yakuza0 2.23.43 → 2.23.44

package/SECURITY.md

@@ -0,0 +1,32 @@
+# 2026-10-20 安全修复
+
+本次日志所示动态目标请求主要由 yakuza4 的目标策略控制。`proxysecurity_allowedtargets` 为空或未配置时不限制普通业务目标，填写后只允许列出的目标；云元数据等敏感地址始终拦截。公网项目建议启用并补齐后端白名单。
+
+框架部分保留现有协议，包含以下必要修复：
+
+- 可选 `proxyServer.lp` 不再接受任意 Cookie/请求头目标。启用时必须设置 `proxyServer.lpTargets`，请求仅能选择列表中的完整 URL。默认列表为空，拒绝未知目标。
+- Koa 最低版本为 2.16.4，修复 Host 解析等问题；http-proxy-middleware 最低版本为 2.0.10，修复 Host 驱动的路由匹配问题。均保留原有主版本。
+- 同步源码及 Babel 编译产物，更新 `pxnpm-lock.yaml`。历史 npm/yarn 锁与现有依赖不一致，不应使用它们冻结安装本次补丁。
+
+```js
+proxyServer: {
+  lp: true,
+  lpTargets: ['http://10.246.97.10:19092/gateway/api/platform'],
+}
+```
+
+`lpTargets` 必须是明确的 HTTP(S) 基础 URL，不支持通配符、查询串、fragment 或用户信息。请仅填写可信业务目标。
+
+本地验证：
+
+```sh
+node tests/proxy-security.js
+node tests/proxy-dependencies.js
+node tests/build-email-redaction.js
+```
+
+依赖测试需要先安装更新后的依赖。本次使用经 npm integrity 校验的 2.16.4 / 2.0.10 包在临时目录验证，未重装或覆盖现有 `node_modules`，未发布 npm 包。
+
+整个旧前端依赖树尚未完成跨主版本迁移，不能宣称前端所有依赖审计告警均已消除。
+
+上游公告：[Koa Host 解析](https://github.com/koajs/koa/security/advisories/GHSA-7gcc-r8m5-44qm)、[代理路由匹配](https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj)。

package/nuxt/build/index.js

@@ -4,6 +4,10 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 
+var _assign = require('babel-runtime/core-js/object/assign');
+
+var _assign2 = _interopRequireDefault(_assign);
+
 var _toConsumableArray2 = require('babel-runtime/helpers/toConsumableArray');
 
 var _toConsumableArray3 = _interopRequireDefault(_toConsumableArray2);
@@ -30,6 +34,8 @@ var _paths = require('../../config/paths');
 
 var _paths2 = _interopRequireDefault(_paths);
 
+var _runtimeDependencies = require('./runtime-dependencies');
+
 var _eslint = require('./eslint');
 
 var _eslint2 = _interopRequireDefault(_eslint);
@@ -201,6 +207,8 @@ exports.default = function (config) {
       }), _config2.default.resolve.dir)
     })(conf, ctx);
 
+    (0, _assign2.default)(conf.resolve.alias, (0, _runtimeDependencies.runtimeAliases)());
+
     (0, _eslint2.default)(conf, ctx);
 
