yakuza0 2.21.0 → 2.21.1-beta.0

package/nuxt/head.js

@@ -28,6 +28,14 @@ var _config2 = _interopRequireDefault(_config);
 
 var _yakuza = require("yakuza1");
 
+var _syncRequest = require("sync-request");
+
+var _syncRequest2 = _interopRequireDefault(_syncRequest);
+
+var _crypto = require("crypto");
+
+var _csp = require("../utils/csp");
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
@@ -53,6 +61,14 @@ exports.default = function (config) {
   var basePath = _yakuza._.bothAddFix(config.appConf.server.basePath, "/");
 
   _yakuza._.forEach(head, function (v, key) {
+    // switch (key) {
+    //   case "script":
+    //   case "style":
+    //
+    //     break;
+    //   default:
+    // }
+
     if ((typeof v === "undefined" ? "undefined" : (0, _typeof3.default)(v)) === 'object') {
       v = _yakuza._.map(v, function (gv) {
         if (_yakuza._.startsWith(gv.src, '/')) {
@@ -61,6 +77,29 @@ exports.default = function (config) {
         if (_yakuza._.startsWith(gv.href, '/')) {
           gv.href = basePath + _yakuza._.trimStart(gv.href, "/");
         }
+
+        var iUrl = gv.src || gv.href;
+        if ((_config2.default.security.isStupid || _config2.default.server.sri.enabled) && iUrl && _yakuza._.startsWith(iUrl, 'http')) {
+          try {
+            if (!gv.integrity) {
+              var res = (0, _syncRequest2.default)('GET', iUrl, {
+                timeout: parseInt(_config2.default.server.sri.timeout, 10) || 5000,
+                headers: {
+                  "Host": (0, _yakuza.jsUrl)('hostname', iUrl),
+                  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36"
+                }
+              });
+              var iBody = res.getBody('utf8');
+              var hash = (0, _crypto.createHash)('sha384').update(iBody).digest('base64');
+              gv.integrity = "sha384-" + hash;
+            }
+
+            if (gv.integrity) {
+              gv.crossorigin = "anonymous";
+            }
+          } catch (e) {}
+        }
+
         return gv;
       });
     }
@@ -68,6 +107,31 @@ exports.default = function (config) {
     head[key] = v;
   });
 
+  if (_config2.default.server.csp.enabled) {
+    var cspStr = '';
+
+    if (_config2.default.security.isStupid && typeof _config2.default.server.csp.custom === "string") {
+      cspStr = _config2.default.server.csp.custom;
+    } else {
+      var _directives = _config2.default.server.csp.directives;
+      _yakuza._.forEach(_directives, function (v, key) {
+        cspStr += key + " " + v.join(' ') + '; ';
+      });
+      cspStr = cspStr.substring(0, cspStr.length - 2);
+    }
+
+    var metaObj = {
+      'http-equiv': 'Content-Security-Policy',
+      content: cspStr
+    };
+
+    if ((0, _typeof3.default)(head['meta']) === 'object') {
+      head['meta'].push(metaObj);
+    } else {
+      head['meta'] = [metaObj];
+    }
+  }
+
   return head;
 };
 

package/nuxt/render/csp.js

@@ -8,34 +8,19 @@ var _config = require('../../config');
 
 var _config2 = _interopRequireDefault(_config);
 
-var _yakuza = require('yakuza1');
-
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
-  var csp = _config2.default.server.csp;
-  var cspSwitch = _config2.default.server.cspSwitch;
-
-  var cspObj = {};
-  _yakuza._.forEach(csp, function (v, key) {
-    cspObj[_yakuza._.kebabCase(key)] = _yakuza._.compact(v.map(function (k) {
-      if (_config2.default.server.cspStrict) {
-        if (k === "*" || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
-          return '';
-        }
-      }
-
-      return k;
-    }));
-  });
+  var cspSwitch = _config2.default.server.csp.enabled;
+  var directives = _config2.default.server.csp.directives;
 
