yakuza0 2.23.34 → 2.23.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.23.34",
+  "version": "2.23.37",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {
@@ -67,7 +67,7 @@
     "get-port": "^5.0.0",
     "html-loader": "^1.3.2",
     "http-proxy": "^1.18.1",
-    "http-proxy-middleware": "^2.0.6",
+    "http-proxy-middleware": "^2.0.7",
     "isomorphic-fetch": "^2.2.1",
     "json-format": "^1.0.1",
     "koa": "^2.13.3",
@@ -112,7 +112,7 @@
     "stylus-loader": "^3.0.2",
     "sync-request": "^6.1.0",
     "tcp-port-used": "^1.0.1",
-    "ua-parser-js": "^0.7.20",
+    "ua-parser-js": "^0.7.40",
     "uglify-js": "^3.17.4",
     "v8-compile-cache": "^2.0.2",
     "yakuza1": "^2.6.21"

package/pxnpm-lock.yaml

@@ -141,7 +141,7 @@ dependencies:
     specifier: ^1.18.1
     version: 1.18.1
   http-proxy-middleware:
-    specifier: ^2.0.6
+    specifier: ^2.0.7
     version: 2.0.7
   isomorphic-fetch:
     specifier: ^2.2.1
@@ -231,7 +231,7 @@ dependencies:
     specifier: ^2.2.0
     version: 2.5.0
   string-replace-loader:
-    specifier: ^3.1.0
+    specifier: 3.1.0
     version: 3.1.0(webpack@4.47.0)
   stylelint:
     specifier: ^14.1.0
@@ -276,7 +276,7 @@ dependencies:
     specifier: ^1.0.1
     version: 1.0.2
   ua-parser-js:
-    specifier: ^0.7.20
+    specifier: ^0.7.40
     version: 0.7.40
   uglify-js:
     specifier: ^3.17.4

package/server/proxy/csrf.js

@@ -88,10 +88,6 @@ var _koaSslify2 = _interopRequireDefault(_koaSslify);
 
 var _koaMid = require('../../utils/koaMid');
 
-var _universal = require('yakuza1/lib/ky/universal');
-
-var _universal2 = _interopRequireDefault(_universal);
-
 var _fraud = require('./fraud');
 
 var fraud = _interopRequireWildcard(_fraud);
@@ -106,10 +102,14 @@ var _httpProxy2 = _interopRequireDefault(_httpProxy);
 
 var _csp = require('../../utils/csp');
 
+var _ck = require('../../utils/ck');
+
 function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = obj[key]; } } newObj.default = obj; return newObj; } }
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
+// import helmet from 'helmet';
+
 // import {symmetry as gs, asymmetric as as} from 'yakuza1/lib/encrypt/general';
 // import koaJwt from 'koa-jwt';
 var codeMessage = {
@@ -129,8 +129,6 @@ var codeMessage = {
   503: '服务不可用，服务器暂时过载或维护。',
   504: '网关超时。'
 };
-// import helmet from 'helmet';
-
 // import {getCache, keys} from "../cache/conf";
 // import csrfPri from "./csrfPri";
 // import csrfPub from "yakuza1/lib/cert/csrfPub";
@@ -176,6 +174,23 @@ var ssrReqAllow = function ssrReqAllow(ctx) {
   return ak && ak === _server.global.__yConf_ak__ && isSsr;
 };
 
+var parseBrowserType = function parseBrowserType() {
+  var userAgent = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : '';
+
+  if (typeof userAgent !== 'string' || userAgent.length > 512) {
+    return '';
+  }
+
+  try {
+    var parser = new _uaParserJs2.default();
+    parser.setUA(userAgent);
+    var result = parser.getResult();
+    return result.browser.name + parseInt(result.browser.version, 10);
+  } catch (e) {
+    return '';
+  }
+};
+
 var ddos = {};
 
 exports.default = function () {
@@ -420,7 +435,7 @@ exports.default = function () {
                 }, _callee, undefined);
               }));
 
-              return function (_x3, _x4) {
+              return function (_x4, _x5) {
                 return _ref4.apply(this, arguments);
               };
             }());
@@ -447,7 +462,7 @@ exports.default = function () {
                     }, _callee2, undefined);
                   }));
 