     // if (ctx && ctx.isClient) {

package/nuxt/build/runtime-dependencies.js

@@ -0,0 +1,13 @@
+'use strict';
+
+var path = require('path');
+
+// Nuxt writes plugins into the application's build directory. Resolve the
+// protocol runtime from yakuza0, not from a possibly older hoisted UI dependency.
+var runtimeAliases = function runtimeAliases() {
+  return {
+    yakuza1: path.dirname(require.resolve('yakuza1/package.json'))
+  };
+};
+
+module.exports = { runtimeAliases: runtimeAliases };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.23.43",
+  "version": "2.23.44",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {
@@ -67,10 +67,10 @@
     "get-port": "^5.0.0",
     "html-loader": "^1.3.2",
     "http-proxy": "^1.18.1",
-    "http-proxy-middleware": "^2.0.7",
+    "http-proxy-middleware": "^2.0.10",
     "isomorphic-fetch": "^2.2.1",
     "json-format": "^1.0.1",
-    "koa": "^2.13.3",
+    "koa": "^2.16.4",
     "koa-body": "^4.0.4",
     "koa-compress": "^3.0.0",
     "koa-helmet": "7.0.2",
@@ -115,13 +115,13 @@
     "ua-parser-js": "^0.7.40",
     "uglify-js": "^3.17.4",
     "v8-compile-cache": "^2.0.2",
-    "yakuza1": "^2.6.25"
+    "yakuza1": "2.6.26"
   },
   "peerDependencies": {
     "@evolvere/nuxt": "2.15.9",
     "core-js": "3.10.1",
     "eslint": "7.2.0",
-    "yakuza1": "^2.6.25"
+    "yakuza1": "2.6.26"
   },
   "__npminstall_done": false
 }

package/pxnpm-lock.yaml

@@ -144,8 +144,8 @@ importers:
         specifier: ^1.18.1
         version: 1.18.1
       http-proxy-middleware:
-        specifier: ^2.0.7
-        version: 2.0.7
+        specifier: ^2.0.10
+        version: 2.0.10
       isomorphic-fetch:
         specifier: ^2.2.1
         version: 2.2.1
@@ -153,8 +153,8 @@ importers:
         specifier: ^1.0.1
         version: 1.0.1
       koa:
-        specifier: ^2.13.3
-        version: 2.16.0
+        specifier: ^2.16.4
+        version: 2.16.4
       koa-body:
         specifier: ^4.0.4
         version: 4.2.0
@@ -4285,14 +4285,9 @@ packages:
     resolution: {integrity: sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==}
     engines: {node: '>= 6'}
 
-  http-proxy-middleware@2.0.7:
-    resolution: {integrity: sha512-fgVY8AV7qU7z/MmXJ/rxwbrtQH4jBQ9m7kp3llF0liB7glmFeVZFBepQb32T3y8n8k2+AEYuMPCpinYW+/CuRA==}
+  http-proxy-middleware@2.0.10:
+    resolution: {integrity: sha512-RKzRWNPxUZqbuk3BC5mGVJbBnWgr+diEnjJexIOytFbBzDy88Fbh/YvBr3DsNrl1jYAfjWfpATEv0NO35FDuPQ==}
     engines: {node: '>=12.0.0'}
-    peerDependencies:
-      '@types/express': ^4.17.13
-    peerDependenciesMeta:
-      '@types/express':
-        optional: true
 
   http-proxy@1.18.1:
     resolution: {integrity: sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==}
@@ -5035,8 +5030,8 @@ packages:
     resolution: {integrity: sha512-Subc/t9vJaMtorZ/Z/yqjRaZZ4RQ8ew+aacQhYXzL6oVuaYaUGqhh3UMRB5gcpu7t9hu1QBwbJezHohLNohr3g==}
     engines: {node: '>=4'}
 
-  koa@2.16.0:
-    resolution: {integrity: sha512-Afhqq0Vq3W7C+/rW6IqHVBDLzqObwZ07JaUNUEF8yCQ6afiyFE3RAy+i7V0E46XOWlH7vPWn/x0vsZwNy6PWxw==}
+  koa@2.16.4:
+    resolution: {integrity: sha512-3An0GCLDSR34tsCO4H8Tef8Pp2ngtaZDAZnsWJYelqXUK5wyiHvGItgK/xcSkmHLSTn1Jcho1mRQs2ehRzvKKw==}
     engines: {node: ^4.8.4 || ^6.10.1 || ^7.10.1 || >= 8.1.4}
 
   last-call-webpack-plugin@3.0.0:
@@ -14067,7 +14062,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  http-proxy-middleware@2.0.7:
+  http-proxy-middleware@2.0.10:
     dependencies:
       '@types/http-proxy': 1.17.16
       http-proxy: 1.18.1
@@ -14766,7 +14761,7 @@ snapshots:
 
