Fix auth bypass: normalize URL path to lowercase before JWT/auth checks

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

back/api/env.ts

@@ -44,7 +44,6 @@ export default (app: Router) => {
             .required()
             .pattern(/^[a-zA-Z_][0-9a-zA-Z_]*$/),
           remarks: Joi.string().optional().allow(''),
-          labels: Joi.array().items(Joi.string()).optional(),
         }),
       ),
     }),
@@ -71,7 +70,6 @@ export default (app: Router) => {
         name: Joi.string().required(),
         remarks: Joi.string().optional().allow('').allow(null),
         id: Joi.number().required(),
-        labels: Joi.array().items(Joi.string()).optional(),
       }),
     }),
     async (req: Request, res: Response, next: NextFunction) => {
@@ -232,46 +230,6 @@ export default (app: Router) => {
     },
   );
 
-  route.post(
-    '/labels',
-    celebrate({
-      body: Joi.object({
-        ids: Joi.array().items(Joi.number().required()),
-        labels: Joi.array().items(Joi.string().required()),
-      }),
-    }),
-    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
-      try {
-        const envService = Container.get(EnvService);
-        const data = await envService.addLabels(req.body.ids, req.body.labels);
-        return res.send({ code: 200, data });
-      } catch (e) {
-        return next(e);
-      }
-    },
-  );
-
-  route.delete(
-    '/labels',
-    celebrate({
-      body: Joi.object({
-        ids: Joi.array().items(Joi.number().required()),
-        labels: Joi.array().items(Joi.string().required()),
-      }),
-    }),
-    async (req: Request, res: Response, next: NextFunction) => {
-      const logger: Logger = Container.get('logger');
-      try {
-        const envService = Container.get(EnvService);
-        const data = await envService.removeLabels(req.body.ids, req.body.labels);
-        return res.send({ code: 200, data });
-      } catch (e) {
-        return next(e);
-      }
-    },
-  );
-
   route.post(
     '/upload',
     upload.single('env'),

back/data/env.ts

@@ -10,7 +10,6 @@ export class Env {
   name?: string;
   remarks?: string;
   isPinned?: 1 | 0;
-  labels?: string[];
 
   constructor(options: Env) {
     this.value = options.value;
@@ -24,7 +23,6 @@ export class Env {
     this.name = options.name;
     this.remarks = options.remarks || '';
     this.isPinned = options.isPinned || 0;
-    this.labels = options.labels || [];
   }
 }
 
@@ -47,5 +45,4 @@ export const EnvModel = sequelize.define<EnvInstance>('Env', {
   name: { type: DataTypes.STRING, unique: 'compositeIndex' },
   remarks: DataTypes.STRING,
   isPinned: DataTypes.NUMBER,
-  labels: DataTypes.JSON,
 });

back/loaders/express.ts

@@ -13,35 +13,23 @@ import { isValidToken } from '../shared/auth';
 import path from 'path';
 
 export default ({ app }: { app: Application }) => {
-  // Security: Enable strict routing to prevent case-insensitive path bypass
-  app.set('case sensitive routing', true);
-  app.set('strict routing', true);
   app.set('trust proxy', 'loopback');
   app.use(cors());
   
-  // Security: Path normalization middleware to prevent case variation attacks
-  app.use((req, res, next) => {
-    const originalPath = req.path;
-    const normalizedPath = originalPath.toLowerCase();
-    
-    // Block requests with case variations on protected paths
-    if (originalPath !== normalizedPath && 
-        (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
-      return res.status(400).json({
-        code: 400,
-        message: 'Invalid path format'
-      });
-    }
-    
-    next();
-  });
-  
   // Rewrite URLs to strip baseUrl prefix if configured
   // This allows the rest of the app to work without baseUrl awareness
   if (config.baseUrl) {
     app.use(rewrite(`${config.baseUrl}/*`, '/$1'));
   }
   
+  // Normalize URL path to lowercase to prevent authentication bypass via mixed-case paths
+  // e.g. /API/system/command-run should not bypass JWT checks designed for /api/...
+  // The regex only matches the path portion (stops at ? or #), preserving query strings.
+  app.use((req: Request, res: Response, next: NextFunction) => {
+    req.url = req.url.replace(/^[^?#]*/, (p) => p.toLowerCase());
+    next();
+  });
+
   app.get(`${config.api.prefix}/env.js`, serveEnv);
   app.use(`${config.api.prefix}/static`, express.static(config.uploadPath));
 
