key) => {
+        try {
+          const id = key.replace(/:/g, '_')
+          await db.collection('cap_tokens').doc(id).remove()
+        } catch (e) {}
+      },
+      deleteExpired: async () => {
+        try {
+          await db.collection('cap_tokens').where({ expires: _.lte(Date.now()) }).remove()
+        } catch (e) {}
+      }
+    }
+  }
+}
+
+/**
+ * EdgeOne Blob-style store: expects { get(key), set(key, value), del(key) }
+ * value is JSON-serializable.
+ */
+function kvStorage (kv) {
+  return {
+    challenges: {
+      store: async (token, data) => { await kv.set(`cap:c:${token}`, data) },
+      read: async (token) => {
+        const data = await kv.get(`cap:c:${token}`)
+        if (!data || data.expires < Date.now()) return null
+        return data
+      },
+      delete: async (token) => { await kv.del(`cap:c:${token}`) },
+      deleteExpired: async () => {}
+    },
+    tokens: {
+      store: async (key, expires) => { await kv.set(`cap:t:${key}`, { expires }) },
+      get: async (key) => {
+        const data = await kv.get(`cap:t:${key}`)
+        if (!data || data.expires < Date.now()) return null
+        return data.expires
+      },
+      delete: async (key) => { await kv.del(`cap:t:${key}`) },
+      deleteExpired: async () => {}
+    }
+  }
+}
+
+function createCap (storage) {
+  return new Cap({
+    noFSState: true,
+    storage: storage || memoryStorage()
+  })
+}
+
+async function createChallenge (cap) {
+  return cap.createChallenge(CHALLENGE_OPTS)
+}
+
+async function redeemChallenge (cap, body) {
+  const token = body && body.token
+  const solutions = body && body.solutions
+  if (!token || !solutions || !Array.isArray(solutions)) {
+    return { success: false, error: 'Missing token or solutions' }
+  }
+  return cap.redeemChallenge({ token, solutions })
+}
+
+async function validateToken (cap, token) {
+  if (!token) return false
+  try {
+    const { success } = await cap.validateToken(token)
+    return !!success
+  } catch (e) {
+    logger.error('Cap validateToken failed:', e)
+    return false
+  }
+}
+
+/** CAPTCHA_PROVIDER=Cap and no CAP_API_ENDPOINT → use embedded Cap */
+function isBuiltinCap (config) {
+  return config && config.CAPTCHA_PROVIDER === 'Cap' && !config.CAP_API_ENDPOINT
+}
+
+module.exports = {
+  createCap,
+  memoryStorage,
+  mongoStorage,
+  lokiStorage,
+  tcbStorage,
+  kvStorage,
+  createChallenge,
+  redeemChallenge,
+  validateToken,
+  isBuiltinCap,
+  CHALLENGE_OPTS
+}

package/utils/image.js

@@ -1,6 +1,4 @@
-const fs = require('fs')
-const os = require('os')
-const path = require('path')
+const crypto = require('crypto')
 const { isUrl } = require('.')
 const { RES_CODE } = require('./constants')
 const { getAxios, getFormData } = require('./lib')
@@ -8,9 +6,33 @@ const axios = getAxios()
 const FormData = getFormData()
 const logger = require('./logger')
 