   koa2-connect@1.0.2: {}
 
-  koa@2.16.0:
+  koa@2.16.4:
     dependencies:
       accepts: 1.3.8
       cache-content-type: 1.0.1

package/server/proxy/conf.js

@@ -222,5 +222,5 @@ var ng_conf = exports.ng_conf = function ng_conf(_ref7) {
 
   var headers = '\n    proxy_set_header ' + _def.variable.projectNameHeader + ' \'' + th[_def.variable.projectNameHeader] + '\';\n    proxy_set_header ' + _def.variable.ipHeader + ' \'' + th[_def.variable.ipHeader] + '\';\n    proxy_set_header ' + _def.variable.childKeyHeader + ' \'' + th[_def.variable.childKeyHeader] + '\';\n    proxy_set_header ' + _def.variable.appCodeHeader + ' \'' + th[_def.variable.appCodeHeader] + '\';\n    proxy_set_header ' + _def.variable.appKeyHeader + ' \'' + th[_def.variable.appKeyHeader] + '\';\n    proxy_set_header ' + _def.variable.shareRuleHeader + ' \'' + th[_def.variable.shareRuleHeader] + '\';\n    proxy_set_header ' + _def.variable.baseURLHeader + ' \'' + th[_def.variable.baseURLHeader] + '\';\n  ';
 
-  return '\n    ' + resolver + '\n\n    server {\n      listen       ' + port + ';\n      server_name  cln-tire.lan;\n      include ' + confRoot + '/server.conf;\n\n      location ' + basePath + ' {\n          proxy_pass ' + appUrl + ';\n      }\n\n      location ' + basePath + 'apiv1 {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/apiv1/' + name + '/client/backend;\n      }\n\n      location ' + basePath + 'apiv1/feapiv1 {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/apiv1/' + name + '/client/feapiv1;\n      }\n\n      location ' + basePath + 'apiv2 {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/apiv2;\n      }\n\n      location ~ ' + basePath + 'apiv3/cln_.*feapiv1/ {\n        rewrite ^' + basePath + 'apiv3/cln_(.*)feapiv1/(.*)$ ' + basePath + 'apiv3/fe/$2 last;\n        include ' + confRoot + '/proxy.conf;\n        proxy_pass ' + yk4Addr + ';\n      }\n      location ~ ' + basePath + 'apiv3/cln_[a-z]+/ {\n        rewrite ^' + basePath + 'apiv3/cln_[a-z]+/(.*)$ ' + basePath + 'apiv3/backend/$1 last;\n        include ' + confRoot + '/proxy.conf;\n        proxy_pass ' + yk4Addr + ';\n      }\n  }\n  ';
+  return '\n    ' + resolver + '\n\n    server {\n      listen       ' + port + ';\n      server_name  cln-tire.lan;\n      include ' + confRoot + '/server.conf;\n\n      location ' + basePath + ' {\n          proxy_pass ' + appUrl + ';\n      }\n\n      location ' + basePath + 'zunir {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/zunir/' + name + '/client/backend;\n      }\n\n      location ' + basePath + 'zunir/feapiv1 {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/zunir/' + name + '/client/feapiv1;\n      }\n\n      location ' + basePath + 'apiv2 {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/apiv2;\n      }\n\n      location ~ ' + basePath + 'apiv3/cln_.*feapiv1/ {\n        rewrite ^' + basePath + 'apiv3/cln_(.*)feapiv1/(.*)$ ' + basePath + 'apiv3/fe/$2 last;\n        include ' + confRoot + '/proxy.conf;\n        proxy_pass ' + yk4Addr + ';\n      }\n      location ~ ' + basePath + 'apiv3/cln_[a-z]+/ {\n        rewrite ^' + basePath + 'apiv3/cln_[a-z]+/(.*)$ ' + basePath + 'apiv3/backend/$1 last;\n        include ' + confRoot + '/proxy.conf;\n        proxy_pass ' + yk4Addr + ';\n      }\n  }\n  ';
 };