@@ -56,7 +44,7 @@ export default ({ app }: { app: Application }) => {
       secret: config.jwt.secret,
       algorithms: ['HS384'],
     }).unless({
-      path: [...config.apiWhiteList, /^(\/(?!api\/).*)$/i],
+      path: [...config.apiWhiteList, /^\/(?!api\/).*/],
     }),
   );
 
@@ -71,20 +59,19 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req: Request, res, next) => {
-    const pathLower = req.path.toLowerCase();
-    if (!['/open/', '/api/'].some((x) => pathLower.startsWith(x))) {
+    if (!['/open/', '/api/'].some((x) => req.path.startsWith(x))) {
       return next();
     }
 
     const headerToken = getToken(req);
-    if (pathLower.startsWith('/open/')) {
+    if (req.path.startsWith('/open/')) {
       const apps = await shareStore.getApps();
       const doc = apps?.filter((x) =>
         x.tokens?.find((y) => y.value === headerToken),
       )?.[0];
       if (doc && doc.tokens && doc.tokens.length > 0) {
         const currentToken = doc.tokens.find((x) => x.value === headerToken);
-        const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
+        const keyMatch = req.path.match(/\/open\/([a-z]+)\/*/);
         const key = keyMatch && keyMatch[1];
         if (
           doc.scopes.includes(key as any) &&
@@ -119,15 +106,7 @@ export default ({ app }: { app: Application }) => {
   });
 
   app.use(async (req, res, next) => {
-    const pathLower = req.path.toLowerCase();
-    if (
-      ![
-        '/api/user/init',
-        '/api/user/notification/init',
-        '/open/user/init',
-        '/open/user/notification/init',
-      ].includes(req.path)
-    ) {
+    if (!['/api/user/init', '/api/user/notification/init'].includes(req.path)) {
       return next();
     }
     const authInfo =

back/loaders/initData.ts

@@ -13,7 +13,7 @@ import { AuthDataType, SystemModel } from '../data/system';
 import SystemService from '../services/system';
 import UserService from '../services/user';
 import { writeFile, readFile } from 'fs/promises';
-import { createRandomString, fileExist, isDemoEnv, safeJSONParse } from '../config/util';
+import { createRandomString, fileExist, safeJSONParse } from '../config/util';
 import OpenService from '../services/open';
 import { shareStore } from '../shared/store';
 import Logger from './logger';
@@ -50,7 +50,7 @@ export default async () => {
   const [authConfig] = await SystemModel.findOrCreate({
     where: { type: AuthDataType.authConfig },
   });
-  if (!authConfig?.info || isDemoEnv()) {
+  if (!authConfig?.info) {
     let authInfo = {
       username: 'admin',
       password: 'admin',

back/services/env.ts

@@ -199,34 +199,6 @@ export default class EnvService {
     await EnvModel.update({ isPinned: 0 }, { where: { id: ids } });
   }
 
-  public async addLabels(ids: number[], labels: string[]) {
-    const docs = await EnvModel.findAll({ where: { id: ids } });
-    await sequelize.transaction(async (t) => {
-      for (const doc of docs) {
-        const env = doc.get({ plain: true });
-        await EnvModel.update(
-          { labels: Array.from(new Set((env.labels || []).concat(labels))) },
-          { where: { id: env.id }, transaction: t },
-        );
-      }
-    });
-    return await EnvModel.findAll({ where: { id: ids } });
-  }
-
-  public async removeLabels(ids: number[], labels: string[]) {
-    const docs = await EnvModel.findAll({ where: { id: ids } });
-    await sequelize.transaction(async (t) => {
-      for (const doc of docs) {
-        const env = doc.get({ plain: true });
-        await EnvModel.update(
-          { labels: (env.labels || []).filter((label: string) => !labels.includes(label)) },
-          { where: { id: env.id }, transaction: t },
-        );
-      }
-    });
-    return await EnvModel.findAll({ where: { id: ids } });
-  }
-
   public async set_envs() {
     const envs = await this.envs('', {
       name: { [Op.not]: null },

docker/310.Dockerfile

@@ -69,10 +69,9 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
-  HOME=/root
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -84,6 +83,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/Dockerfile

