yakuza0 2.20.14-beta.0 → 2.20.15-beta.2

package/nuxt/head.js

@@ -34,6 +34,8 @@ var _syncRequest2 = _interopRequireDefault(_syncRequest);
 
 var _crypto = require("crypto");
 
+var _csp = require("../utils/csp");
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
@@ -79,7 +81,7 @@ exports.default = function (config) {
           try {
             if (!gv.integrity) {
               var res = (0, _syncRequest2.default)('GET', iUrl, {
-                timeout: 5000,
+                timeout: parseInt(_config2.default.server.sriTimeout, 10) || 5000,
                 headers: {
                   "Host": (0, _yakuza.jsUrl)('hostname', iUrl),
                   "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36"
@@ -103,6 +105,31 @@ exports.default = function (config) {
     head[key] = v;
   });
 
+  if (_config2.default.server.cspSwitch && _config2.default.security.isStupid) {
+    var cspStr = '';
+
+    if (_config2.default.server.cspStrict) {
+      cspStr = "default-src 'self'";
+    } else {
+      var cspObj = (0, _csp.directives)();
+      _yakuza._.forEach(cspObj, function (v, key) {
+        cspStr += key + " " + v.join(' ') + '; ';
+      });
+      cspStr = cspStr.substring(0, cspStr.length - 2);
+    }
+
+    var metaObj = {
+      'http-equiv': 'Content-Security-Policy',
+      content: cspStr
+    };
+
+    if ((0, _typeof3.default)(head['meta']) === 'object') {
+      head['meta'].push(metaObj);
+    } else {
+      head['meta'] = [metaObj];
+    }
+  }
+
   return head;
 };
 

package/nuxt/render/csp.js

@@ -10,29 +10,43 @@ var _config2 = _interopRequireDefault(_config);
 
 var _yakuza = require('yakuza1');
 
+var _csp = require('../../utils/csp');
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
-  var csp = _config2.default.server.csp;
   var cspSwitch = _config2.default.server.cspSwitch;
+  var cspObj = (0, _csp.directives)();
 
-  var cspObj = {};
-  _yakuza._.forEach(csp, function (v, key) {
-    cspObj[_yakuza._.kebabCase(key)] = _yakuza._.compact(v.map(function (k) {
-      if (_config2.default.server.cspStrict) {
-        if (k === "*" || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
-          return '';
-        }
-      }
-
-      return k;
-    }));
-  });
-
-  if (!_config2.default.security.stupid) {
-    cspObj = _yakuza._.omit(cspObj, ['require-sri-for']);
+  if (_config2.default.security.stupid) {
+    cspSwitch = false;
   }
 
+  // const csp = yConf.server.csp;
+  //
+  // let cspObj = {};
+  // _.forEach(csp, (v, key) => {
+  //   cspObj[_.kebabCase(key)] = _.compact(v.map(k => {
+  //     if (yConf.server.cspStrict) {
+  //       if (
+  //         k === "*"
+  //         || k.indexOf('*') !== -1
+  //         || k === "data:"
+  //         || k === "'unsafe-eval'"
+  //         || k === "'unsafe-inline'"
+  //       ) {
+  //         return '';
+  //       }
+  //     }
+  //
+  //     return k
+  //   }))
+  // })
+  //
+  // if (!yConf.security.stupid) {
+  //   cspObj = _.omit(cspObj, ['require-sri-for'])
+  // }
+
   return cspSwitch ? {
     enabled: true,
     policies: cspObj,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.20.14-beta.0",
+  "version": "2.20.15-beta.2",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -92,15 +92,16 @@ var _httpProxy = require('http-proxy');
 
 var _httpProxy2 = _interopRequireDefault(_httpProxy);
 