package/server/proxy/csrf.js

@@ -355,7 +355,7 @@ exports.default = function () {
 
 
             appCp = (0, _koaMid.appCrossProxy)({ app: app, config: config });
-            appCpApiV1 = (0, _koaMid.appCrossProxy)({ app: app, config: config, extendProxyKey: ['apiv1'] });
+            appCpApiV1 = (0, _koaMid.appCrossProxy)({ app: app, config: config, extendProxyKey: ['zunir'] });
 
             jwtVerC = function jwtVerC(path) {
               return path.match(new RegExp('^/(' + _config2.default.proxyServer.apiKey + ')/'));
@@ -434,7 +434,7 @@ exports.default = function () {
             //     }
             //
             //     const extIndex = ctx.path.lastIndexOf('.')
-            //     const isApi = ctx.path.startsWith('/apiv1')
+            //     const isApi = ctx.path.startsWith('/zunir')
             //       || ctx.path.startsWith('/apiv3');
             //     const isApiV2 = ctx.path.startsWith('/apiv2');
             //     if (ctx.method === "GET"

package/server/proxy/lpTarget.js

@@ -0,0 +1,59 @@
+'use strict';
+
+var _getIterator2 = require('babel-runtime/core-js/get-iterator');
+
+var _getIterator3 = _interopRequireDefault(_getIterator2);
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var _require = require('url'),
+    URL = _require.URL;
+
+var parseTarget = function parseTarget(value) {
+  if (typeof value !== 'string') return null;
+  try {
+    var target = new URL(value);
+    if (!['http:', 'https:'].includes(target.protocol) || target.username || target.password || target.search || target.hash || value.includes('?') || value.includes('#') || value.includes('\\')) return null;
+    var host = target.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (host === '100.100.100.200' || host === '168.63.129.16' || host.startsWith('169.254.') || host === 'fd00:ec2::254' || host.startsWith('fe80:') || host.startsWith('::ffff:')) return null;
+    return target.href;
+  } catch (err) {
+    return null;
+  }
+};
+
+// Return the server-configured URL. Cookies/headers only select an exact entry;
+// they cannot supply a new destination, port, credentials, or base path.
+var resolveLpTarget = function resolveLpTarget(requested, allowedTargets) {
+  var candidate = parseTarget(requested);
+  if (!candidate || !Array.isArray(allowedTargets)) return null;
+  var _iteratorNormalCompletion = true;
+  var _didIteratorError = false;
+  var _iteratorError = undefined;
+
+  try {
+    for (var _iterator = (0, _getIterator3.default)(allowedTargets), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true) {
+      var entry = _step.value;
+
+      var allowed = parseTarget(entry);
+      if (allowed && candidate === allowed) return allowed;
+    }
+  } catch (err) {
+    _didIteratorError = true;
+    _iteratorError = err;
+  } finally {
+    try {
+      if (!_iteratorNormalCompletion && _iterator.return) {
+        _iterator.return();
+      }
+    } finally {
+      if (_didIteratorError) {
+        throw _iteratorError;
+      }
+    }
+  }
+
+  return null;
+};
+
+module.exports = { resolveLpTarget: resolveLpTarget };

