yakuza0 2.22.25 → 2.22.26-beta.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/nuxt/render/csp.js +1 -0
  2. package/package.json +1 -1
  3. package/server/proxy/csrf.js +114 -111
  4. package/utils/inclusive.js +14 -11
package/nuxt/render/csp.js CHANGED
@@ -21,6 +21,7 @@ exports.default = function (config) {
21
21
  }
22
22
 
23
23
  if (_config2.default.security.isStupid) {
24
+ directives['script-src'] = _yakuza._.difference(directives['script-src'], ["'self'"]);
24
25
  if (!(directives['object-src'] && _yakuza._.isArray(directives['object-src']) && directives['object-src'].length > 0)) {
25
26
  directives['object-src'] = ["'none'"];
26
27
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "yakuza0",
3
- "version": "2.22.25",
3
+ "version": "2.22.26-beta.1",
4
4
  "description": "yakuza0 with nuxt",
5
5
  "main": "index.js",
6
6
  "scripts": {
package/server/proxy/csrf.js CHANGED
@@ -404,17 +404,51 @@ exports.default = function () {
404
404
  });
405
405
  };
406
406
 
407
+ if (_config2.default.security.helmet && _config2.default.security.isStupid) {
408
+ if (typeof _config2.default.server.csp.custom === "string") {
409
+ app.use(function () {
410
+ var _ref5 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee2(ctx, next) {
411
+ return _regenerator2.default.wrap(function _callee2$(_context2) {
412
+ while (1) {
413
+ switch (_context2.prev = _context2.next) {
414
+ case 0:
415
+ ctx.set('Content-Security-Policy', _config2.default.server.csp.custom);
416
+ ctx.set('X-Content-Security-Policy', _config2.default.server.csp.custom);
417
+ _context2.next = 4;
418
+ return next();
419
+
420
+ case 4:
421
+ case 'end':
422
+ return _context2.stop();
423
+ }
424
+ }
425
+ }, _callee2, undefined);
426
+ }));
427
+
428
+ return function (_x5, _x6) {
429
+ return _ref5.apply(this, arguments);
430
+ };
431
+ }());
432
+ } else {
433
+ if (_config2.default.server.csp.decoration === true) {
434
+ app.use(_koaHelmet2.default.contentSecurityPolicy({
435
+ directives: _config2.default.server.csp.directives
436
+ }));
437
+ }
438
+ }
439
+ }
440
+
407
441
  app.use(function () {
408
- var _ref5 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee2(ctx, next) {
442
+ var _ref6 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee3(ctx, next) {
409
443
  var ycp;
410
- return _regenerator2.default.wrap(function _callee2$(_context2) {
444
+ return _regenerator2.default.wrap(function _callee3$(_context3) {
411
445
  while (1) {
412
- switch (_context2.prev = _context2.next) {
446
+ switch (_context3.prev = _context3.next) {
413
447
  case 0:
414
448
  ycp = _paths2.default.ykConfigJsonClient(config.appName);
415
449
 
416
450
  if (!(ctx.method.toUpperCase() === 'GET' && ctx.path === config.appConf.server.basePathMU + 'cln/init.js')) {
417
- _context2.next = 9;
451
+ _context3.next = 9;
418
452
  break;
419
453
  }
420
454
 
@@ -425,12 +459,12 @@ exports.default = function () {
425
459
  ctx.status = 200;
426
460
  ctx.body = _server.global.__yk_cln_init_client__;
427
461
  ctx.type = 'application/javascript; charset=utf-8';
428
- _context2.next = 18;
462
+ _context3.next = 18;
429
463
  break;
430
464
 
431
465
  case 9:
432
466
  if (!(ctx.method.toUpperCase() === 'GET' && ctx.path === config.appConf.server.basePathMU + 'cln/ini')) {
433
- _context2.next = 16;
467
+ _context3.next = 16;
434
468
  break;
435
469
  }
436
470
 
@@ -441,32 +475,32 @@ exports.default = function () {
441
475
  // global.__yk_cln_init_server__ = paths.read(ycp.confServer)
442
476
  ctx.status = 200;
443
477
  ctx.body = _server.global.__yk_cln_init_server__;
444
- _context2.next = 18;
478
+ _context3.next = 18;
445
479
  break;
446
480
 
447
481
  case 16:
448
- _context2.next = 18;
482
+ _context3.next = 18;
449
483
  return next();
450
484
 