-  if (!_config2.default.security.stupid) {
-    cspObj = _yakuza._.omit(cspObj, ['require-sri-for']);
+  if (_config2.default.security.isStupid) {
+    cspSwitch = false;
   }
 
   return cspSwitch ? {
     enabled: true,
-    policies: cspObj,
+    policies: directives,
     hashAlgorithm: 'sha256',
     reportOnly: false
     // addMeta: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.21.0",
+  "version": "2.21.1-beta.0",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {
@@ -99,15 +99,16 @@
     "stylelint-webpack-plugin": "^3.1.0",
     "stylus": "^0.54.7",
     "stylus-loader": "^3.0.2",
+    "sync-request": "^6.1.0",
     "tcp-port-used": "^1.0.1",
     "ua-parser-js": "^0.7.20",
     "v8-compile-cache": "^2.0.2",
-    "yakuza1": "2.6.7"
+    "yakuza1": "2.6.8"
   },
   "peerDependencies": {
     "@rdc/nuxt": "2.15.8-0",
     "core-js": "3.10.1",
     "eslint": "7.2.0",
-    "yakuza1": "2.6.7"
+    "yakuza1": "2.6.8"
   }
 }

package/server/proxy/csrf.js

@@ -96,12 +96,17 @@ var _httpProxy = require('http-proxy');
 
 var _httpProxy2 = _interopRequireDefault(_httpProxy);
 
+var _csp = require('../../utils/csp');
+
 function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = obj[key]; } } newObj.default = obj; return newObj; } }
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
-// import {symmetry as gs, asymmetric as as} from 'yakuza1/lib/encrypt/general';
-// import koaJwt from 'koa-jwt';
+// import {getCache, keys} from "../cache/conf";
+// import csrfPri from "./csrfPri";
+// import csrfPub from "yakuza1/lib/cert/csrfPub";
+
+// import nocache from 'nocache';
 var codeMessage = {
   200: '服务器成功返回请求的数据。',
   201: '新建或修改数据成功。',
@@ -119,11 +124,10 @@ var codeMessage = {
   503: '服务不可用，服务器暂时过载或维护。',
   504: '网关超时。'
 };
-// import {getCache, keys} from "../cache/conf";
-// import csrfPri from "./csrfPri";
-// import csrfPub from "yakuza1/lib/cert/csrfPub";
+// import helmet from 'helmet';
 
-// import nocache from 'nocache';
+// import {symmetry as gs, asymmetric as as} from 'yakuza1/lib/encrypt/general';
+// import koaJwt from 'koa-jwt';
 
 
 var apiErr = function apiErr(options, ctx) {
@@ -167,13 +171,13 @@ var ssrReqAllow = function ssrReqAllow(ctx) {
 var ddos = {};
 
 exports.default = function () {
-  var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee12(_ref2) {
+  var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee13(_ref2) {
     var app = _ref2.app,
         config = _ref2.config;
     var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, cm;
-    return _regenerator2.default.wrap(function _callee12$(_context12) {
+    return _regenerator2.default.wrap(function _callee13$(_context13) {
       while (1) {
-        switch (_context12.prev = _context12.next) {
+        switch (_context13.prev = _context13.next) {
           case 0:
             // if (yConf.security.isTire) {
             //   const proxy = httpProxy.createServer({
@@ -759,13 +763,42 @@ exports.default = function () {
             if (_config2.default.security.helmet) {
               app.use((0, _koaHelmet2.default)());
 
-              if (_config2.default.security.stupid) {
+              if (_config2.default.security.isStupid) {
+                if (typeof _config2.default.server.csp.custom === "string") {
+                  app.use(function () {
+                    var _ref12 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee9(ctx, next) {
+                      return _regenerator2.default.wrap(function _callee9$(_context9) {
+                        while (1) {
+                          switch (_context9.prev = _context9.next) {
+                            case 0:
+                              ctx.set('Content-Security-Policy', _config2.default.server.csp.custom);
+                              ctx.set('X-Content-Security-Policy', _config2.default.server.csp.custom);
+                              _context9.next = 4;
+                              return next();
+
+                            case 4:
+                            case 'end':
+                              return _context9.stop();
+                          }
+                        }
+                      }, _callee9, undefined);
+                    }));
+
+                    return function (_x19, _x20) {
+                      return _ref12.apply(this, arguments);
+                    };
+                  }());
+                } else {
+                  app.use(_koaHelmet2.default.contentSecurityPolicy({
+                    directives: _config2.default.server.csp.directives
+                  }));
+                }
                 appCpApiV1(function () {
-                  var _ref12 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee9(ctx, next) {
+                  var _ref13 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee10(ctx, next) {
                     var isNext, rHost, rOrigin, rReferer;
-                    return _regenerator2.default.wrap(function _callee9$(_context9) {
+                    return _regenerator2.default.wrap(function _callee10$(_context10) {
                       while (1) {
-                        switch (_context9.prev = _context9.next) {
+                        switch (_context10.prev = _context10.next) {
                           case 0:
                             isNext = true;
                             rHost = (0, _server.jsUrl)('hostname', ctx.get('host'));
@@ -777,15 +810,15 @@ exports.default = function () {
                             }
 