package/server/proxy/tire.js

@@ -506,10 +506,10 @@ exports.default = function () {
                 (0, _child_process.exec)(_config2.default.server.tire.guPath + ' -c ' + _config2.default.server.tire.guConf + ' -g "daemon off;"');
                 // spawn(yConf.server.tire.guPath, ['-c', yConf.server.tire.guConf]);
               } else {
-                app.use(basePath + "apiv1", createProxyMiddleware((0, _extends5.default)({}, baseConfig, {
+                app.use(basePath + "zunir", createProxyMiddleware((0, _extends5.default)({}, baseConfig, {
                   target: _config2.default.server.orbProtocol.http + "//" + _config2.default.server.orbHost + ":" + _config2.default.server.orbPort,
                   headers: th,
-                  pathRewrite: (_pathRewrite = {}, (0, _defineProperty3.default)(_pathRewrite, "^" + basePath + "apiv1/feapiv1", "/" + _config2.default.proxyServer.apiKey + "/" + _config2.default.name + "/client/feapiv1"), (0, _defineProperty3.default)(_pathRewrite, "^" + basePath + "apiv1", "/" + _config2.default.proxyServer.apiKey + "/" + _config2.default.name + "/client/backend"), _pathRewrite)
+                  pathRewrite: (_pathRewrite = {}, (0, _defineProperty3.default)(_pathRewrite, "^" + basePath + "zunir/feapiv1", "/" + _config2.default.proxyServer.apiKey + "/" + _config2.default.name + "/client/feapiv1"), (0, _defineProperty3.default)(_pathRewrite, "^" + basePath + "zunir", "/" + _config2.default.proxyServer.apiKey + "/" + _config2.default.name + "/client/backend"), _pathRewrite)
                 })));
 
                 app.use(basePath + "apiv2", createProxyMiddleware((0, _extends5.default)({}, baseConfig, {

package/server/proxy/web.js

@@ -60,6 +60,8 @@ var _conf = require('./conf');
 
 var _om = require('../../utils/om');
 
+var _lpTarget = require('./lpTarget');
+
 var _httpDebug = require('../../utils/httpDebug');
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
@@ -194,7 +196,7 @@ exports.default = function () {
 
               app.use(function () {
                 var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee(ctx, next) {
-                  var lpc, lph, lp;
+                  var lpc, lph, lp, target;
                   return _regenerator2.default.wrap(function _callee$(_context) {
                     while (1) {
                       switch (_context.prev = _context.next) {
@@ -204,13 +206,25 @@ exports.default = function () {
                           lp = lph || lpc;
 
                           if (!(typeof lp === 'string' && lp.length > 0)) {
-                            _context.next = 7;
+                            _context.next = 12;
+                            break;
+                          }
+
+                          target = (0, _lpTarget.resolveLpTarget)(lp, _config2.default.proxyServer.lpTargets);
+
+                          if (target) {
+                            _context.next = 9;
                             break;
                           }
 
+                          ctx.status = 403;
+                          ctx.body = 'Proxy target denied';
+                          return _context.abrupt('return');
+
+                        case 9:
                           return _context.abrupt('return', new _promise2.default(function (resolve, reject) {
                             _mid.proxy.web(ctx.req, ctx.res, {
-                              target: lp,
+                              target: target,
                               ws: true
                             }, function (e) {
                               var status = {
@@ -222,11 +236,11 @@ exports.default = function () {
                             });
                           }));
 
-                        case 7:
-                          _context.next = 9;
+                        case 12:
+                          _context.next = 14;
                           return next();
 
-                        case 9:
+                        case 14:
                         case 'end':
                           return _context.stop();
                       }

package/utils/inclusive.js

@@ -598,12 +598,13 @@ var render = function () {
                 }
               },
               proxyServer: {
-                apiKey: 'apiv1',
+                apiKey: 'zunir',
                 apiFeV1Key: 'feapiv1',
                 apiBackendKey: 'backend',
                 baseKey: 'platform',
                 baseUrl: {},
                 lp: false,
+                lpTargets: [],
                 options: {
                   changeOrigin: true,
                   secure: false,

package/utils/koaMid.js

@@ -34,7 +34,7 @@ var appCrossProxy = exports.appCrossProxy = function appCrossProxy(_ref) {
 
   var proxyKey = [].concat((0, _toConsumableArray3.default)((0, _keys2.default)(_config2.default.proxyServer.proxy)), (0, _toConsumableArray3.default)(extendProxyKey || []));
 
-  // don't have apiv1
+  // don't have zunir
   var jwtVerProxy = function jwtVerProxy(path) {
     return path.match(new RegExp("^/(" + proxyKey.join("|") + ")/"));
   };