+const MAX_IMAGE_SIZE = 10 * 1024 * 1024
+const IMAGE_TYPES = [
+  {
+    mimeType: 'image/jpeg',
+    extension: 'jpg',
+    matches: (body) => body.length >= 3 && body[0] === 0xff && body[1] === 0xd8 && body[2] === 0xff
+  },
+  {
+    mimeType: 'image/png',
+    extension: 'png',
+    matches: (body) => body.length >= 8 && body.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
+  },
+  {
+    mimeType: 'image/gif',
+    extension: 'gif',
+    matches: (body) => body.length >= 6 && (body.subarray(0, 6).equals(Buffer.from('GIF87a')) || body.subarray(0, 6).equals(Buffer.from('GIF89a')))
+  },
+  {
+    mimeType: 'image/webp',
+    extension: 'webp',
+    matches: (body) => body.length >= 12 && body.subarray(0, 4).equals(Buffer.from('RIFF')) && body.subarray(8, 12).equals(Buffer.from('WEBP'))
+  }
+]
+
 const fn = {
   async uploadImage (event, config) {
-    const { photo, fileName } = event
+    const { photo } = event
     const res = {}
     const imageService = config.IMAGE_CDN
     try {
@@ -22,8 +44,9 @@ const fn = {
       } else if (!imageService || !config.IMAGE_CDN_TOKEN) {
         throw new Error('未配置图片上传服务')
       }
+      const image = fn.parseImage(photo)
       if (config.NSFW_API_URL) {
-        const nsfwResult = await fn.checkNsfw({ photo, config })
+        const nsfwResult = await fn.checkNsfw({ image, config })
         if (nsfwResult.rejected) {
           res.code = RES_CODE.NSFW_REJECTED
           res.err = nsfwResult.message
@@ -32,21 +55,21 @@ const fn = {
       }
       // tip: qcloud 图床走前端上传，其他图床走后端上传
       if (imageService === '7bu') {
-        await fn.uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: 'https://7bu.top' })
+        await fn.uploadImageToLskyPro({ image, config, res, imageCdn: 'https://7bu.top' })
       } else if (imageService === 'see') {
-        await fn.uploadImageToSee({ photo, fileName, config, res, imageCdn: 'https://s.ee/api/v1/file/upload' })
+        await fn.uploadImageToSee({ image, config, res, imageCdn: 'https://s.ee/api/v1/file/upload' })
       } else if (isUrl(imageService)) {
-        await fn.uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: imageService })
+        await fn.uploadImageToLskyPro({ image, config, res, imageCdn: imageService })
       } else if (imageService === 'lskypro') {
-        await fn.uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: config.IMAGE_CDN_URL })
+        await fn.uploadImageToLskyPro({ image, config, res, imageCdn: config.IMAGE_CDN_URL })
       } else if (imageService === 'piclist') {
-        await fn.uploadImageToPicList({ photo, fileName, config, res, imageCdn: config.IMAGE_CDN_URL })
+        await fn.uploadImageToPicList({ image, config, res, imageCdn: config.IMAGE_CDN_URL })
       } else if (imageService === 'easyimage') {
-        await fn.uploadImageToEasyImage({ photo, fileName, config, res })
+        await fn.uploadImageToEasyImage({ image, config, res })
       } else if (imageService === 'chevereto') {
-        await fn.uploadImageToChevereto({ photo, fileName, config, res })
+        await fn.uploadImageToChevereto({ image, config, res })
       } else if (imageService === 's3') {
-        await fn.uploadImageToS3({ photo, fileName, config, res })
+        await fn.uploadImageToS3({ image, config, res })
       } else {
         throw new Error('不支持的图片上传服务')
       }
@@ -57,13 +80,13 @@ const fn = {
     }
     return res
   },
-  async checkNsfw ({ photo, config }) {
+  async checkNsfw ({ image, config }) {
     const result = { rejected: false, message: '' }
     try {
       const threshold = parseFloat(config.NSFW_THRESHOLD) || 0.5
       const apiUrl = config.NSFW_API_URL.replace(/\/$/, '')
       const formData = new FormData()
-      formData.append('image', fn.base64UrlToReadStream(photo, 'nsfw_check.jpg'))
+      fn.appendImage(formData, 'image', image)
       const response = await axios.post(`${apiUrl}/classify`, formData, {
         headers: {
           ...formData.getHeaders()
@@ -84,10 +107,10 @@ const fn = {
     }
     return result
   },
-  async uploadImageToSee ({ photo, fileName, config, res, imageCdn }) {
+  async uploadImageToSee ({ image, config, res, imageCdn }) {
     // S.EE 图床 https://s.ee (原 SM.MS)
     const formData = new FormData()
-    formData.append('smfile', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'smfile', image)
     const uploadResult = await axios.post(imageCdn, formData, {
       headers: {
         ...formData.getHeaders(),
@@ -100,10 +123,10 @@ const fn = {
       throw new Error(uploadResult.data.message)
     }
   },
-  async uploadImageToLskyPro ({ photo, fileName, config, res, imageCdn }) {
+  async uploadImageToLskyPro ({ image, config, res, imageCdn }) {
     // 自定义兰空图床（v2）URL
     const formData = new FormData()
-    formData.append('file', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'file', image)
     if (process.env.TWIKOO_LSKY_STRATEGY_ID) {
       formData.append('strategy_id', parseInt(process.env.TWIKOO_LSKY_STRATEGY_ID))
