mirror of
https://github.com/whyour/qinglong.git
synced 2026-08-30 17:38:10 +08:00
fix: secure file routes and dependency management
This commit is contained in:
whyour
@@ -0,0 +1,125 @@
|
||||
const assert = require('node:assert/strict');
|
||||
const test = require('node:test');
|
||||
|
||||
test('dependency listing marks cache entries missing from disk for reinstall', async (t) => {
|
||||
const moduleStubs = new Map();
|
||||
const stubModule = (modulePath, exports) => {
|
||||
const resolved = require.resolve(modulePath);
|
||||
moduleStubs.set(resolved, require.cache[resolved]);
|
||||
require.cache[resolved] = {
|
||||
id: resolved,
|
||||
filename: resolved,
|
||||
loaded: true,
|
||||
exports,
|
||||
children: [],
|
||||
paths: [],
|
||||
};
|
||||
};
|
||||
|
||||
const DependenceStatus = {
|
||||
installing: 0,
|
||||
installed: 1,
|
||||
installFailed: 2,
|
||||
};
|
||||
const DependenceTypes = { nodejs: 0, python3: 1, linux: 2 };
|
||||
const docs = [
|
||||
{ id: 1, name: 'missing-package', type: 0, status: 1 },
|
||||
{ id: 2, name: 'present-package', type: 0, status: 1 },
|
||||
];
|
||||
const updates = [];
|
||||
const DependenceModel = {
|
||||
findAll: async ({ where }) => {
|
||||
if (where.status === DependenceStatus.installed) {
|
||||
return docs;
|
||||
}
|
||||
return docs.map((doc) => ({
|
||||
...doc,
|
||||
status: updates.some((update) => update.ids.includes(doc.id))
|
||||
? DependenceStatus.installFailed
|
||||
: doc.status,
|
||||
}));
|
||||
},
|
||||
update: async ({ status }, { where }) => {
|
||||
updates.push({ status, ids: where.id });
|
||||
},
|
||||
};
|
||||
|
||||
stubModule('../../back/config', {
|
||||
__esModule: true,
|
||||
default: {},
|
||||
});
|
||||
stubModule('../../back/data/dependence', {
|
||||
Dependence: class Dependence {},
|
||||
DependenceModel,
|
||||
DependenceStatus,
|
||||
DependenceTypes,
|
||||
versionDependenceCommandTypes: { 0: '@', 1: '==', 2: '=' },
|
||||
});
|
||||
stubModule('../../back/config/util', {
|
||||
concurrentRun: async (tasks) => Promise.all(tasks.map((task) => task())),
|
||||
detectOS: async () => 'Alpine',
|
||||
fileExist: async () => false,
|
||||
getGetCommand: (_type, name) => `check:${name}`,
|
||||
getInstallCommand: () => '',
|
||||
getPid: async () => 0,
|
||||
getUninstallCommand: () => '',
|
||||
killTask: async () => {},
|
||||
promiseExecSuccess: async (command) =>
|
||||
command === 'check:present-package' ? 'present-package 1.0.0\n' : '',
|
||||
});
|
||||
stubModule('../../back/config/const', {
|
||||
LINUX_DEPENDENCE_COMMAND: { Alpine: {} },
|
||||
});
|
||||
stubModule('../../back/shared/pLimit', {
|
||||
__esModule: true,
|
||||
default: {},
|
||||
});
|
||||
stubModule('../../back/shared/i18n', {
|
||||
t: (message) => message,
|
||||
tf: (message) => message,
|
||||
});
|
||||
stubModule('../../back/services/sock', {
|
||||
__esModule: true,
|
||||
default: class SockService {},
|
||||
});
|
||||
|
||||
const servicePath = require.resolve('../../back/services/dependence');
|
||||
const originalService = require.cache[servicePath];
|
||||
delete require.cache[servicePath];
|
||||
t.after(() => {
|
||||
if (originalService) {
|
||||
require.cache[servicePath] = originalService;
|
||||
} else {
|
||||
delete require.cache[servicePath];
|
||||
}
|
||||
for (const [resolved, original] of moduleStubs) {
|
||||
if (original) {
|
||||
require.cache[resolved] = original;
|
||||
} else {
|
||||
delete require.cache[resolved];
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
const DependenceService = require('../../back/services/dependence').default;
|
||||
const service = new DependenceService({}, {});
|
||||
const result = await service.dependencies({
|
||||
searchValue: '',
|
||||
type: 'nodejs',
|
||||
status: '',
|
||||
});
|
||||
|
||||
assert.deepEqual(updates, [
|
||||
{ status: DependenceStatus.installFailed, ids: [1] },
|
||||
]);
|
||||
assert.deepEqual(
|
||||
result.map(({ id, status }) => ({ id, status })),
|
||||
[
|
||||
{ id: 1, status: DependenceStatus.installFailed },
|
||||
{ id: 2, status: DependenceStatus.installed },
|
||||
],
|
||||
);
|
||||
|
||||
await service.dependencies({ searchValue: '', type: 'linux', status: '' });