                             if (!isNext) {
-                              _context9.next = 10;
+                              _context10.next = 10;
                               break;
                             }
 
-                            _context9.next = 8;
+                            _context10.next = 8;
                             return next();
 
                           case 8:
-                            _context9.next = 11;
+                            _context10.next = 11;
                             break;
 
                           case 10:
@@ -796,14 +829,14 @@ exports.default = function () {
 
                           case 11:
                           case 'end':
-                            return _context9.stop();
+                            return _context10.stop();
                         }
                       }
-                    }, _callee9, undefined);
+                    }, _callee10, undefined);
                   }));
 
-                  return function (_x19, _x20) {
-                    return _ref12.apply(this, arguments);
+                  return function (_x21, _x22) {
+                    return _ref13.apply(this, arguments);
                   };
                 }()
                 // if (ctx.method === 'GET' || ctx.method === 'POST' || jwtVerC(ctx.path)) {
@@ -817,29 +850,29 @@ exports.default = function () {
                 );
 
                 app.use(function () {
-                  var _ref13 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee10(ctx, next) {
-                    return _regenerator2.default.wrap(function _callee10$(_context10) {
+                  var _ref14 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee11(ctx, next) {
+                    return _regenerator2.default.wrap(function _callee11$(_context11) {
                       while (1) {
-                        switch (_context10.prev = _context10.next) {
+                        switch (_context11.prev = _context11.next) {
                           case 0:
                             // ctx.set('Surrogate-Control', 'no-store');
                             // ctx.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
                             // ctx.set('Pragma', 'no-cache');
                             // ctx.set('Expires', '0');
                             (0, _control.noCache)(ctx);
-                            _context10.next = 3;
+                            _context11.next = 3;
                             return next();
 
                           case 3:
                           case 'end':
-                            return _context10.stop();
+                            return _context11.stop();
                         }
                       }
-                    }, _callee10, undefined);
+                    }, _callee11, undefined);
                   }));
 
-                  return function (_x21, _x22) {
-                    return _ref13.apply(this, arguments);
+                  return function (_x23, _x24) {
+                    return _ref14.apply(this, arguments);
                   };
                 }());
               }
@@ -853,10 +886,10 @@ exports.default = function () {
             }
 
             app.use(function () {
-              var _ref14 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee11(ctx, next) {
-                return _regenerator2.default.wrap(function _callee11$(_context11) {
+              var _ref15 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee12(ctx, next) {
+                return _regenerator2.default.wrap(function _callee12$(_context12) {
                   while (1) {
-                    switch (_context11.prev = _context11.next) {
+                    switch (_context12.prev = _context12.next) {
                       case 0:
                         // const csrfCookie = ctx.cookies.get(variable.csrfCookie, {signed: false});
                         // console.log(ctx.path, ctx.req.headers.cookie, 111);
@@ -872,28 +905,28 @@ exports.default = function () {
                           cookieDomain: config.appConf.cookieDomain || _server.Cookies.getDefCookieDomain(ctx.hostname)
                         }, ctx.req.crossParams);
 
-                        _context11.next = 3;
+                        _context12.next = 3;
                         return next();
 
                       case 3:
                       case 'end':
-                        return _context11.stop();
+                        return _context12.stop();
                     }
                   }
-                }, _callee11, undefined);
+                }, _callee12, undefined);
               }));
 