     }
@@ -125,11 +148,11 @@ const fn = {
       throw new Error(uploadResult.data.message)
     }
   },
-  async uploadImageToPicList ({ photo, fileName, config, res, imageCdn }) {
+  async uploadImageToPicList ({ image, config, res, imageCdn }) {
     // PicList https://piclist.cn/ 高效的云存储和图床平台管理工具
     // 鉴权使用 query 参数 key
     const formData = new FormData()
-    formData.append('file', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'file', image)
     let url = `${imageCdn}/upload`
     // 如果填写了 key 则拼接 url
     if (config.IMAGE_CDN_TOKEN) {
@@ -143,7 +166,7 @@ const fn = {
       throw new Error(uploadResult.data.message)
     }
   },
-  async uploadImageToEasyImage ({ photo, fileName, config, res }) {
+  async uploadImageToEasyImage ({ image, config, res }) {
     // EasyImage2.0 https://github.com/icret/EasyImages2.0 简单图床 - 一款功能强大无数据库的图床 2.0版
     try {
       // 参数校验
@@ -158,9 +181,7 @@ const fn = {
       // 添加 token 参数到 Body
       formData.append('token', config.IMAGE_CDN_TOKEN)
       // 添加图片文件（固定参数名 image）
-      formData.append('image', fn.base64UrlToReadStream(photo, fileName), {
-        filename: fileName
-      })
+      fn.appendImage(formData, 'image', image)
       // 发送请求
       const uploadResult = await axios.post(config.IMAGE_CDN_URL, formData, {
         headers: {
@@ -193,7 +214,7 @@ const fn = {
       throw new Error(errorMsg)
     }
   },
-  async uploadImageToChevereto ({ photo, fileName, config, res }) {
+  async uploadImageToChevereto ({ image, config, res }) {
     if (!config.IMAGE_CDN_URL) {
       throw new Error('未配置 Chevereto 站点地址 (IMAGE_CDN_URL)')
     }
@@ -202,7 +223,7 @@ const fn = {
     }
     const formData = new FormData()
     formData.append('key', config.IMAGE_CDN_TOKEN)
-    formData.append('source', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'source', image)
     formData.append('format', 'json')
     const apiUrl = config.IMAGE_CDN_URL.replace(/\/$/, '') + '/api/1/upload'
     const uploadResult = await axios.post(apiUrl, formData, {
@@ -222,7 +243,7 @@ const fn = {
       throw new Error(`Chevereto 上传失败: ${errMsg}`)
     }
   },
-  async uploadImageToS3 ({ photo, fileName, config, res }) {
+  async uploadImageToS3 ({ image, config, res }) {
     // 使用原生 crypto + axios 实现 AWS Signature V4，无需引入 SDK
     if (!config.S3_BUCKET) {
       throw new Error('未配置 S3 存储桶名称 (S3_BUCKET)')
@@ -233,15 +254,11 @@ const fn = {
     if (!config.S3_SECRET_ACCESS_KEY) {
       throw new Error('未配置 S3 Secret Access Key (S3_SECRET_ACCESS_KEY)')
     }
-    const crypto = require('crypto')
     const region = config.S3_REGION || 'us-east-1'
-    // 解析 base64 图片数据
-    const base64 = photo.split(';base64,').pop()
-    const mimeType = photo.split(';base64,')[0].replace('data:', '') || 'image/webp'
-    const body = Buffer.from(base64, 'base64')
+    const { body, mimeType, fileName } = image
     // 构建对象 key
     const prefix = config.S3_PATH_PREFIX ? config.S3_PATH_PREFIX.replace(/\/$/, '') + '/' : ''
-    const key = `${prefix}${Date.now()}-${fileName}`
+    const key = `${prefix}${fileName}`
     const forcePathStyle = String(config.S3_FORCE_PATH_STYLE).trim().toLowerCase() !== 'false'
     let endpoint
     let s3Base
@@ -315,11 +332,44 @@ const fn = {
     }
     res.data = { url: fileUrl }
   },
-  base64UrlToReadStream (base64Url, fileName) {
-    const base64 = base64Url.split(';base64,').pop()
-    const writePath = path.resolve(os.tmpdir(), fileName)
-    fs.writeFileSync(writePath, base64, { encoding: 'base64' })
-    return fs.createReadStream(writePath)
+  parseImage (photo) {
+    if (typeof photo !== 'string' || photo.length > Math.ceil(MAX_IMAGE_SIZE / 3) * 4 + 64) {
+      throw new Error('图片大小不能超过 10 MB')
+    }
+    const header = /^data:([a-z0-9.+-]+\/[a-z0-9.+-]+);base64,/i.exec(photo)
+    if (!header) {
+      throw new Error('图片数据格式不合法')
+    }
+    const declaredMimeType = header[1].toLowerCase()
+    const base64 = photo.slice(header[0].length)
+    if (!base64 || base64.length % 4 !== 0 || !/^[a-z0-9+/]*={0,2}$/i.test(base64)) {
+      throw new Error('图片数据格式不合法')
+    }
+    const padding = base64.endsWith('==') ? 2 : (base64.endsWith('=') ? 1 : 0)
+    const decodedSize = base64.length * 3 / 4 - padding
+    if (decodedSize > MAX_IMAGE_SIZE) {
+      throw new Error('图片大小不能超过 10 MB')
+    }
+    const body = Buffer.from(base64, 'base64')
+    const imageType = IMAGE_TYPES.find((type) => type.matches(body))
+    if (!imageType) {
+      throw new Error('仅支持 JPEG、PNG、GIF 和 WebP 图片')
+    }
+    if (declaredMimeType !== imageType.mimeType) {
+      throw new Error('图片 MIME 类型与文件内容不匹配')
+    }
+    return {
+      body,
+      mimeType: imageType.mimeType,
+      fileName: `${crypto.randomBytes(16).toString('hex')}.${imageType.extension}`
+    }
+  },
+  appendImage (formData, fieldName, image) {
+    formData.append(fieldName, image.body, {
+      filename: image.fileName,
+      contentType: image.mimeType,
+      knownLength: image.body.length
+    })
   }
 }
 