-                  return function (_x5, _x6) {
+                  return function (_x6, _x7) {
                     return _ref5.apply(this, arguments);
                   };
                 }());
@@ -509,7 +524,7 @@ exports.default = function () {
                 }, _callee3, undefined);
               }));
 
-              return function (_x7, _x8) {
+              return function (_x8, _x9) {
                 return _ref6.apply(this, arguments);
               };
             }());
@@ -540,7 +555,7 @@ exports.default = function () {
                 }, _callee4, undefined);
               }));
 
-              return function (_x9, _x10) {
+              return function (_x10, _x11) {
                 return _ref7.apply(this, arguments);
               };
             }());
@@ -602,7 +617,7 @@ exports.default = function () {
                   }, _callee5, undefined);
                 }));
 
-                return function (_x11, _x12) {
+                return function (_x12, _x13) {
                   return _ref8.apply(this, arguments);
                 };
               }());
@@ -640,7 +655,7 @@ exports.default = function () {
                 }, _callee6, undefined);
               }));
 
-              return function (_x13, _x14) {
+              return function (_x14, _x15) {
                 return _ref9.apply(this, arguments);
               };
             }());
@@ -737,7 +752,7 @@ exports.default = function () {
                 }, _callee7, undefined);
               }));
 
-              return function (_x15, _x16) {
+              return function (_x16, _x17) {
                 return _ref10.apply(this, arguments);
               };
             }()
@@ -786,7 +801,7 @@ exports.default = function () {
                   }, _callee8, undefined);
                 }));
 
-                return function (_x17, _x18) {
+                return function (_x18, _x19) {
                   return _ref11.apply(this, arguments);
                 };
               }());
@@ -794,16 +809,12 @@ exports.default = function () {
 
             appCp(function () {
               var _ref12 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee9(ctx, next) {
-                var parser, result, browserType, bt, bs, url, isNext;
+                var browserType, bt, bs, url, isNext;
                 return _regenerator2.default.wrap(function _callee9$(_context9) {
                   while (1) {
                     switch (_context9.prev = _context9.next) {
                       case 0:
-                        parser = new _uaParserJs2.default();
-
-                        parser.setUA(ctx.get('user-agent'));
-                        result = parser.getResult();
-                        browserType = result.browser.name + parseInt(result.browser.version, 10);
+                        browserType = parseBrowserType(ctx.get('user-agent'));
                         bt = config.appConf.server.browsers.redirect;
                         bs = config.appConf.server.browsers.static;
                         url = null;
@@ -828,14 +839,14 @@ exports.default = function () {
                         }
 
                         if (!isNext) {
-                          _context9.next = 14;
+                          _context9.next = 11;
                           break;
                         }
 
-                        _context9.next = 14;
+                        _context9.next = 11;
                         return next();
 
-                      case 14:
+                      case 11:
                       case 'end':
                         return _context9.stop();
                     }
@@ -843,7 +854,7 @@ exports.default = function () {
                 }, _callee9, undefined);
               }));
 
-              return function (_x19, _x20) {
+              return function (_x20, _x21) {
                 return _ref12.apply(this, arguments);
               };
             }());
@@ -878,7 +889,7 @@ exports.default = function () {
                   }, _callee10, undefined);
                 }));
 
-                return function (_x21, _x22) {
+                return function (_x22, _x23) {
                   return _ref13.apply(this, arguments);
                 };
               }());
@@ -911,58 +922,65 @@ exports.default = function () {
                             }
                             Cookie = _server.Cookies.koaGetCookieStr({ req: ctx.req });
 
+                            (0, _ck.logDebugSuError)(Cookie, 'rHost: ' + rHost);
+                            (0, _ck.logDebugSuError)(Cookie, 'rOrigin: ' + rOrigin);
+                            (0, _ck.logDebugSuError)(Cookie, 'rReferer: ' + rReferer);
+                            (0, _ck.logDebugSuError)(Cookie, 'rx isNext: ' + isNext);
+
                             if (!Cookie) {
-                              _context11.next = 15;
+                              _context11.next = 20;
                               break;
                             }
 