-              return function (_x23, _x24) {
-                return _ref14.apply(this, arguments);
+              return function (_x25, _x26) {
+                return _ref15.apply(this, arguments);
               };
             }());
 
           case 17:
           case 'end':
-            return _context12.stop();
+            return _context13.stop();
         }
       }
-    }, _callee12, undefined);
+    }, _callee13, undefined);
   }));
 
   return function (_x) {

package/utils/csp.js

@@ -0,0 +1,38 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.directives = undefined;
+
+var _yakuza = require("yakuza1");
+
+var _config = require("../config");
+
+var _config2 = _interopRequireDefault(_config);
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var directives = exports.directives = function directives() {
+  var csp = _config2.default.server.csp;
+  // const cspSwitch = yConf.server.cspSwitch;
+
+  var cspObj = {};
+  _yakuza._.forEach(csp, function (v, key) {
+    cspObj[_yakuza._.kebabCase(key)] = _yakuza._.compact(v.map(function (k) {
+      if (_config2.default.server.cspStrict) {
+        if (k === "*" || k.indexOf('*') !== -1 || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
+          return '';
+        }
+      }
+
+      return k;
+    }));
+  });
+
+  if (!_config2.default.security.stupid) {
+    cspObj = _yakuza._.omit(cspObj, ['require-sri-for']);
+  }
+
+  return cspObj;
+};

package/utils/inclusive.js

@@ -69,8 +69,6 @@ var _getPort = require('get-port');
 
 var _getPort2 = _interopRequireDefault(_getPort);
 
-var _conf = require('./conf');
-
 function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = obj[key]; } } newObj.default = obj; return newObj; } }
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
@@ -189,7 +187,7 @@ var render = function () {
         ykServerEnv = _ref.ykServerEnv,
         ykPkg = _ref.pkg;
 
-    var _ykConfig, ykConf, processEnv, aliasDir, conf, cspLoop, setConfValue, setConfCSP, setConf, hostname, port, ykServer, orbAddr, tip;
+    var _ykConfig, ykConf, processEnv, aliasDir, conf, cspLoop, setConfValue, setConfCSP, setConf, hostname, port, ykServer, orbAddr, directives, tip;
 
     return _regenerator2.default.wrap(function _callee2$(_context2) {
       while (1) {
@@ -298,11 +296,25 @@ var render = function () {
                 appBuildCacheDirName: '.nuxt',
                 autoOpenBrowser: true,
                 cookieSameSite: 'Lax',
-                cspSwitch: true,
-                cspStrict: false,
+                // cspSwitch: true,
+                // cspStrict: false,
+                // cspStrictValue: "default-src 'self'",
+                // sriSwitch: false,
+                // sriTimeout: 2000,
                 // ...mainConf.server,
                 // ...ykConf.server,
                 // csp,
+                csp: {
+                  enabled: true,
+                  strict: false,
+                  strictValue: false,
+                  policies: _def.csp,
+                  directives: {}
+                },
+                sri: {
+                  enabled: false,
+                  timeout: 2000
+                },
                 ddos: {
                   enabled: true,
                   maxRequest: 6666,
@@ -584,13 +596,13 @@ var render = function () {
             };
 
             cspLoop = function cspLoop(cspConf) {
-              if (cspConf.server && cspConf.server.csp && _yakuza._.isPlainObject(cspConf.server.csp)) {
-                _yakuza._.forEach(conf.server.csp, function (v, key) {
-                  conf.server.csp[key] = _yakuza._.uniq([].concat((0, _toConsumableArray3.default)(conf.server.csp[key]), (0, _toConsumableArray3.default)(cspConf.server.csp[key] || [])));
+              if (cspConf.server && cspConf.server.csp && cspConf.server.csp.policies && _yakuza._.isPlainObject(cspConf.server.csp.policies)) {
+                _yakuza._.forEach(conf.server.csp.policies, function (v, key) {
+                  conf.server.csp.policies[key] = _yakuza._.uniq([].concat((0, _toConsumableArray3.default)(conf.server.csp.policies[key]), (0, _toConsumableArray3.default)(cspConf.server.csp.policies[key] || [])));
                 });
 
-                _yakuza._.forEach(cspConf.server.csp, function (v, key) {
-                  conf.server.csp[key] = _yakuza._.uniq([].concat((0, _toConsumableArray3.default)(conf.server.csp[key] || []), (0, _toConsumableArray3.default)(cspConf.server.csp[key] || [])));
+                _yakuza._.forEach(cspConf.server.csp.policies, function (v, key) {
+                  conf.server.csp.policies[key] = _yakuza._.uniq([].concat((0, _toConsumableArray3.default)(conf.server.csp.policies[key] || []), (0, _toConsumableArray3.default)(cspConf.server.csp.policies[key] || [])));
                 });
               }
             };
@@ -622,7 +634,7 @@ var render = function () {
               allConf.forEach(function (chunkConf) {
                 setConfValue(chunkConf);
               });
-              conf.server.csp = _def.csp;
+              conf.server.csp.policies = _def.csp;
               allConf.forEach(function (chunkConf) {
                 setConfCSP(chunkConf);
               });
@@ -683,7 +695,7 @@ var render = function () {
             });
 