package/utils/index.js

@@ -268,7 +268,7 @@ const fn = {
       if (qqApiKey) {
         headers.Authorization = `Bearer ${qqApiKey}`
       }
-      const result = await axios.get(`https://v1.nsuuu.com/api/qqname?qq=${qqNum}`, { headers })
+      const result = await axios.get(`https://v1.tqq.me/v1/qqname?qq=${qqNum}`, { headers })
       if (result.data?.code === 200 && result.data?.data?.nick) {
         return result.data.data.nick
       }
@@ -366,11 +366,17 @@ const fn = {
       throw new Error('极验验证码检测失败: ' + e.message)
     }
   },
-  async checkCapCaptcha ({ capToken, capSecretKey, capApiEndpoint }) {
+  async checkCapCaptcha ({ capToken, capSecretKey, capApiEndpoint, cap }) {
     try {
-      // 移除末尾的斜杠，避免双斜杠
+      // 内嵌 Cap：直接 validateToken，无需外部 Standalone
+      if (cap) {
+        const { validateToken } = require('./cap')
+        const ok = await validateToken(cap, capToken)
+        if (!ok) throw new Error('验证码错误')
+        return
+      }
+      // 外部 Cap Standalone：HTTP siteverify
       const endpoint = capApiEndpoint.replace(/\/$/, '')
-      // Cap 的 siteverify 端点
       const url = `${endpoint}/siteverify`
       logger.log('Cap验证码验证URL:', url)
       logger.log('Cap验证码验证参数:', { secret: capSecretKey ? '***' : undefined, response: capToken.substring(0, 20) + '...' })
@@ -412,8 +418,7 @@ const fn = {
       HIGHLIGHT_THEME: config.HIGHLIGHT_THEME,
       HIGHLIGHT_PLUGIN: config.HIGHLIGHT_PLUGIN,
       LIMIT_LENGTH: config.LIMIT_LENGTH,
-      CAPTCHA_PROVIDER: config.CAPTCHA_PROVIDER,
-      QQ_API_KEY: config.QQ_API_KEY
+      CAPTCHA_PROVIDER: config.CAPTCHA_PROVIDER
     }
 
