twikoo-func 1.7.15 → 1.7.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-func",
-  "version": "1.7.15",
+  "version": "1.7.16",
   "description": "A simple comment system.",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",
@@ -11,6 +11,9 @@
   },
   "homepage": "https://twikoo.js.org",
   "dependencies": {
+    "@xsai/generate-text": "0.2.2",
+    "@xsai/shared": "0.2.2",
+    "@xsai/shared-chat": "0.2.2",
     "@cap.js/server": "^4.0.5",
     "@cloudbase/manager-node": "^3.9.0",
     "@cloudbase/node-sdk": "^2.5.0",
@@ -21,14 +24,13 @@
     "bowser": "^2.11.0",
     "cheerio": "1.0.0-rc.5",
     "crypto-js": "^4.0.0",
-    "dompurify": "^2.2.6",
+    "dompurify": "^2.5.9",
     "form-data": "^4.0.0",
     "jsdom": "^16.4.0",
     "marked": "^4.0.12",
-    "nodemailer": "^7.0.11",
+    "nodemailer": "^9.0.5",
     "pushoo": "latest",
     "tencentcloud-sdk-nodejs": "^4.0.65",
-    "xml2js": "^0.6.0",
-    "xsai": "^0.2.2"
+    "xml2js": "^0.6.0"
   }
 }

package/utils/image.js

@@ -1,6 +1,4 @@
-const fs = require('fs')
-const os = require('os')
-const path = require('path')
+const crypto = require('crypto')
 const { isUrl } = require('.')
 const { RES_CODE } = require('./constants')
 const { getAxios, getFormData } = require('./lib')
@@ -8,9 +6,33 @@ const axios = getAxios()
 const FormData = getFormData()
 const logger = require('./logger')
 