451
485
  case 18:
452
486
  case 'end':
453
- return _context2.stop();
487
+ return _context3.stop();
454
488
  }
455
489
  }
456
- }, _callee2, undefined);
490
+ }, _callee3, undefined);
457
491
  }));
458
492
 
459
- return function (_x5, _x6) {
460
- return _ref5.apply(this, arguments);
493
+ return function (_x7, _x8) {
494
+ return _ref6.apply(this, arguments);
461
495
  };
462
496
  }());
463
497
 
464
498
  app.use(function () {
465
- var _ref6 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee3(ctx, next) {
499
+ var _ref7 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee4(ctx, next) {
466
500
  var keys;
467
- return _regenerator2.default.wrap(function _callee3$(_context3) {
501
+ return _regenerator2.default.wrap(function _callee4$(_context4) {
468
502
  while (1) {
469
- switch (_context3.prev = _context3.next) {
503
+ switch (_context4.prev = _context4.next) {
470
504
  case 0:
471
505
  if (config.appConf.server.basePath !== "/") {
472
506
  keys = [].concat((0, _toConsumableArray3.default)((0, _keys2.default)(_config2.default.proxyServer.proxy)), [_config2.default.proxyServer.apiKey]);
@@ -476,19 +510,19 @@ exports.default = function () {
476
510
  ctx.path = ctx.path.replace(config.appConf.server.basePath + "/" + tk, tk);
477
511
  });
478
512
  }
479
- _context3.next = 3;
513
+ _context4.next = 3;
480
514
  return next();
481
515
 
482
516
  case 3:
483
517
  case 'end':
484
- return _context3.stop();
518
+ return _context4.stop();
485
519
  }
486
520
  }
487
- }, _callee3, undefined);
521
+ }, _callee4, undefined);
488
522
  }));
489
523
 
490
- return function (_x7, _x8) {
491
- return _ref6.apply(this, arguments);
524
+ return function (_x9, _x10) {
525
+ return _ref7.apply(this, arguments);
492
526
  };
493
527
  }());
494
528
 
@@ -508,69 +542,69 @@ exports.default = function () {
508
542
  _server.global.__cpm__ = (0, _httpProxyMiddleware.createProxyMiddleware)((0, _extends3.default)({}, cm));
509
543
 
510
544
  appCp(function () {
511
- var _ref7 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee4(ctx, next) {
512
- return _regenerator2.default.wrap(function _callee4$(_context4) {
545
+ var _ref8 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee5(ctx, next) {
546
+ return _regenerator2.default.wrap(function _callee5$(_context5) {
513
547
  while (1) {
514
- switch (_context4.prev = _context4.next) {
548
+ switch (_context5.prev = _context5.next) {
515
549
  case 0:
516
550
  if (!(0, _om.isOmOpen)(ctx.req)) {
517
- _context4.next = 9;
551
+ _context5.next = 9;
518
552
  break;
519
553
  }
520
554
 
521
555
  if (!((0, _keys2.default)(omConf.router).length > 0)) {
522
- _context4.next = 6;
556
+ _context5.next = 6;
523
557
  break;
524
558
  }
525
559
 
526
- _context4.next = 4;
560
+ _context5.next = 4;
527
561
  return (0, _koa2Connect2.default)(_server.global.__cpm__)(ctx, next);
528
562
 
529
563
  case 4:
530
- _context4.next = 7;
564
+ _context5.next = 7;
531
565
  break;
532
566
 
533
567
  case 6:
534
568
  ctx.body = _msg.errMsg['server.om.target.none'];
535
569
 
536
570
  case 7:
537
- _context4.next = 11;
571
+ _context5.next = 11;
538
572
  break;
539
573
 
540
574
  case 9:
541
- _context4.next = 11;
575
+ _context5.next = 11;
542
576
  return next();
543
577
 
544
578
  case 11:
545
579
  case 'end':
546
- return _context4.stop();
580
+ return _context5.stop();
547
581
  }
548
582
  }
549
- }, _callee4, undefined);
583
+ }, _callee5, undefined);
550
584
  }));
551
585
 
552
- return function (_x9, _x10) {
553
- return _ref7.apply(this, arguments);
586
+ return function (_x11, _x12) {
587
+ return _ref8.apply(this, arguments);
554
588
  };
555
589
  }());
556
590
  }
557
591
 
