mirror of
https://github.com/whyour/qinglong.git
synced 2026-10-17 07:20:51 +08:00
* fix: harden scoped API inputs and isolate login throttling * fix: close script path gaps and harden security boundaries * fix: preserve subscription aliases and avoid extension eval * fix: allow cancelling invalid historical subscriptions * fix: make script parent validation explicit for CodeQL * fix: limit command execution and clarify trusted path branches * fix: separate diff tool script access from config APIs * fix: clean up obsolete subscription SSH credentials
39 lines
1.1 KiB
TypeScript
39 lines
1.1 KiB
TypeScript
import { Service } from 'typedi';
|
|
import config from '../config';
|
|
import { getFileContentByName } from '../config/util';
|
|
import { t } from '../shared/i18n';
|
|
import { Response } from 'express';
|
|
import { request } from 'undici';
|
|
import { resolveFileAccess } from '../shared/fileAccess';
|
|
|
|
@Service()
|
|
export default class ConfigService {
|
|
constructor() {}
|
|
|
|
public async getFile(filePath: string, res: Response) {
|
|
let content = '';
|
|
if (!filePath || filePath.startsWith('data/scripts/')) {
|
|
return res.send({ code: 403, message: t('文件无法访问') });
|
|
}
|
|
const resolved = resolveFileAccess(
|
|
config.configPath,
|
|
[filePath],
|
|
config.blackFileList,
|
|
);
|
|
if (!resolved) {
|
|
return res.send({ code: 403, message: t('文件无法访问') });
|
|
}
|
|
|
|
if (filePath.startsWith('sample/')) {
|
|
const res = await request(
|
|
`https://gitlab.com/whyour/qinglong/-/raw/master/${filePath}`,
|
|
);
|
|
content = await res.body.text();
|
|
} else {
|
|
content = await getFileContentByName(resolved);
|
|
}
|
|
|
|
res.send({ code: 200, data: content });
|
|
}
|
|
}
|