+const MAX_IMAGE_SIZE = 10 * 1024 * 1024
+const IMAGE_TYPES = [
+  {
+    mimeType: 'image/jpeg',
+    extension: 'jpg',
+    matches: (body) => body.length >= 3 && body[0] === 0xff && body[1] === 0xd8 && body[2] === 0xff
+  },
+  {
+    mimeType: 'image/png',
+    extension: 'png',
+    matches: (body) => body.length >= 8 && body.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
+  },
+  {
+    mimeType: 'image/gif',
+    extension: 'gif',
+    matches: (body) => body.length >= 6 && (body.subarray(0, 6).equals(Buffer.from('GIF87a')) || body.subarray(0, 6).equals(Buffer.from('GIF89a')))
+  },
+  {
+    mimeType: 'image/webp',
+    extension: 'webp',
+    matches: (body) => body.length >= 12 && body.subarray(0, 4).equals(Buffer.from('RIFF')) && body.subarray(8, 12).equals(Buffer.from('WEBP'))
+  }
+]
+
 const fn = {
   async uploadImage (event, config) {
-    const { photo, fileName } = event
+    const { photo } = event
     const res = {}
     const imageService = config.IMAGE_CDN
     try {
@@ -22,8 +44,9 @@ const fn = {
       } else if (!imageService || !config.IMAGE_CDN_TOKEN) {
         throw new Error('未配置图片上传服务')
       }
+      const image = fn.parseImage(photo)
       if (config.NSFW_API_URL) {
-        const nsfwResult = await fn.checkNsfw({ photo, config })
+        const nsfwResult = await fn.checkNsfw({ image, config })
         if (nsfwResult.rejected) {
           res.code = RES_CODE.NSFW_REJECTED
           res.err = nsfwResult.message
@@ -32,21 +55,21 @@ const fn = {
       }
       // tip: qcloud 图床走前端上传，其他图床走后端上传
       if (imageService === '7bu') {
-        await fn.uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: 'https://7bu.top' })
+        await fn.uploadImageToLskyPro({ image, config, res, imageCdn: 'https://7bu.top' })
       } else if (imageService === 'see') {
-        await fn.uploadImageToSee({ photo, fileName, config, res, imageCdn: 'https://s.ee/api/v1/file/upload' })
+        await fn.uploadImageToSee({ image, config, res, imageCdn: 'https://s.ee/api/v1/file/upload' })
       } else if (isUrl(imageService)) {
-        await fn.uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: imageService })
+        await fn.uploadImageToLskyPro({ image, config, res, imageCdn: imageService })
       } else if (imageService === 'lskypro') {
-        await fn.uploadImageToLskyPro({ photo, fileName, config, res, imageCdn: config.IMAGE_CDN_URL })
+        await fn.uploadImageToLskyPro({ image, config, res, imageCdn: config.IMAGE_CDN_URL })
       } else if (imageService === 'piclist') {
-        await fn.uploadImageToPicList({ photo, fileName, config, res, imageCdn: config.IMAGE_CDN_URL })
+        await fn.uploadImageToPicList({ image, config, res, imageCdn: config.IMAGE_CDN_URL })
       } else if (imageService === 'easyimage') {
-        await fn.uploadImageToEasyImage({ photo, fileName, config, res })
+        await fn.uploadImageToEasyImage({ image, config, res })
       } else if (imageService === 'chevereto') {
-        await fn.uploadImageToChevereto({ photo, fileName, config, res })
+        await fn.uploadImageToChevereto({ image, config, res })
       } else if (imageService === 's3') {
-        await fn.uploadImageToS3({ photo, fileName, config, res })
+        await fn.uploadImageToS3({ image, config, res })
       } else {
         throw new Error('不支持的图片上传服务')
       }
@@ -57,13 +80,13 @@ const fn = {
     }
     return res
   },
-  async checkNsfw ({ photo, config }) {
+  async checkNsfw ({ image, config }) {
     const result = { rejected: false, message: '' }
     try {
       const threshold = parseFloat(config.NSFW_THRESHOLD) || 0.5
       const apiUrl = config.NSFW_API_URL.replace(/\/$/, '')
       const formData = new FormData()
-      formData.append('image', fn.base64UrlToReadStream(photo, 'nsfw_check.jpg'))
+      fn.appendImage(formData, 'image', image)
       const response = await axios.post(`${apiUrl}/classify`, formData, {
         headers: {
           ...formData.getHeaders()
@@ -84,10 +107,10 @@ const fn = {
     }
     return result
   },
-  async uploadImageToSee ({ photo, fileName, config, res, imageCdn }) {
+  async uploadImageToSee ({ image, config, res, imageCdn }) {
     // S.EE 图床 https://s.ee (原 SM.MS)
     const formData = new FormData()
-    formData.append('smfile', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'smfile', image)
     const uploadResult = await axios.post(imageCdn, formData, {
       headers: {
         ...formData.getHeaders(),
@@ -100,10 +123,10 @@ const fn = {
       throw new Error(uploadResult.data.message)
     }
   },
-  async uploadImageToLskyPro ({ photo, fileName, config, res, imageCdn }) {
+  async uploadImageToLskyPro ({ image, config, res, imageCdn }) {
     // 自定义兰空图床（v2）URL
     const formData = new FormData()
-    formData.append('file', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'file', image)
     if (process.env.TWIKOO_LSKY_STRATEGY_ID) {
       formData.append('strategy_id', parseInt(process.env.TWIKOO_LSKY_STRATEGY_ID))
     }