|
||||
assert.equal(updates.length, 1);
|
||||
});
|
||||
@@ -0,0 +1,82 @@
|
||||
const assert = require('node:assert/strict');
|
||||
const test = require('node:test');
|
||||
const express = require('express');
|
||||
|
||||
function mockModule(modulePath, exports) {
|
||||
const filename = require.resolve(modulePath);
|
||||
require.cache[filename] = {
|
||||
id: filename,
|
||||
filename,
|
||||
loaded: true,
|
||||
exports,
|
||||
children: [],
|
||||
paths: [],
|
||||
};
|
||||
}
|
||||
|
||||
mockModule('../../back/config', {
|
||||
__esModule: true,
|
||||
default: {
|
||||
bakPath: '/tmp',
|
||||
blackFileList: [],
|
||||
configPath: '/tmp',
|
||||
logPath: '/tmp',
|
||||
logs: { level: 'info' },
|
||||
rootPath: '/tmp',
|
||||
scriptPath: '/tmp',
|
||||
systemLogPath: '/tmp',
|
||||
writePathList: ['/tmp'],
|
||||
},
|
||||
});
|
||||
mockModule('../../back/shared/i18n', {
|
||||
t: (message) => message,
|
||||
});
|
||||
mockModule('../../back/config/util', {
|
||||
fileExist: async () => false,
|
||||
readDir: async () => [],
|
||||
readDirs: async () => [],
|
||||
removeAnsi: (content) => content,
|
||||
rmPath: async () => {},
|
||||
});
|
||||
mockModule('../../back/shared/utils', {
|
||||
writeFileWithLock: async () => {},
|
||||
});
|
||||
for (const service of ['config', 'script', 'log']) {
|
||||
mockModule(`../../back/services/${service}`, {
|
||||
__esModule: true,
|
||||
default: class {},
|
||||
});
|
||||
}
|
||||
mockModule('../../back/data/runningInstance', {
|
||||
InstanceStatus: { running: 'running' },
|
||||
RunningInstanceModel: { findOne: async () => null },
|
||||
});
|
||||
|
||||
const deprecatedRoutes = [
|
||||
['config', '/configs/detail'],
|
||||
['script', '/scripts/detail'],
|
||||
['log', '/logs/detail'],
|
||||
];
|
||||
|
||||
for (const [moduleName, replacement] of deprecatedRoutes) {
|
||||
test(`${moduleName} filename route points callers to its detail API`, () => {
|
||||
const app = express.Router();
|
||||
require(`../../back/api/${moduleName}`).default(app);
|
||||
const router = app.stack.find((layer) => layer.name === 'router').handle;
|
||||
const deprecatedRoute = router.stack.find(
|
||||
(layer) => layer.route?.path === '/:file',
|
||||
);
|
||||
const handler = deprecatedRoute.route.stack.at(-1).handle;
|
||||
let responseBody;
|
||||
|
||||
handler(
|
||||
{ params: { file: 'Example.js' }, query: {} },
|
||||
{ send: (body) => (responseBody = body) },
|
||||
);
|
||||
|
||||
assert.deepEqual(responseBody, {
|
||||
code: 410,
|
||||
message: `接口已下线，请使用 ${replacement} 接口`,
|
||||
});
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
const assert = require('node:assert/strict');
|
||||
const test = require('node:test');
|
||||
|
||||
const protectedPathCase = require(
|
||||
'../../back/middlewares/protectedPathCase',
|
||||
).default;
|
||||
|
||||
function runMiddleware(path) {
|
||||
let status;
|
||||
let body;
|
||||
let nextCalled = false;
|
||||
const response = {
|
||||
status(value) {
|
||||
status = value;
|
||||
return this;
|
||||
},
|
||||
json(value) {
|
||||
body = value;
|
||||
return this;
|
||||
},
|
||||
};
|
||||
|
||||
protectedPathCase({ path }, response, () => {
|
||||
nextCalled = true;
|
||||
});
|
||||
|
||||
return { status, body, nextCalled };
|
||||
}
|
||||
|
||||
test('rejects case variations under protected API namespaces', () => {
|
||||
for (const path of [
|
||||
'/Api/configs/detail',
|
||||
'/api/Configs/detail',
|
||||
'/OPEN/scripts/detail',
|
||||
'/open/scripts/Detail',
|
||||
]) {
|
||||
assert.deepEqual(runMiddleware(path), {
|
||||
status: 400,
|
||||
body: { code: 400, message: 'Invalid path format' },
|
||||
nextCalled: false,
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
test('allows normalized protected paths and unrelated paths', () => {
|
||||
for (const path of [
|
||||
'/api/configs/detail',
|
||||
'/open/scripts/detail',
|
||||
'/OpenApi/status',
|
||||
'/assets/AppBundle.js',
|
||||
]) {
|
||||
assert.deepEqual(runMiddleware(path), {
|
||||
status: undefined,
|
||||
body: undefined,
|
||||
nextCalled: true,
|
||||
});
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,126 @@
|
||||