     // 仅在明确指定使用 Turnstile 时下发 Turnstile 的 site key
@@ -426,9 +431,13 @@ const fn = {
       baseConfig.GEETEST_CAPTCHA_ID = config.GEETEST_CAPTCHA_ID
     }
 
-    // 仅在明确指定使用 Cap 时下发 Cap 的 api endpoint
+    // Cap：有外部 endpoint 则下发；否则标记 builtin，前端走 twikoo 事件代理
     if (config.CAPTCHA_PROVIDER === 'Cap') {
-      baseConfig.CAP_API_ENDPOINT = config.CAP_API_ENDPOINT
+      if (config.CAP_API_ENDPOINT) {
+        baseConfig.CAP_API_ENDPOINT = config.CAP_API_ENDPOINT
+      } else {
+        baseConfig.CAP_BUILTIN = true
+      }
     }
 
     return {

package/utils/lib.js

@@ -71,13 +71,5 @@ module.exports = {
   getXml2js () {
     const xml2js = require('xml2js') // XML 解析
     return xml2js
-  },
-  getOpenAIClient (config) {
-    const OpenAI = require('openai') // OpenAI 的 SDK，用于反垃圾
-    const openaiClient = new OpenAI({
-      apiKey: config.LLM_API_KEY,
-      baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com'
-    })
-    return openaiClient
   }
 }

package/utils/notify.js

@@ -9,6 +9,18 @@ const pushoo = getPushoo()
 const { RES_CODE } = require('./constants')
 const logger = require('./logger')
 
+// HTML 实体转义，防止用户可控字段（昵称、邮箱等）在邮件 HTML 模板中造成存储型 XSS
+// 仅在渲染邮件时转义，不修改数据库的存储内容
+function escapeHtml (str) {
+  if (typeof str !== 'string') return str
+  return str
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
 let nodemailer
 
 function lazilyGetNodemailer () {
@@ -85,13 +97,13 @@ const fn = {
       return
     }
     const SITE_NAME = config.SITE_NAME
-    const NICK = comment.nick
+    const NICK = escapeHtml(comment.nick)
     const IMG = getAvatar(comment, config)
     const IP = comment.ip
-    const MAIL = comment.mail
+    const MAIL = escapeHtml(comment.mail)
     const COMMENT = comment.comment
     const SITE_URL = config.SITE_URL
-    const POST_URL = fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id)
+    const POST_URL = escapeHtml(fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id))
     const emailSubject = config.MAIL_SUBJECT_ADMIN || `${SITE_NAME}上有新评论了`
     let emailContent
     if (config.MAIL_TEMPLATE_ADMIN) {
@@ -160,12 +172,12 @@ const fn = {
   // 即时消息推送内容获取
   getIMPushContent (comment, config) {
     const SITE_NAME = config.SITE_NAME
-    const NICK = comment.nick
-    const MAIL = comment.mail
+    const NICK = escapeHtml(comment.nick)
+    const MAIL = escapeHtml(comment.mail)
     const IP = comment.ip
     const COMMENT = $(comment.comment).text()
     const SITE_URL = config.SITE_URL
-    const POST_URL = fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id)
+    const POST_URL = escapeHtml(fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id))
     const subject = config.MAIL_SUBJECT_ADMIN || `${SITE_NAME}有新评论了`
     const content = `评论人：${NICK} ([${MAIL}](mailto:${MAIL}))
 