@@ -125,11 +148,11 @@ const fn = {
       throw new Error(uploadResult.data.message)
     }
   },
-  async uploadImageToPicList ({ photo, fileName, config, res, imageCdn }) {
+  async uploadImageToPicList ({ image, config, res, imageCdn }) {
     // PicList https://piclist.cn/ 高效的云存储和图床平台管理工具
     // 鉴权使用 query 参数 key
     const formData = new FormData()
-    formData.append('file', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'file', image)
     let url = `${imageCdn}/upload`
     // 如果填写了 key 则拼接 url
     if (config.IMAGE_CDN_TOKEN) {
@@ -143,7 +166,7 @@ const fn = {
       throw new Error(uploadResult.data.message)
     }
   },
-  async uploadImageToEasyImage ({ photo, fileName, config, res }) {
+  async uploadImageToEasyImage ({ image, config, res }) {
     // EasyImage2.0 https://github.com/icret/EasyImages2.0 简单图床 - 一款功能强大无数据库的图床 2.0版
     try {
       // 参数校验
@@ -158,9 +181,7 @@ const fn = {
       // 添加 token 参数到 Body
       formData.append('token', config.IMAGE_CDN_TOKEN)
       // 添加图片文件（固定参数名 image）
-      formData.append('image', fn.base64UrlToReadStream(photo, fileName), {
-        filename: fileName
-      })
+      fn.appendImage(formData, 'image', image)
       // 发送请求
       const uploadResult = await axios.post(config.IMAGE_CDN_URL, formData, {
         headers: {
@@ -193,7 +214,7 @@ const fn = {
       throw new Error(errorMsg)
     }
   },
-  async uploadImageToChevereto ({ photo, fileName, config, res }) {
+  async uploadImageToChevereto ({ image, config, res }) {
     if (!config.IMAGE_CDN_URL) {
       throw new Error('未配置 Chevereto 站点地址 (IMAGE_CDN_URL)')
     }
@@ -202,7 +223,7 @@ const fn = {
     }
     const formData = new FormData()
     formData.append('key', config.IMAGE_CDN_TOKEN)
-    formData.append('source', fn.base64UrlToReadStream(photo, fileName))
+    fn.appendImage(formData, 'source', image)
     formData.append('format', 'json')
     const apiUrl = config.IMAGE_CDN_URL.replace(/\/$/, '') + '/api/1/upload'
     const uploadResult = await axios.post(apiUrl, formData, {
@@ -222,7 +243,7 @@ const fn = {
       throw new Error(`Chevereto 上传失败: ${errMsg}`)
     }
   },
-  async uploadImageToS3 ({ photo, fileName, config, res }) {
+  async uploadImageToS3 ({ image, config, res }) {
     // 使用原生 crypto + axios 实现 AWS Signature V4，无需引入 SDK
     if (!config.S3_BUCKET) {
       throw new Error('未配置 S3 存储桶名称 (S3_BUCKET)')
@@ -233,15 +254,11 @@ const fn = {
     if (!config.S3_SECRET_ACCESS_KEY) {
       throw new Error('未配置 S3 Secret Access Key (S3_SECRET_ACCESS_KEY)')
     }
-    const crypto = require('crypto')
     const region = config.S3_REGION || 'us-east-1'
-    // 解析 base64 图片数据
-    const base64 = photo.split(';base64,').pop()
-    const mimeType = photo.split(';base64,')[0].replace('data:', '') || 'image/webp'
-    const body = Buffer.from(base64, 'base64')
+    const { body, mimeType, fileName } = image
     // 构建对象 key
     const prefix = config.S3_PATH_PREFIX ? config.S3_PATH_PREFIX.replace(/\/$/, '') + '/' : ''
-    const key = `${prefix}${Date.now()}-${fileName}`
+    const key = `${prefix}${fileName}`
     const forcePathStyle = String(config.S3_FORCE_PATH_STYLE).trim().toLowerCase() !== 'false'
     let endpoint
     let s3Base
@@ -315,11 +332,44 @@ const fn = {
     }
     res.data = { url: fileUrl }
   },
-  base64UrlToReadStream (base64Url, fileName) {
-    const base64 = base64Url.split(';base64,').pop()
-    const writePath = path.resolve(os.tmpdir(), fileName)
-    fs.writeFileSync(writePath, base64, { encoding: 'base64' })
-    return fs.createReadStream(writePath)
+  parseImage (photo) {
+    if (typeof photo !== 'string' || photo.length > Math.ceil(MAX_IMAGE_SIZE / 3) * 4 + 64) {
+      throw new Error('图片大小不能超过 10 MB')
+    }
+    const header = /^data:([a-z0-9.+-]+\/[a-z0-9.+-]+);base64,/i.exec(photo)
+    if (!header) {
+      throw new Error('图片数据格式不合法')
+    }
+    const declaredMimeType = header[1].toLowerCase()
+    const base64 = photo.slice(header[0].length)
+    if (!base64 || base64.length % 4 !== 0 || !/^[a-z0-9+/]*={0,2}$/i.test(base64)) {
+      throw new Error('图片数据格式不合法')
+    }
+    const padding = base64.endsWith('==') ? 2 : (base64.endsWith('=') ? 1 : 0)
+    const decodedSize = base64.length * 3 / 4 - padding
+    if (decodedSize > MAX_IMAGE_SIZE) {
+      throw new Error('图片大小不能超过 10 MB')
+    }
+    const body = Buffer.from(base64, 'base64')
+    const imageType = IMAGE_TYPES.find((type) => type.matches(body))
+    if (!imageType) {
+      throw new Error('仅支持 JPEG、PNG、GIF 和 WebP 图片')
+    }
+    if (declaredMimeType !== imageType.mimeType) {
+      throw new Error('图片 MIME 类型与文件内容不匹配')
+    }
+    return {
+      body,
+      mimeType: imageType.mimeType,
+      fileName: `${crypto.randomBytes(16).toString('hex')}.${imageType.extension}`
+    }
+  },
+  appendImage (formData, fieldName, image) {
+    formData.append(fieldName, image.body, {
+      filename: image.fileName,
+      contentType: image.mimeType,
+      knownLength: image.body.length
+    })
   }
 }
 