const assert = require('node:assert/strict');
|
||||
const fs = require('node:fs/promises');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
const test = require('node:test');
|
||||
|
||||
test('clearing a dependency cache marks installed entries for reinstall', async (t) => {
|
||||
const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'ql-dependence-'));
|
||||
const nodeCache = path.join(directory, 'node');
|
||||
await fs.mkdir(nodeCache);
|
||||
await fs.writeFile(path.join(nodeCache, 'package'), 'cached');
|
||||
t.after(() => fs.rm(directory, { recursive: true, force: true }));
|
||||
|
||||
const moduleStubs = new Map();
|
||||
const stubModule = (modulePath, exports) => {
|
||||
const resolved = require.resolve(modulePath);
|
||||
moduleStubs.set(resolved, require.cache[resolved]);
|
||||
require.cache[resolved] = {
|
||||
id: resolved,
|
||||
filename: resolved,
|
||||
loaded: true,
|
||||
exports,
|
||||
children: [],
|
||||
paths: [],
|
||||
};
|
||||
};
|
||||
const updates = [];
|
||||
const DependenceStatus = { installed: 1, installFailed: 2 };
|
||||
const DependenceTypes = { nodejs: 0, python3: 1 };
|
||||
|
||||
stubModule('../../back/config', {
|
||||
__esModule: true,
|
||||
default: { dependenceCachePath: directory },
|
||||
});
|
||||
stubModule('../../back/config/const', {
|
||||
NotificationModeStringMap: {},
|
||||
TASK_COMMAND: 'task',
|
||||
});
|
||||
stubModule('../../back/config/util', {
|
||||
getPid: async () => 0,
|
||||
killTask: async () => {},
|
||||
parseContentVersion: () => '',
|
||||
parseVersion: () => '',
|
||||
promiseExec: async () => '',
|
||||
readDirs: async () => [],
|
||||
rmPath: async () => {},
|
||||
setSystemTimezone: async () => true,
|
||||
updateLinuxMirrorFile: async () => {},
|
||||
});
|
||||
stubModule('../../back/data/dependence', {
|
||||
DependenceModel: {
|
||||
update: async (values, options) => updates.push({ values, options }),
|
||||
},
|
||||
DependenceStatus,
|
||||
DependenceTypes,
|
||||
});
|
||||
stubModule('../../back/data/notify', {});
|
||||
stubModule('../../back/data/system', {
|
||||
AuthDataType: {},
|
||||
SystemModel: {},
|
||||
});
|
||||
stubModule('../../back/shared/pLimit', {
|
||||
__esModule: true,
|
||||
default: {},
|
||||
});
|
||||
stubModule('../../back/shared/i18n', {
|
||||
setLang: () => {},
|
||||
t: (message) => message,
|
||||
});
|
||||
stubModule('../../back/services/notify', {
|
||||
__esModule: true,
|
||||
default: class NotificationService {},
|
||||
});
|
||||
stubModule('../../back/services/schedule', {
|
||||
__esModule: true,
|
||||
default: class ScheduleService {},
|
||||
});
|
||||
stubModule('../../back/services/sock', {
|
||||
__esModule: true,
|
||||
default: class SockService {},
|
||||
});
|
||||
|
||||
const servicePath = require.resolve('../../back/services/system');
|
||||
const originalService = require.cache[servicePath];
|
||||
delete require.cache[servicePath];
|
||||
t.after(() => {
|
||||
if (originalService) {
|
||||
require.cache[servicePath] = originalService;
|
||||
} else {
|
||||
delete require.cache[servicePath];
|
||||
}
|
||||
for (const [resolved, original] of moduleStubs) {
|
||||
if (original) {
|
||||
require.cache[resolved] = original;
|
||||
} else {
|
||||
delete require.cache[resolved];
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
const SystemService = require('../../back/services/system').default;
|
||||
const service = new SystemService({}, {}, {});
|
||||
assert.deepEqual(await service.cleanDependence('node'), { code: 200 });
|
||||
assert.deepEqual(await service.cleanDependence('python3'), { code: 200 });
|
||||
await assert.rejects(fs.stat(nodeCache), { code: 'ENOENT' });
|
||||
assert.deepEqual(updates, [
|
||||
{
|
||||
values: { status: DependenceStatus.installFailed },
|
||||
options: {
|
||||
where: {
|
||||
type: DependenceTypes.nodejs,
|
||||
status: DependenceStatus.installed,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
values: { status: DependenceStatus.installFailed },
|
||||
options: {
|
||||
where: {
|
||||
type: DependenceTypes.python3,
|
||||
status: DependenceStatus.installed,
|
||||
},
|
||||
},
|
||||
},
|
||||
]);
|
||||
});
|
||||
Reference in New Issue
Block a user