-                            _context11.prev = 7;
-                            _context11.next = 10;
-                            return _universal2.default.post(_config2.default.server.orbAddr + '/apiv2/cln/verify/ck', {
+                            _context11.prev = 11;
+                            _context11.next = 14;
+                            return (0, _server.curl)(_config2.default.server.orbAddr + '/apiv2/cln/verify/ck', {
+                              method: 'POST',
                               headers: {
                                 Cookie: Cookie
                               },
                               timeout: 2000
                             });
 
-                          case 10:
-                            _context11.next = 15;
+                          case 14:
+                            _context11.next = 20;
                             break;
 
-                          case 12:
-                            _context11.prev = 12;
-                            _context11.t0 = _context11['catch'](7);
+                          case 16:
+                            _context11.prev = 16;
+                            _context11.t0 = _context11['catch'](11);
 
+                            (0, _ck.logDebugSuError)(Cookie, _context11.t0);
                             isNext = false;
 
-                          case 15:
+                          case 20:
                             if (!isNext) {
-                              _context11.next = 20;
+                              _context11.next = 25;
                               break;
                             }
 
-                            _context11.next = 18;
+                            _context11.next = 23;
                             return next();
 
-                          case 18:
-                            _context11.next = 21;
+                          case 23:
+                            _context11.next = 26;
                             break;
 
-                          case 20:
+                          case 25:
                             ctx.body = apiErr({
                               status: 500,
                               data: '请求完整性校验错误，连接被拒绝'
                             }, ctx);
 
-                          case 21:
+                          case 26:
                           case 'end':
                             return _context11.stop();
                         }
                       }
-                    }, _callee11, undefined, [[7, 12]]);
+                    }, _callee11, undefined, [[11, 16]]);
                   }));
 
-                  return function (_x23, _x24) {
+                  return function (_x24, _x25) {
                     return _ref14.apply(this, arguments);
                   };
                 }()
@@ -998,7 +1016,7 @@ exports.default = function () {
                     }, _callee12, undefined);
                   }));
 
-                  return function (_x25, _x26) {
+                  return function (_x26, _x27) {
                     return _ref15.apply(this, arguments);
                   };
                 }());
@@ -1043,7 +1061,7 @@ exports.default = function () {
                 }, _callee13, undefined);
               }));
 
-              return function (_x27, _x28) {
+              return function (_x28, _x29) {
                 return _ref16.apply(this, arguments);
               };
             }());
@@ -1056,7 +1074,7 @@ exports.default = function () {
     }, _callee14, undefined);
   }));
 
-  return function (_x) {
+  return function (_x2) {
     return _ref3.apply(this, arguments);
   };
 }();

package/utils/ck.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.setOfflineCookie = exports.addCookieStr = undefined;
+exports.setOfflineCookie = exports.addCookieStr = exports.logDebugSuError = exports.hasCookieKey = exports.DEBUG_SU_COOKIE_KEY = undefined;
 
 var _config = require("../config");
 
@@ -13,6 +13,27 @@ var _yakuza = require("yakuza1");
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
+var DEBUG_SU_COOKIE_KEY = exports.DEBUG_SU_COOKIE_KEY = '__yk0_debug_su_';
+
+var hasCookieKey = exports.hasCookieKey = function hasCookieKey(cookieStr, key) {
+  if (!cookieStr || !key) {
+    return false;
+  }
+
+  return cookieStr.split(';').some(function (item) {
+    var cookieKey = item.trim().split('=')[0];
+    return cookieKey === key;
+  });
+};
+
+var logDebugSuError = exports.logDebugSuError = function logDebugSuError(cookieStr, err) {
+  var message = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : '[yk0 csrf verify cookie error]';
+
+  if (hasCookieKey(cookieStr, DEBUG_SU_COOKIE_KEY)) {
+    console.error(message, err);
+  }
+};
+
 var addCookieStr = exports.addCookieStr = function addCookieStr(req, oc, key) {
   var match = '';
   if ((0, _yakuza.checkServer)() && req && req.headers && req.headers.cookie) {