@@ -199,14 +211,14 @@ const fn = {
       logger.info('回复自己的评论，不邮件通知')
       return
     }
-    const PARENT_NICK = parentComment.nick
+    const PARENT_NICK = escapeHtml(parentComment.nick)
     const IMG = getAvatar(currentComment, config)
     const PARENT_IMG = getAvatar(parentComment, config)
     const SITE_NAME = config.SITE_NAME
-    const NICK = currentComment.nick
+    const NICK = escapeHtml(currentComment.nick)
     const COMMENT = currentComment.comment
     const PARENT_COMMENT = parentComment.comment
-    const POST_URL = fn.appendHashToUrl(currentComment.href || config.SITE_URL + currentComment.url, currentComment.id)
+    const POST_URL = escapeHtml(fn.appendHashToUrl(currentComment.href || config.SITE_URL + currentComment.url, currentComment.id))
     const SITE_URL = config.SITE_URL
     const emailSubject = config.MAIL_SUBJECT || `${PARENT_NICK}，您在『${SITE_NAME}』上的评论收到了回复`
     let emailContent

package/utils/spam.js

@@ -1,8 +1,7 @@
 const {
   getAkismetClient,
   getCryptoJS,
-  getTencentcloud,
-  getOpenAIClient
+  getTencentcloud
 } = require('./lib')
 const {
   equalsMail
@@ -13,9 +12,7 @@ const CryptoJS = getCryptoJS()
 const logger = require('./logger')
 
 let tencentcloud
-let openai
-let _openaiApiKey
-let _openaiEndpoint
+let generateTextPromise
 
 function getTencentCloud () {
   if (!tencentcloud) {
@@ -28,19 +25,16 @@ function getTencentCloud () {
   return tencentcloud
 }
 
-function getOpenAI (config) {
-  if (isConfigChanged(config)) {
-    _openaiApiKey = config.LLM_API_KEY || ''
-    _openaiEndpoint = config.LLM_API_ENDPOINT || ''
-    openai = getOpenAIClient(config)
+function getGenerateText () {
+  if (!generateTextPromise) {
+    generateTextPromise = import('@xsai/generate-text')
+      .then(({ generateText }) => generateText)
+      .catch((error) => {
+        generateTextPromise = null
+        throw error
+      })
   }
-  return openai
-}
-
-function isConfigChanged (config) {
-  return !openai ||
-    _openaiApiKey !== (config.LLM_API_KEY || '') ||
-    _openaiEndpoint !== (config.LLM_API_ENDPOINT || '')
+  return generateTextPromise
 }
 
 // 提取json结构的函数
@@ -126,8 +120,6 @@ async function checkByLLM (comment, config) {
   const maxRetries = Number(config.LLM_MAX_RETRIES) || 3
   let lastError = ''
 
-  const openai = getOpenAI(config)
-
   // 网络/Provider 异常或者格式校验不通过会进入重试逻辑
   for (let attempt = 1; attempt <= maxRetries; attempt++) {
     if (attempt > 1) {
@@ -142,13 +134,16 @@ async function checkByLLM (comment, config) {
         messages = buildMessages(comment, lastError)
       }
 
-      const chatCompletion = await openai.chat.completions.create({
-        model: config.LLM_MODEL || 'deepseek-v4-pro',
-        response_format: { type: 'json_object' },
+      const generateText = await getGenerateText()
+      const chatCompletion = await generateText({
+        apiKey: config.LLM_API_KEY,
+        baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com/v1',
+        model: config.LLM_MODEL || 'deepseek-chat',
+        responseFormat: { type: 'json_object' },
         messages
       })
 
-      const rawText = chatCompletion.choices[0].message.content || ''
+      const rawText = chatCompletion.text || ''
 
       const extracted = extractJson(rawText)
       const repaired = repairJson(extracted)