+var _csp = require('../../utils/csp');
+
 function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = obj[key]; } } newObj.default = obj; return newObj; } }
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
-// import {symmetry as gs, asymmetric as as} from 'yakuza1/lib/encrypt/general';
-
-// import paths from '../../config/paths';
-
-// import nocache from 'nocache';
+// import {getCache, keys} from "../cache/conf";
+// import csrfPri from "./csrfPri";
+// import csrfPub from "yakuza1/lib/cert/csrfPub";
+// import koaJwt from 'koa-jwt';
 var codeMessage = {
   200: '服务器成功返回请求的数据。',
   201: '新建或修改数据成功。',
@@ -118,10 +119,13 @@ var codeMessage = {
   503: '服务不可用，服务器暂时过载或维护。',
   504: '网关超时。'
 };
-// import {getCache, keys} from "../cache/conf";
-// import csrfPri from "./csrfPri";
-// import csrfPub from "yakuza1/lib/cert/csrfPub";
-// import koaJwt from 'koa-jwt';
+// import helmet from 'helmet';
+
+// import {symmetry as gs, asymmetric as as} from 'yakuza1/lib/encrypt/general';
+
+// import paths from '../../config/paths';
+
+// import nocache from 'nocache';
 
 
 var apiErr = function apiErr(options, ctx) {
@@ -165,13 +169,13 @@ var ssrReqAllow = function ssrReqAllow(ctx) {
 var ddos = {};
 
 exports.default = function () {
-  var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee11(_ref2) {
+  var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee12(_ref2) {
     var app = _ref2.app,
         config = _ref2.config;
-    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, cm;
-    return _regenerator2.default.wrap(function _callee11$(_context11) {
+    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, cm, cspObj;
+    return _regenerator2.default.wrap(function _callee12$(_context12) {
       while (1) {
-        switch (_context11.prev = _context11.next) {
+        switch (_context12.prev = _context12.next) {
           case 0:
             // if (yConf.security.isTire) {
             //   const proxy = httpProxy.createServer({
@@ -712,12 +716,44 @@ exports.default = function () {
               app.use((0, _koaHelmet2.default)());
 
               if (_config2.default.security.stupid) {
+                cspObj = (0, _csp.directives)();
+
+
+                if (_config2.default.server.cspStrict) {
+                  app.use(function () {
+                    var _ref11 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee8(ctx, next) {
+                      return _regenerator2.default.wrap(function _callee8$(_context8) {
+                        while (1) {
+                          switch (_context8.prev = _context8.next) {
+                            case 0:
+                              ctx.set('Content-Security-Policy', "default-src 'self'");
+                              ctx.set('X-Content-Security-Policy', "default-src 'self'");
+                              _context8.next = 4;
+                              return next();
+
+                            case 4:
+                            case 'end':
+                              return _context8.stop();
+                          }
+                        }
+                      }, _callee8, undefined);
+                    }));
+
+                    return function (_x17, _x18) {
+                      return _ref11.apply(this, arguments);
+                    };
+                  }());
+                } else {
+                  app.use(_koaHelmet2.default.contentSecurityPolicy({
+                    directives: cspObj
+                  }));
+                }
                 appCpApiV1(function () {
-                  var _ref11 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee8(ctx, next) {
+                  var _ref12 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee9(ctx, next) {
                     var isNext, rHost, rOrigin, rReferer;
-                    return _regenerator2.default.wrap(function _callee8$(_context8) {
+                    return _regenerator2.default.wrap(function _callee9$(_context9) {
                       while (1) {
-                        switch (_context8.prev = _context8.next) {
+                        switch (_context9.prev = _context9.next) {
                           case 0:
                             isNext = true;
                             rHost = (0, _server.jsUrl)('hostname', ctx.get('host'));
@@ -729,15 +765,15 @@ exports.default = function () {
                             }
 
                             if (!isNext) {
-                              _context8.next = 10;
+                              _context9.next = 10;
                               break;
                             }
 
-                            _context8.next = 8;
+                            _context9.next = 8;
                             return next();
 
                           case 8:
-                            _context8.next = 11;
+                            _context9.next = 11;
                             break;
 
                           case 10:
@@ -748,14 +784,14 @@ exports.default = function () {
 
                           case 11:
                           case 'end':
-                            return _context8.stop();
+                            return _context9.stop();
                         }
                       }
-                    }, _callee8, undefined);
+                    }, _callee9, undefined);
                   }));
 
