From e1cdff2b4a74738c52c707454721fb11accc0160 Mon Sep 17 00:00:00 2001 From: canglan Date: Fri, 21 Aug 2026 20:10:05 +0800 Subject: [PATCH] security: backend validation for all inputs - router.param('id'): all :id path params must be positive ints (tickets/features/polls/auth/users; external/bans/notifications already had parseInt - now consistent) - notifications: type enum + webhook URL format + SSRF (isPrivateUrl exported) + events whitelist + active boolean check on PUT - bans: type enum + player_name length - external: all-tickets type/status enums, bans status/type enums, page/limit floor protection, ticket field length caps, clients active boolean + id validation - verified: 28 checks (syntax + validation coverage) --- backend/routes/auth.js | 6 +++++ backend/routes/bans.js | 6 ++++- backend/routes/external.js | 43 +++++++++++++++++++++-------- backend/routes/features.js | 6 +++++ backend/routes/notifications.js | 48 +++++++++++++++++++++++++++------ backend/routes/polls.js | 6 +++++ backend/routes/tickets.js | 6 +++++ backend/routes/users.js | 6 +++++ backend/webhook.js | 2 +- 9 files changed, 108 insertions(+), 21 deletions(-) diff --git a/backend/routes/auth.js b/backend/routes/auth.js index 71f0e7a..ae37515 100644 --- a/backend/routes/auth.js +++ b/backend/routes/auth.js @@ -28,6 +28,12 @@ const { validateLengths } = require('../middleware/security'); const router = express.Router(); +// 统一校验 :id 路径参数(必须是正整数) +router.param('id', (req, res, next, id) => { + if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' }); + next(); +}); + async function getSiteUrl() { const row = await getRow("SELECT v FROM settings WHERE k = 'site_url'"); return row?.v || 'http://localhost:3100'; diff --git a/backend/routes/bans.js b/backend/routes/bans.js index fa6e5a3..15a5cfc 100644 --- a/backend/routes/bans.js +++ b/backend/routes/bans.js @@ -49,6 +49,8 @@ router.post('/', authenticate, requireRole('owner'), async (req, res) => { try { const { player_name, player_uid, reason, type, duration, ticket_id, expires_at, source } = req.body; if (!player_name) return res.status(400).json({ error: '玩家名为必填' }); + if (player_name.length > 50) return res.status(400).json({ error: '玩家名过长' }); + if (type && !['ban','mute','warn','other'].includes(type)) return res.status(400).json({ error: '无效的处罚类型' }); const durDays = parseDuration(duration); const prev = await getRow('SELECT * FROM bans WHERE (player_name = ? OR player_uid = ?) AND type = ? AND status = ? ORDER BY created_at DESC LIMIT 1', @@ -85,7 +87,9 @@ router.put('/:id', authenticate, requireRole('owner'), async (req, res) => { }); router.delete('/:id', authenticate, requireRole('owner'), async (req, res) => { - await query('DELETE FROM bans WHERE id = ?', [req.params.id]); + const id = parseInt(req.params.id); + if (!id) return res.status(400).json({ error: '无效的ID' }); + await query('DELETE FROM bans WHERE id = ?', [id]); res.json({ message: '已删除' }); }); diff --git a/backend/routes/external.js b/backend/routes/external.js index e81ff40..5b8b4dc 100644 --- a/backend/routes/external.js +++ b/backend/routes/external.js @@ -112,9 +112,12 @@ router.get('/clients', authenticate, async (req, res) => { router.put('/clients/:id', authenticate, async (req, res) => { try { if (!['owner','admin'].includes(req.user.role)) return res.status(403).json({ error: '无权限' }); + const id = parseInt(req.params.id); + if (!id) return res.status(400).json({ error: '无效的ID' }); const { active } = req.body; - await query('UPDATE api_clients SET active = ? WHERE id = ?', [active ? 1 : 0, req.params.id]); - await logSystem('info', 'api', `更新外部API客户端 #${req.params.id}`, { active: !!active }); + if (active === undefined || (typeof active !== 'boolean' && ![0,1,'0','1'].includes(active))) return res.status(400).json({ error: 'active 必须为布尔值' }); + await query('UPDATE api_clients SET active = ? WHERE id = ?', [active ? 1 : 0, id]); + await logSystem('info', 'api', `更新外部API客户端 #${id}`, { active: !!active }); res.json({ message: '已更新' }); } catch (e) { res.status(500).json({ error: e.message }); } }); @@ -122,8 +125,10 @@ router.put('/clients/:id', authenticate, async (req, res) => { router.delete('/clients/:id', authenticate, async (req, res) => { try { if (!