@@ -69,10 +69,9 @@ RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \
-  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3 \
-  HOME=/root
+  PYTHONUSERBASE=${QL_DIR}/data/dep_cache/python3
 
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin:${HOME}/bin \
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PNPM_HOME}:${PYTHON_HOME}/bin \
   NODE_PATH=/usr/local/bin:/usr/local/lib/node_modules:${PNPM_HOME}/global/5/node_modules \
   PIP_CACHE_DIR=${PYTHON_HOME}/pip \
   PYTHONPATH=${PYTHON_HOME}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}:${PYTHON_HOME}/lib/python${PYTHON_SHORT_VERSION}/site-packages
@@ -84,6 +83,6 @@ COPY --from=builder /tmp/build/node_modules/. /ql/node_modules/
 WORKDIR ${QL_DIR}
 
 HEALTHCHECK --interval=5s --timeout=2s --retries=20 \
-  CMD curl -sf --noproxy '*' http://127.0.0.1:${QlPort:-5700}/api/health || exit 1
+  CMD curl -sf --noproxy '*' http://127.0.0.1:5700/api/health || exit 1
 
 ENTRYPOINT ["./docker/docker-entrypoint.sh"]

docker/docker-entrypoint.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+export PATH="$HOME/bin:$PATH"
+
 dir_shell=/ql/shell
 . $dir_shell/share.sh
 

package.json

@@ -77,9 +77,9 @@
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
     "lodash": "^4.17.21",
-    "multer": "2.1.1",
+    "multer": "1.4.5-lts.1",
     "node-schedule": "^2.1.0",
-    "nodemailer": "^8.0.1",
+    "nodemailer": "^6.9.16",
     "p-queue-cjs": "7.3.4",
     "@bufbuild/protobuf": "^2.10.0",
     "ps-tree": "^1.2.0",

src/pages/env/index.tsx

@@ -36,7 +36,7 @@ import { useVT } from 'virtualizedtableforantd4';
 import Copy from '../../components/copy';
 import EditNameModal from './editNameModal';
 import './index.less';
-import EnvModal, { EnvLabelModal } from './modal';
+import EnvModal from './modal';
 
 const { Paragraph } = Typography;
 const { Search } = Input;
@@ -121,22 +121,6 @@ const Env = () => {
         );
       },
     },
-    {
-      title: intl.get('标签'),
-      dataIndex: 'labels',
-      key: 'labels',
-      render: (labels: string[], record: any) => {
-        return (
-          <Space size={[0, 4]} wrap>
-            {labels?.filter((label) => label).map((label) => (
-              <Tag key={label} color="blue">
-                {label}
-              </Tag>
-            ))}
-          </Space>
-        );
-      },
-    },
     {
       title: intl.get('更新时间'),
       dataIndex: 'timestamp',
@@ -254,7 +238,6 @@ const Env = () => {
   const [loading, setLoading] = useState(true);
   const [isModalVisible, setIsModalVisible] = useState(false);
   const [isEditNameModalVisible, setIsEditNameModalVisible] = useState(false);
-  const [isLabelModalVisible, setIsLabelModalVisible] = useState(false);
   const [editedEnv, setEditedEnv] = useState();
   const [selectedRowIds, setSelectedRowIds] = useState<string[]>([]);
   const [searchText, setSearchText] = useState('');
@@ -639,13 +622,6 @@ const Env = () => {
             >
               {intl.get('批量修改变量名称')}
             </Button>
-            <Button
-              type="primary"
-              style={{ marginBottom: 5, marginLeft: 8 }}
-              onClick={() => setIsLabelModalVisible(true)}
-            >
-              {intl.get('批量修改标签')}
-            </Button>
             <Button
               type="primary"
               style={{ marginBottom: 5, marginLeft: 8 }}
@@ -724,15 +700,6 @@ const Env = () => {
           ids={selectedRowIds}
         />
       )}
-      {isLabelModalVisible && (
-        <EnvLabelModal
-          handleCancel={(needUpdate) => {
-            setIsLabelModalVisible(false);
-            if (needUpdate) getEnvs();
-          }}
-          ids={selectedRowIds}
-        />
-      )}
     </PageContainer>
   );
 };

