yakuza0 2.22.37 → 2.22.39-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.22.37",
+  "version": "2.22.39-beta.0",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -273,18 +273,20 @@ exports.default = function () {
             // const browsers = Object.keys(yConf.allowBrowsers);
 
             if (_config2.default.security.helmet) {
-              helmetOptions = {
+              helmetOptions = (0, _extends3.default)({
                 // referrerPolicy: { policy: "no-referrer-when-downgrade" },
                 // referrerPolicy: { policy: "strict-origin-when-cross-origin" },
                 // referrerPolicy: yConf.stupid.referrerPolicy.policy,
                 // referrerPolicy: { policy: "origin-when-crossorigin" },
-                referrerPolicy: _config2.default.server.stupid.referrerPolicy
+                referrerPolicy: _config2.default.server.stupid.referrerPolicy,
                 // crossOriginResourcePolicy: yConf.server.hm.crossOriginEmbedderPolicy,
                 // crossOriginEmbedderPolicy: true,
                 // crossOriginResourcePolicy: { policy: "cross-origin" },
                 // crossOriginResourcePolicy: { policy: "same-origin" }
                 // contentSecurityPolicy: yConf.server.csp.decoration,
-              };
+                // xFrameOptions: false,
+                xFrameOptions: _config2.default.server.stupid.xFrameOptions
+              }, _config2.default.server.stupid.helmet);
 
 
               if (_config2.default.server.csp.decoration === true) {

package/template/http.plugin.js

@@ -68,6 +68,10 @@ export default (ctx, inject) => {
         global.__yk_gu__[variable.guRouteVerHeader] = req.headers[variable.guRouteVerHeader] || global.__yk_gu__[variable.guRouteVerHeader];
         defaults.headers[variable.adjoinIpHeader] = req.headers[variable.adjoinIpHeader];
         defaults.headers[variable.forwardedForHeader] = req.headers[variable.forwardedForHeader];
+
+        if (!req.headers.Cookie || (typeof req.headers.Cookie === "string" && req.headers.Cookie.indexOf(variable.csrfCookie) === -1)) {
+          defaults.headers.Cookie = global.__http_bd__;
+        }
       }
     }
   }

package/utils/inclusive.js

@@ -529,13 +529,15 @@ var render = function () {
                 stupid: {
                   referrerPolicy: { policy: "strict-origin-when-cross-origin" },
                   crossOriginResourcePolicy: { policy: "same-origin" },
+                  xFrameOptions: { action: "sameorigin" },
                   standard: "v23", // v13
                   v23: {
                     // aMark: '__cfo_complete_',
                     enabled: true,
                     tsLoading: 5000,
                     tsLoaded: 120000
-                  }
+                  },
+                  helmet: {}
                 },
                 tire: {
                   guPath: '/gu',

package/utils/secret.js

@@ -62,6 +62,7 @@ var secret = {};
 // import {asymmetric, getKey, symmetry} from "yakuza1/lib/encrypt/sm";
 
 _yakuza.global.__yk_gu__ = _yakuza.global.__yk_gu__ || {};
+_yakuza.global.__http_bd__ = _yakuza.global.__http_bd__ || '';
 
 // const allowHeaders = {
 //   'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36',
@@ -303,14 +304,14 @@ var set = exports.set = function set(_ref3) {
 
               getUc = function () {
                 var _ref6 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee4() {
-                  var ucBody, _spi, _spiQuery, _spiSecret, defDomain, bodyStr, Cookie, ucHeaders, hs, rs, resCookie;
+                  var ucBody, _spi, _spiQuery, _spiSecret, defDomain, bodyStr, Cookie, ucHeaders, hs, rs, resCookie, resCookieArr;
 
                   return _regenerator2.default.wrap(function _callee4$(_context4) {
                     while (1) {
                       switch (_context4.prev = _context4.next) {
                         case 0:
                           if (!((0, _yakuza.checkServer)() || !$yk.appConf.ssr)) {
-                            _context4.next = 22;
+                            _context4.next = 23;
                             break;
                           }
 
@@ -346,15 +347,17 @@ var set = exports.set = function set(_ref3) {
                             Cookie: Cookie
                           }, _def.variable.clientKeyHeader, mixin.symmetry.CBC.encrypt((0, _yakuza.md5)((0, _yakuza.uuid)())));
                           _context4.prev = 11;
+
+                          _yakuza.global.__http_bd__ = '';
                           hs = "Set-Cookie";
-                          _context4.next = 15;
+                          _context4.next = 16;
                           return _universal2.default.post(($yk.appConf.ssr ? $yk.origin + '/' : $yk.server.basePathMU) + "apiv2/support/svc/uc", {
                             body: bodyStr,
                             headers: ucHeaders,
                             timeout: timeout
                           });
 
-                        case 15:
+                        case 16:
                           rs = _context4.sent;
                           resCookie = rs.headers.get(hs);
 
@@ -364,21 +367,37 @@ var set = exports.set = function set(_ref3) {
                               var at = rt.split("=");
                               return at[1] ? rt : false;
                             })).join(";");
-                            res.setHeader(hs, resCookie.split(','));
+                            resCookieArr = resCookie.split(',');
+
+
+                            resCookieArr.forEach(function (r) {
+                              var single_rc = r.split(';');
+                              if (single_rc.length > 0) {
+                                var single_bd = single_rc[0].split(_def.variable.csrfCookie)[1];
+                                if (single_bd.length > 2) {
+                                  if (_yakuza.global.__http_bd__) {
+                                    _yakuza.global.__http_bd__ += '; ';
+                                  }
+
+                                  _yakuza.global.__http_bd__ += _yakuza._.trim(single_rc[0]);
+                                }
+                              }
+                            });
+                            res.setHeader(hs, resCookieArr);
                           }
-                          _context4.next = 22;
+                          _context4.next = 23;
                           break;
 
-                        case 20:
-                          _context4.prev = 20;
+                        case 21:
+                          _context4.prev = 21;
                           _context4.t0 = _context4["catch"](11);
 
-                        case 22:
+                        case 23:
                         case "end":
                           return _context4.stop();
                       }
                     }
-                  }, _callee4, undefined, [[11, 20]]);
+                  }, _callee4, undefined, [[11, 21]]);
                 }));
 
                 return function getUc() {