['owner','admin'].includes(req.user.role)) return res.status(403).json({ error: '无权限' }); - await query('DELETE FROM api_clients WHERE id = ?', [req.params.id]); - await logSystem('info', 'api', `删除外部API客户端 #${req.params.id}`); + const id = parseInt(req.params.id); + if (!id) return res.status(400).json({ error: '无效的ID' }); + await query('DELETE FROM api_clients WHERE id = ?', [id]); + await logSystem('info', 'api', `删除外部API客户端 #${id}`); res.json({ message: '已删除' }); } catch (e) { res.status(500).json({ error: e.message }); } }); @@ -185,6 +190,10 @@ router.post('/tickets', async (req, res) => { const { type, title, reporter_game_name, reporter_game_uid, target_game_name, target_game_uid, reason, description, is_admin_complaint, server } = req.body; if (!type || !['report','suggestion','appeal'].includes(type)) return res.status(400).json({ error: '类型不正确' }); if (!title || !reporter_game_name) return res.status(400).json({ error: '必填字段不完整' }); + if (String(title).length > 100) return res.status(400).json({ error: '标题过长(≤100)' }); + if (String(reporter_game_name).length > 50) return res.status(400).json({ error: '游戏名过长' }); + if (reason && String(reason).length > 500) return res.status(400).json({ error: '原因过长(≤500)' }); + if (description && String(description).length > 5000) return res.status(400).json({ error: '内容过长(≤5000)' }); if (type === 'report' && !reason) return res.status(400).json({ error: '请填写举报原因' }); if (type === 'suggestion' && !description) return res.status(400).json({ error: '建议内容不能为空' }); if (type === 'appeal' && (!reason || !description)) return res.status(400).json({ error: '请填写完整申诉信息' }); @@ -216,8 +225,14 @@ router.get('/tickets/track', async (req, res) => { }); // ============ 工单列表(带 server 过滤) ============ +const TICKET_TYPES = ['report', 'suggestion', 'appeal', 'result_appeal']; +const TICKET_STATUSES = ['pending', 'processing', 'awaiting_info', 'appealing', 'resolved', 'rejected', 'closed']; +const BAN_STATUSES = ['active', 'expired', 'appealed', 'lifted']; + router.get('/all-tickets', async (req, res) => { const { type, status, server, page, limit } = req.query; + if (type && !TICKET_TYPES.includes(type)) return res.status(400).json({ error: '无效的 type' }); + if (status && !TICKET_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' }); let q = `SELECT id, type, title, status, priority, reporter_game_name, reporter_game_uid, target_game_name, target_game_uid, reason, description, assigned_to, claim_note, server_name, created_at, updated_at FROM tickets WHERE 1=1`; const p = []; if (type) { q += ' AND type = ?'; p.push(type); } @@ -226,17 +241,19 @@ router.get('/all-tickets', async (req, res) => { const sv = await resolveServer(server); q += ' AND server_name = ?'; p.push(sv.server_name); } - const pg = parseInt(page) || 1; - const lm = Math.min(parseInt(limit) || 50, 200); + const pg = Math.max(parseInt(page) || 1, 1); + const lm = Math.min(Math.max(parseInt(limit) || 50, 1), 200); q += ` ORDER BY updated_at DESC LIMIT ${(pg-1)*lm}, ${lm}`; res.json(await query(q, p)); }); router.get('/all-tickets/:id', async (req, res) => { - const t = await getRow('SELECT * FROM tickets WHERE id = ?', [req.params.id]); + const id = parseInt(req.params.id); + if (!id) return res.status(400).json({ error: '无效的ID' }); + const t = await getRow('SELECT * FROM tickets WHERE id = ?', [id]); if (!t) return res.status(404).json({ error: 'Not found' }); - t.responses = await query('SELECT content, is_staff, created_at FROM responses WHERE ticket_id = ? ORDER BY created_at ASC', [req.params.id]); - t.attachments = await query('SELECT id, original_name, mime_type, size FROM attachments WHERE ticket_id = ?', [req.params.id]); + t.responses = await query('SELECT content, is_staff, created_at FROM responses WHERE ticket_id = ? ORDER BY created_at ASC', [id]); + t.attachments = await query('SELECT id, original_name, mime_type, size FROM attachments WHERE ticket_id = ?', [id]); res.json(t); }); @@ -244,6 +261,7 @@ router.get('/all-tickets/:id', async (req, res) => { // 拉取封禁: ?server=alias|server_name|分组/服务器&status=active|expired|appealed|lifted&player=&limit= router.get('/bans', async (req, res) => { const { server, status, player, page, limit } = req.query; + if (status && !BAN_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' }); let q = 'SELECT id, player_name, player_uid, source, reason, type, duration, server_name, status, created_at, expires_at