package/utils/index.js

@@ -418,8 +418,7 @@ const fn = {
       HIGHLIGHT_THEME: config.HIGHLIGHT_THEME,
       HIGHLIGHT_PLUGIN: config.HIGHLIGHT_PLUGIN,
       LIMIT_LENGTH: config.LIMIT_LENGTH,
-      CAPTCHA_PROVIDER: config.CAPTCHA_PROVIDER,
-      QQ_API_KEY: config.QQ_API_KEY
+      CAPTCHA_PROVIDER: config.CAPTCHA_PROVIDER
     }
 
     // 仅在明确指定使用 Turnstile 时下发 Turnstile 的 site key

package/utils/lib.js

@@ -71,13 +71,5 @@ module.exports = {
   getXml2js () {
     const xml2js = require('xml2js') // XML 解析
     return xml2js
-  },
-  getOpenAIClient (config) {
-    const { createXSClient } = require('xsai') // xsai SDK
-    const openaiClient = createXSClient({
-      apiKey: config.LLM_API_KEY,
-      baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com/v1'
-    })
-    return openaiClient
   }
 }

package/utils/notify.js

@@ -9,6 +9,18 @@ const pushoo = getPushoo()
 const { RES_CODE } = require('./constants')
 const logger = require('./logger')
 
+// HTML 实体转义，防止用户可控字段（昵称、邮箱等）在邮件 HTML 模板中造成存储型 XSS
+// 仅在渲染邮件时转义，不修改数据库的存储内容
+function escapeHtml (str) {
+  if (typeof str !== 'string') return str
+  return str
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
 let nodemailer
 
 function lazilyGetNodemailer () {
@@ -85,13 +97,13 @@ const fn = {
       return
     }
     const SITE_NAME = config.SITE_NAME
-    const NICK = comment.nick
+    const NICK = escapeHtml(comment.nick)
     const IMG = getAvatar(comment, config)
     const IP = comment.ip
-    const MAIL = comment.mail
+    const MAIL = escapeHtml(comment.mail)
     const COMMENT = comment.comment
     const SITE_URL = config.SITE_URL
-    const POST_URL = fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id)
+    const POST_URL = escapeHtml(fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id))
     const emailSubject = config.MAIL_SUBJECT_ADMIN || `${SITE_NAME}上有新评论了`
     let emailContent
     if (config.MAIL_TEMPLATE_ADMIN) {
@@ -160,12 +172,12 @@ const fn = {
   // 即时消息推送内容获取
   getIMPushContent (comment, config) {
     const SITE_NAME = config.SITE_NAME
-    const NICK = comment.nick
-    const MAIL = comment.mail
+    const NICK = escapeHtml(comment.nick)
+    const MAIL = escapeHtml(comment.mail)
     const IP = comment.ip
     const COMMENT = $(comment.comment).text()
     const SITE_URL = config.SITE_URL
-    const POST_URL = fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id)
+    const POST_URL = escapeHtml(fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id))
     const subject = config.MAIL_SUBJECT_ADMIN || `${SITE_NAME}有新评论了`
     const content = `评论人：${NICK} ([${MAIL}](mailto:${MAIL}))
 
@@ -199,14 +211,14 @@ const fn = {
       logger.info('回复自己的评论，不邮件通知')
       return
     }
-    const PARENT_NICK = parentComment.nick
+    const PARENT_NICK = escapeHtml(parentComment.nick)
     const IMG = getAvatar(currentComment, config)
     const PARENT_IMG = getAvatar(parentComment, config)
     const SITE_NAME = config.SITE_NAME
-    const NICK = currentComment.nick
+    const NICK = escapeHtml(currentComment.nick)
     const COMMENT = currentComment.comment
     const PARENT_COMMENT = parentComment.comment
-    const POST_URL = fn.appendHashToUrl(currentComment.href || config.SITE_URL + currentComment.url, currentComment.id)
+    const POST_URL = escapeHtml(fn.appendHashToUrl(currentComment.href || config.SITE_URL + currentComment.url, currentComment.id))
     const SITE_URL = config.SITE_URL
     const emailSubject = config.MAIL_SUBJECT || `${PARENT_NICK}，您在『${SITE_NAME}』上的评论收到了回复`
     let emailContent

package/utils/spam.js

@@ -12,6 +12,7 @@ const CryptoJS = getCryptoJS()
 const logger = require('./logger')
 
 let tencentcloud
+let generateTextPromise
 
 function getTencentCloud () {
   if (!tencentcloud) {
@@ -24,6 +25,18 @@ function getTencentCloud () {
   return tencentcloud
 }
 
+function getGenerateText () {
+  if (!generateTextPromise) {
+    generateTextPromise = import('@xsai/generate-text')
+      .then(({ generateText }) => generateText)
+      .catch((error) => {
+        generateTextPromise = null
+        throw error
+      })
+  }
+  return generateTextPromise
+}
+
 // 提取json结构的函数
 function extractJson (rawText) {
   if (!rawText) return ''
@@ -121,8 +134,10 @@ async function checkByLLM (comment, config) {
         messages = buildMessages(comment, lastError)
       }
 
-      const { generateText } = require('xsai')
+      const generateText = await getGenerateText()
       const chatCompletion = await generateText({
+        apiKey: config.LLM_API_KEY,
+        baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com/v1',
         model: config.LLM_MODEL || 'deepseek-chat',
         responseFormat: { type: 'json_object' },
         messages