558
592
  appCp(function () {
559
- var _ref8 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee5(ctx, next) {
560
- return _regenerator2.default.wrap(function _callee5$(_context5) {
593
+ var _ref9 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee6(ctx, next) {
594
+ return _regenerator2.default.wrap(function _callee6$(_context6) {
561
595
  while (1) {
562
- switch (_context5.prev = _context5.next) {
596
+ switch (_context6.prev = _context6.next) {
563
597
  case 0:
564
598
  if (!(ctx.method === 'GET' || ctx.method === 'POST' || jwtVerC(ctx.path))) {
565
- _context5.next = 5;
599
+ _context6.next = 5;
566
600
  break;
567
601
  }
568
602
 
569
- _context5.next = 3;
603
+ _context6.next = 3;
570
604
  return next();
571
605
 
572
606
  case 3:
573
- _context5.next = 6;
607
+ _context6.next = 6;
574
608
  break;
575
609
 
576
610
  case 5:
@@ -581,26 +615,26 @@ exports.default = function () {
581
615
 
582
616
  case 6:
583
617
  case 'end':
584
- return _context5.stop();
618
+ return _context6.stop();
585
619
  }
586
620
  }
587
- }, _callee5, undefined);
621
+ }, _callee6, undefined);
588
622
  }));
589
623
 
590
- return function (_x11, _x12) {
591
- return _ref8.apply(this, arguments);
624
+ return function (_x13, _x14) {
625
+ return _ref9.apply(this, arguments);
592
626
  };
593
627
  }());
594
628
 
595
629
  app.use(function () {
596
- var _ref9 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee6(ctx, next) {
630
+ var _ref10 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee7(ctx, next) {
597
631
  var isInclude, include, exclude, referer;
598
- return _regenerator2.default.wrap(function _callee6$(_context6) {
632
+ return _regenerator2.default.wrap(function _callee7$(_context7) {
599
633
  while (1) {
600
- switch (_context6.prev = _context6.next) {
634
+ switch (_context7.prev = _context7.next) {
601
635
  case 0:
602
636
  if (!_config2.default.server.hotLinking.enabled) {
603
- _context6.next = 21;
637
+ _context7.next = 21;
604
638
  break;
605
639
  }
606
640
 
@@ -628,51 +662,51 @@ exports.default = function () {
628
662
  // console.log(ctx.href, referer, ctx.href.indexOf(jsUrl('hostname', referer)), 11);
629
663
 
630
664
  if (!isInclude) {
631
- _context6.next = 17;
665
+ _context7.next = 17;
632
666
  break;
633
667
  }
634
668
 
635
669
  if (!(typeof referer === 'string' && referer !== '' && ctx.href.indexOf((0, _server.jsUrl)('hostname', referer)) !== -1)) {
636
- _context6.next = 14;
670
+ _context7.next = 14;
637
671
  break;
638
672
  }
639
673
 
640
- _context6.next = 12;
674
+ _context7.next = 12;
641
675
  return next();
642
676
 
643
677
  case 12:
644
- _context6.next = 15;
678
+ _context7.next = 15;
645
679
  break;
646
680
 
647
681
  case 14:
648
682
  ctx.status = 404;
649
683
 
650
684
  case 15:
651
- _context6.next = 19;
685
+ _context7.next = 19;
652
686
  break;
653
687
 
654
688
  case 17:
655
- _context6.next = 19;
689
+ _context7.next = 19;
656
690
  return next();
657
691
 
658
692
  case 19:
659
- _context6.next = 23;
693
+ _context7.next = 23;
660
694
  break;
661
695
 
662
696
  case 21:
663
- _context6.next = 23;
697
+ _context7.next = 23;
664
698
  return next();
665
699
 
666
700
  case 23:
667
701
  case 'end':
668
- return _context6.stop();
702
+ return _context7.stop();
669
703
  }
670
704
  }
671
- }, _callee6, undefined);
705
+ }, _callee7, undefined);
672
706
  }));
673
707
 
674
- return function (_x13, _x14) {
675
- return _ref9.apply(this, arguments);
708
+ return function (_x15, _x16) {
709
+ return _ref10.apply(this, arguments);
676
710
  };
677
711
  }()
678
712
  // if (!yConf.security.stupid) {
@@ -684,16 +718,16 @@ exports.default = function () {
684
718
 
685
719
  if (config.appConf.server.sslify.redirect && !config.appConf.server.generate.enabled) {
686
720
  appCp(function () {
687
- var _ref10 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee7(ctx, next) {
721
+ var _ref11 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee8(ctx, next) {
688
722
  var isRedirected;
689
- return _regenerator2.default.wrap(function _callee7$(_context7) {
723
+ return _regenerator2.default.wrap(function _callee8$(_context8) {
690
724
  while (1) {
691
- switch (_context7.prev = _context7.next) {
725
+ switch (_context8.prev = _context8.next) {
692
726
  case 0:
693
727
  isRedirected = (ctx.req.headers.cookie || '').indexOf(_config2.default.server.sslify.openKey) !== -1;
694
728
 