src/pages/env/modal.tsx

@@ -1,9 +1,8 @@
 import intl from 'react-intl-universal';
 import React, { useEffect, useState } from 'react';
-import { Modal, message, Input, Form, Radio, Button } from 'antd';
+import { Modal, message, Input, Form, Radio } from 'antd';
 import { request } from '@/utils/http';
 import config from '@/utils/config';
-import EditableTagGroup from '@/components/tag';
 
 const EnvModal = ({
   env,
@@ -17,7 +16,7 @@ const EnvModal = ({
 
   const handleOk = async (values: any) => {
     setLoading(true);
-    const { value, split, name, remarks, labels } = values;
+    const { value, split, name, remarks } = values;
     const method = env ? 'put' : 'post';
     let payload;
     if (!env) {
@@ -28,11 +27,10 @@ const EnvModal = ({
             name: name,
             value: x,
             remarks: remarks,
-            labels: labels || [],
           };
         });
       } else {
-        payload = [{ value, name, remarks, labels: labels || [] }];
+        payload = [{ value, name, remarks }];
       }
     } else {
       payload = { ...values, id: env.id };
@@ -125,81 +123,9 @@ const EnvModal = ({
         <Form.Item name="remarks" label={intl.get('备注')}>
           <Input placeholder={intl.get('请输入备注')} />
         </Form.Item>
-        <Form.Item name="labels" label={intl.get('标签')}>
-          <EditableTagGroup />
-        </Form.Item>
       </Form>
     </Modal>
   );
 };
 
-export { EnvModal as default };
-export const EnvLabelModal = ({
-  ids,
-  handleCancel,
-}: {
-  ids: Array<string>;
-  handleCancel: (needUpdate?: boolean) => void;
-}) => {
-  const [form] = Form.useForm();
-  const [loading, setLoading] = useState(false);
-
-  const update = async (action: 'delete' | 'post') => {
-    form
-      .validateFields()
-      .then(async (values) => {
-        setLoading(true);
-        const payload = { ids, labels: values.labels };
-        try {
-          const { code, data } = await request[action](
-            `${config.apiPrefix}envs/labels`,
-            payload,
-          );
-
-          if (code === 200) {
-            message.success(
-              action === 'post'
-                ? intl.get('添加Labels成功')
-                : intl.get('删除Labels成功'),
-            );
-            handleCancel(true);
-          }
-          setLoading(false);
-        } catch (error) {
-          setLoading(false);
-        }
-      })
-      .catch((info) => {
-        console.log('Validate Failed:', info);
-      });
-  };
-
-  const buttons = [
-    <Button key="cancel" onClick={() => handleCancel(false)}>{intl.get('取消')}</Button>,
-    <Button key="delete" type="primary" danger onClick={() => update('delete')}>
-      {intl.get('删除')}
-    </Button>,
-    <Button key="add" type="primary" onClick={() => update('post')}>
-      {intl.get('添加')}
-    </Button>,
-  ];
-
-  return (
-    <Modal
-      title={intl.get('批量修改标签')}
-      open={true}
-      footer={buttons}
-      centered
-      maskClosable={false}
-      forceRender
-      onCancel={() => handleCancel(false)}
-      confirmLoading={loading}
-    >
-      <Form form={form} layout="vertical" name="form_in_env_label_modal">
-        <Form.Item name="labels" label={intl.get('标签')}>
-          <EditableTagGroup />
-        </Form.Item>
-      </Form>
-    </Modal>
-  );
-};
+export default EnvModal;

version.yaml

@@ -1,6 +1,11 @@
-version: 2.20.2
-changeLogLink: https://t.me/jiao_long/434
-publishTime: 2026-03-01 1800
+version: 2.20.1
+changeLogLink: https://t.me/jiao_long/433
+publishTime: 2025-12-26 22:00
 changeLog: |
-  1. 修复 path 安全漏洞（重要）
-  
+  1. 修复获取依赖管理列表
+  2. notify.js 修复 TG_PROXY_AUTH 参数拼接
+  3. QLAPI.notify larkSecret 参数
+  4. 修复 cron parser 定时规则校验
+  5. 修复设置 baseUrl 后无法访问
+  6. 修复环境变量排序
+  7. 修复定时任务无法停止