             _context2.t0 = conf.dkyMode;
-            _context2.next = _context2.t0 === "dev" ? 16 : _context2.t0 === "prod" ? 18 : _context2.t0 === "stupid" ? 23 : _context2.t0 === "tire" ? 29 : 34;
+            _context2.next = _context2.t0 === "dev" ? 16 : _context2.t0 === "prod" ? 18 : _context2.t0 === "stupid" ? 23 : _context2.t0 === "tire" ? 30 : 35;
             break;
 
           case 16:
@@ -692,7 +704,7 @@ var render = function () {
             // conf.security.helmet = true;
             // conf.server.f5Offline = false;
             conf.security.isDev = true;
-            return _context2.abrupt('break', 34);
+            return _context2.abrupt('break', 35);
 
           case 18:
             conf.security.encrypt = "sm";
@@ -700,7 +712,7 @@ var render = function () {
             conf.security.helmet = true;
             // conf.server.f5Offline = false;
             conf.security.isProd = true;
-            return _context2.abrupt('break', 34);
+            return _context2.abrupt('break', 35);
 
           case 23:
             conf.security.encrypt = "sm";
@@ -708,18 +720,19 @@ var render = function () {
             conf.security.helmet = true;
             // conf.server.f5Offline = false;
             conf.security.isStupid = true;
-            conf.server.cspSwitch = true;
-            return _context2.abrupt('break', 34);
+            conf.server.csp.enabled = true;
+            conf.server.sri.enabled = true;
+            return _context2.abrupt('break', 35);
 
-          case 29:
+          case 30:
             conf.security.encrypt = "none";
             conf.security.stupid = false;
             conf.security.helmet = false;
             // conf.server.f5Offline = false;
             conf.security.isTire = true;
-            return _context2.abrupt('break', 34);
+            return _context2.abrupt('break', 35);
 
-          case 34:
+          case 35:
 
             // conf.router.config['app.examples'].enabled = true;
             if (conf.server.yk4Addr) {
@@ -796,10 +809,30 @@ var render = function () {
             conf.proxyServer.proxy[conf.proxyServer.ws.key] = orbAddr;
             conf.server.orbAddr = orbAddr;
 
-            conf.server.csp.imgSrc = _yakuza._.uniq([].concat((0, _toConsumableArray3.default)(conf.server.csp.imgSrc || []), (0, _toConsumableArray3.default)(conf.server.tfs.fastdfs.domain)));
+            conf.server.csp.policies.imgSrc = _yakuza._.uniq([].concat((0, _toConsumableArray3.default)(conf.server.csp.policies.imgSrc || []), (0, _toConsumableArray3.default)(conf.server.tfs.fastdfs.domain)));
+
+            // csp
+            directives = {};
+
+            _yakuza._.forEach(conf.server.csp.policies, function (v, key) {
+              directives[_yakuza._.kebabCase(key)] = _yakuza._.compact(((typeof v === 'undefined' ? 'undefined' : (0, _typeof3.default)(v)) === "object" ? v : []).map(function (k) {
+                if (conf.server.csp.strict) {
+                  if (k === "*" || k.indexOf('*') !== -1 || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
+                    return '';
+                  }
+                }
+
+                return k;
+              }));
+            });
+
+            if (!conf.security.isStupid) {
+              directives = _yakuza._.omit(directives, ['require-sri-for']);
+            }
+            conf.server.csp.directives = directives;
 
             // const appPortUsed = [];
-            _context2.next = 51;
+            _context2.next = 56;
             return _yakuza._.asyncMap(conf.router.config, function () {
               var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee(v, key) {
                 var name, arr, length, num;
@@ -981,7 +1014,7 @@ var render = function () {
               };
             }());
 
-          case 51:
+          case 56:
             // console.log(conf.router.config);
 
             conf.shareRule.app = conf.shareRule.app.map(function (ap) {
@@ -1081,7 +1114,7 @@ var render = function () {
 
             return _context2.abrupt('return', { conf: conf });
 
-          case 58:
+          case 63:
           case 'end':
             return _context2.stop();
         }