695
729
  if (isRedirected) {
696
- _context7.next = 7;
730
+ _context8.next = 7;
697
731
  break;
698
732
  }
699
733
 
@@ -701,37 +735,37 @@ exports.default = function () {
701
735
  signed: false,
702
736
  sameSite: _config2.default.server.cookieSameSite
703
737
  });
704
- _context7.next = 5;
738
+ _context8.next = 5;
705
739
  return (0, _koaSslify2.default)((0, _extends3.default)({}, _config2.default.server.sslify.options))(ctx, next);
706
740
 
707
741
  case 5:
708
- _context7.next = 9;
742
+ _context8.next = 9;
709
743
  break;
710
744
 
711
745
  case 7:
712
- _context7.next = 9;
746
+ _context8.next = 9;
713
747
  return next();
714
748
 
715
749
  case 9:
716
750
  case 'end':
717
- return _context7.stop();
751
+ return _context8.stop();
718
752
  }
719
753
  }
720
- }, _callee7, undefined);
754
+ }, _callee8, undefined);
721
755
  }));
722
756
 
723
- return function (_x15, _x16) {
724
- return _ref10.apply(this, arguments);
757
+ return function (_x17, _x18) {
758
+ return _ref11.apply(this, arguments);
725
759
  };
726
760
  }());
727
761
  }
728
762
 
729
763
  appCp(function () {
730
- var _ref11 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee8(ctx, next) {
764
+ var _ref12 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee9(ctx, next) {
731
765
  var parser, result, browserType, bt, bs, url, isNext;
732
- return _regenerator2.default.wrap(function _callee8$(_context8) {
766
+ return _regenerator2.default.wrap(function _callee9$(_context9) {
733
767
  while (1) {
734
- switch (_context8.prev = _context8.next) {
768
+ switch (_context9.prev = _context9.next) {
735
769
  case 0:
736
770
  parser = new _uaParserJs2.default();
737
771
 
@@ -762,23 +796,23 @@ exports.default = function () {
762
796
  }
763
797
 
764
798
  if (!isNext) {
765
- _context8.next = 14;
799
+ _context9.next = 14;
766
800
  break;
767
801
  }
768
802
 
769
- _context8.next = 14;
803
+ _context9.next = 14;
770
804
  return next();
771
805
 
772
806
  case 14:
773
807
  case 'end':
774
- return _context8.stop();
808
+ return _context9.stop();
775
809
  }
776
810
  }
777
- }, _callee8, undefined);
811
+ }, _callee9, undefined);
778
812
  }));
779
813
 
780
- return function (_x17, _x18) {
781
- return _ref11.apply(this, arguments);
814
+ return function (_x19, _x20) {
815
+ return _ref12.apply(this, arguments);
782
816
  };
783
817
  }());
784
818
 
@@ -794,37 +828,6 @@ exports.default = function () {
794
828
  // app.use(helmet());
795
829
 
796
830
  if (_config2.default.security.isStupid) {
797
- if (typeof _config2.default.server.csp.custom === "string") {
798
- app.use(function () {
799
- var _ref12 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee9(ctx, next) {
800
- return _regenerator2.default.wrap(function _callee9$(_context9) {
801
- while (1) {
802
- switch (_context9.prev = _context9.next) {
803
- case 0:
804
- ctx.set('Content-Security-Policy', _config2.default.server.csp.custom);
805
- ctx.set('X-Content-Security-Policy', _config2.default.server.csp.custom);
806
- _context9.next = 4;
807
- return next();
808
-
809
- case 4:
810
- case 'end':
811
- return _context9.stop();
812
- }
813
- }
814
- }, _callee9, undefined);
815
- }));
816
-
817
- return function (_x19, _x20) {
818
- return _ref12.apply(this, arguments);
819
- };
820
- }());
821
- } else {
822
- if (_config2.default.server.csp.custom === true) {
823
- app.use(_koaHelmet2.default.contentSecurityPolicy({
824
- directives: _config2.default.server.csp.directives
825
- }));
826
- }
827
- }
828
831
  appCpApiV1(function () {
829
832
  var _ref13 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee10(ctx, next) {
830
833
  var isNext, rHost, rOrigin, rReferer;
@@ -953,7 +956,7 @@ exports.default = function () {
953
956
  };
954
957
  }());
955
958
 