-                  return function (_x17, _x18) {
-                    return _ref11.apply(this, arguments);
+                  return function (_x19, _x20) {
+                    return _ref12.apply(this, arguments);
                   };
                 }()
                 // if (ctx.method === 'GET' || ctx.method === 'POST' || jwtVerC(ctx.path)) {
@@ -769,29 +805,29 @@ exports.default = function () {
                 );
 
                 app.use(function () {
-                  var _ref12 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee9(ctx, next) {
-                    return _regenerator2.default.wrap(function _callee9$(_context9) {
+                  var _ref13 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee10(ctx, next) {
+                    return _regenerator2.default.wrap(function _callee10$(_context10) {
                       while (1) {
-                        switch (_context9.prev = _context9.next) {
+                        switch (_context10.prev = _context10.next) {
                           case 0:
                             // ctx.set('Surrogate-Control', 'no-store');
                             // ctx.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
                             // ctx.set('Pragma', 'no-cache');
                             // ctx.set('Expires', '0');
                             (0, _control.noCache)(ctx);
-                            _context9.next = 3;
+                            _context10.next = 3;
                             return next();
 
                           case 3:
                           case 'end':
-                            return _context9.stop();
+                            return _context10.stop();
                         }
                       }
-                    }, _callee9, undefined);
+                    }, _callee10, undefined);
                   }));
 
-                  return function (_x19, _x20) {
-                    return _ref12.apply(this, arguments);
+                  return function (_x21, _x22) {
+                    return _ref13.apply(this, arguments);
                   };
                 }());
               }
@@ -805,10 +841,10 @@ exports.default = function () {
             }
 
             app.use(function () {
-              var _ref13 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee10(ctx, next) {
-                return _regenerator2.default.wrap(function _callee10$(_context10) {
+              var _ref14 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee11(ctx, next) {
+                return _regenerator2.default.wrap(function _callee11$(_context11) {
                   while (1) {
-                    switch (_context10.prev = _context10.next) {
+                    switch (_context11.prev = _context11.next) {
                       case 0:
                         // const csrfCookie = ctx.cookies.get(variable.csrfCookie, {signed: false});
                         // console.log(ctx.path, ctx.req.headers.cookie, 111);
@@ -824,28 +860,28 @@ exports.default = function () {
                           cookieDomain: config.appConf.cookieDomain || _server.Cookies.getDefCookieDomain(ctx.hostname)
                         }, ctx.req.crossParams);
 
-                        _context10.next = 3;
+                        _context11.next = 3;
                         return next();
 
                       case 3:
                       case 'end':
-                        return _context10.stop();
+                        return _context11.stop();
                     }
                   }
-                }, _callee10, undefined);
+                }, _callee11, undefined);
               }));
 
-              return function (_x21, _x22) {
-                return _ref13.apply(this, arguments);
+              return function (_x23, _x24) {
+                return _ref14.apply(this, arguments);
               };
             }());
 
           case 16:
           case 'end':
-            return _context11.stop();
+            return _context12.stop();
         }
       }
-    }, _callee11, undefined);
+    }, _callee12, undefined);
   }));
 
   return function (_x) {

package/utils/csp.js

@@ -0,0 +1,38 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.directives = undefined;
+
+var _yakuza = require("yakuza1");
+
+var _config = require("../config");
+
+var _config2 = _interopRequireDefault(_config);
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var directives = exports.directives = function directives() {
+  var csp = _config2.default.server.csp;
+  // const cspSwitch = yConf.server.cspSwitch;
+
+  var cspObj = {};
+  _yakuza._.forEach(csp, function (v, key) {
+    cspObj[_yakuza._.kebabCase(key)] = _yakuza._.compact(v.map(function (k) {
+      if (_config2.default.server.cspStrict) {
+        if (k === "*" || k.indexOf('*') !== -1 || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
+          return '';
+        }
+      }
+
+      return k;
+    }));
+  });
+
+  if (!_config2.default.security.stupid) {
+    cspObj = _yakuza._.omit(cspObj, ['require-sri-for']);
+  }
+
+  return cspObj;
+};

package/utils/inclusive.js

@@ -290,6 +290,7 @@ var render = function () {
                 cspSwitch: true,
                 cspStrict: false,
                 sriSwitch: false,
+                sriTimeout: 2000,
                 // ...mainConf.server,
                 // ...ykConf.server,
                 // csp,