956
- case 21:
959
+ case 22:
957
960
  case 'end':
958
961
  return _context13.stop();
959
962
  }
package/utils/inclusive.js CHANGED
@@ -331,6 +331,7 @@ var render = function () {
331
331
  enabled: true,
332
332
  strict: false,
333
333
  custom: false,
334
+ decoration: false,
334
335
  policies: {},
335
336
  directives: {}
336
337
  },
@@ -775,7 +776,7 @@ var render = function () {
775
776
 
776
777
  case 28:
777
778
  _context2.t1 = conf.dkyMode;
778
- _context2.next = _context2.t1 === "dev" ? 31 : _context2.t1 === "normal" ? 34 : _context2.t1 === "prod" ? 37 : _context2.t1 === "stupid" ? 43 : _context2.t1 === "tire" ? 50 : 55;
779
+ _context2.next = _context2.t1 === "dev" ? 31 : _context2.t1 === "normal" ? 34 : _context2.t1 === "prod" ? 37 : _context2.t1 === "stupid" ? 43 : _context2.t1 === "tire" ? 52 : 57;
779
780
  break;
780
781
 
781
782
  case 31:
@@ -785,7 +786,7 @@ var render = function () {
785
786
  // conf.server.f5Offline = false;
786
787
  conf.security.isDev = true;
787
788
  conf.dev = true;
788
- return _context2.abrupt('break', 55);
789
+ return _context2.abrupt('break', 57);
789
790
 
790
791
  case 34:
791
792
  // conf.security.encrypt = "none";
@@ -794,7 +795,7 @@ var render = function () {
794
795
  // conf.server.f5Offline = false;
795
796
  conf.security.isNormal = true;
796
797
  conf.dev = false;
797
- return _context2.abrupt('break', 55);
798
+ return _context2.abrupt('break', 57);
798
799
 
799
800
  case 37:
800
801
  conf.security.encrypt = "sm";
@@ -803,7 +804,7 @@ var render = function () {
803
804
  // conf.server.f5Offline = false;
804
805
  conf.security.isProd = true;
805
806
  conf.dev = false;
806
- return _context2.abrupt('break', 55);
807
+ return _context2.abrupt('break', 57);
807
808
 
808
809
  case 43:
809
810
  conf.security.encrypt = "sm";
@@ -812,20 +813,22 @@ var render = function () {
812
813
  // conf.server.f5Offline = false;
813
814
  conf.security.isStupid = true;
814
815
  conf.server.csp.enabled = true;
816
+ conf.server.csp.strict = true;
817
+ conf.server.csp.decoration = true;
815
818
  conf.server.sri.enabled = true;
816
819
  // conf.dev = false;
817
- return _context2.abrupt('break', 55);
820
+ return _context2.abrupt('break', 57);
818
821
 
819
- case 50:
822
+ case 52:
820
823
  conf.security.encrypt = "none";
821
824
  conf.security.stupid = false;
822
825
  conf.security.helmet = false;
823
826
  // conf.server.f5Offline = false;
824
827
  conf.security.isTire = true;
825
828
  // conf.dev = false;
826
- return _context2.abrupt('break', 55);
829
+ return _context2.abrupt('break', 57);
827
830
 
828
- case 55:
831
+ case 57:
829
832
 
830
833
  // conf.router.config['app.examples'].enabled = true;
831
834
  if (conf.server.yk4Addr) {
@@ -925,7 +928,7 @@ var render = function () {
925
928
  conf.server.csp.directives = directives;
926
929
 
927
930
  // const appPortUsed = [];
928
- _context2.next = 76;
931
+ _context2.next = 78;
929
932
  return _yakuza._.asyncMap(conf.router.config, function () {
930
933
  var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee(v, key) {
931
934
  var name, arr, length, num;
@@ -1110,7 +1113,7 @@ var render = function () {
1110
1113
  };
1111
1114
  }());
1112
1115
 
1113
- case 76:
1116
+ case 78:
1114
1117
  // console.log(conf.router.config);
1115
1118
 
1116
1119
  conf.shareRule.app = conf.shareRule.app.map(function (ap) {
@@ -1232,7 +1235,7 @@ var render = function () {
1232
1235
 
1233
1236
  return _context2.abrupt('return', { conf: conf });
1234
1237
 
1235
- case 87:
1238
+ case 89:
1236
1239
  case 'end':
1237
1240
  return _context2.stop();
1238
1241
  }