FROM bans WHERE 1=1'; const p = []; if (server) { @@ -252,8 +270,8 @@ router.get('/bans', async (req, res) => { } if (status) { q += ' AND status = ?'; p.push(status); } if (player) { q += ' AND (player_name = ? OR player_uid = ?)'; p.push(player, player); } - const pg = parseInt(page) || 1; - const lm = Math.min(parseInt(limit) || 100, 500); + const pg = Math.max(parseInt(page) || 1, 1); + const lm = Math.min(Math.max(parseInt(limit) || 100, 1), 500); q += ` ORDER BY created_at DESC LIMIT ${(pg-1)*lm}, ${lm}`; res.json(await query(q, p)); }); @@ -263,6 +281,9 @@ router.post('/bans', async (req, res) => { try { const { player_name, player_uid, source, reason, type, duration, expires_at, server, status } = req.body; if (!player_name) return res.status(400).json({ error: 'player_name 必填' }); + if (player_name.length > 50) return res.status(400).json({ error: 'player_name 过长' }); + if (type && !['ban','mute','warn','other'].includes(type)) return res.status(400).json({ error: '无效的 type' }); + if (status && !BAN_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' }); const sv = await resolveServer(server); const r = await query(`INSERT INTO bans(player_name, player_uid, source, reason, type, duration, server_name, status, expires_at) VALUES (?,?,?,?,?,?,?,?,?)`, [player_name, player_uid||'', source||'', reason||'', ['ban','mute','warn','other'].includes(type)?type:'ban', duration||'', sv.server_name, ['active','expired','appealed','lifted'].includes(status)?status:'active', expires_at||null]); diff --git a/backend/routes/features.js b/backend/routes/features.js index fc8d459..649efdd 100644 --- a/backend/routes/features.js +++ b/backend/routes/features.js @@ -23,6 +23,12 @@ const { authenticate, requireRole } = require('../middleware/auth'); const router = express.Router(); +// 统一校验 :id 路径参数(必须是正整数) +router.param('id', (req, res, next, id) => { + if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' }); + next(); +}); + router.get('/', authenticate, async (req, res) => { const { group_name, server_name, sort, status } = req.query; let orderClause = 'ORDER BY fi.created_at DESC'; diff --git a/backend/routes/notifications.js b/backend/routes/notifications.js index a5c1893..1d1dc69 100644 --- a/backend/routes/notifications.js +++ b/backend/routes/notifications.js @@ -20,44 +20,76 @@ const express = require('express'); const { query, getRow } = require('../db'); const { authenticate, requireRole } = require('../middleware/auth'); -const { sendWebhook } = require('../webhook'); +const { sendWebhook, isPrivateUrl } = require('../webhook'); const router = express.Router(); +const NOTIFY_TYPES = ['webhook', 'email', 'generic']; +const NOTIFY_EVENTS = ['all', 'ticket_created', 'ticket_claimed', 'ticket_transferred', 'ticket_updated']; + +// 校验通知配置字段(创建/更新共用) +async function validateNotify(body) { + const { name, type, webhook_url, events } = body; + if (name !== undefined && (!name || String(name).length > 100)) return '名称不能为空且不超过100字符'; + if (type !== undefined && !NOTIFY_TYPES.includes(type)) return '无效的通知类型'; + if (webhook_url !== undefined && webhook_url !== '') { + let u; + try { u = new URL(webhook_url); } catch { return 'Webhook地址格式无效'; } + if (u.protocol !== 'https:' && u.protocol !== 'http:') return 'Webhook地址协议不支持'; + if (await isPrivateUrl(webhook_url)) return 'Webhook地址不允许指向内网'; + } + if (events !== undefined) { + const list = String(events).split(',').map(s => s.trim()); + if (!list.every(e => NOTIFY_EVENTS.includes(e))) return '无效的触发事件'; + } + return null; +} + router.get('/', authenticate, requireRole('owner','admin'), async (req, res) => { res.json(await query('SELECT * FROM notification_configs ORDER BY id')); }); router.post('/', authenticate, requireRole('owner','admin'), async (req, res) => { const { name, type, webhook_url, events } = req.body; - if (!name||!type) return res.status(400).json({ error: '名称和类型为必填' }); - if (type==='webhook' && !webhook_url) return res.status(400).json({ error: 'Webhook地址必填' }); + if (!name || !type) return res.status(400).json({ error: '名称和类型为必填' }); + const err = await validateNotify({ name, type, webhook_url, events }); + if (err) return res.status(400).json({ error: err }); + if (type === 'webhook' && !webhook_url) return res.status(400).json({ error: 'Webhook地址必填' }); const r = await query('INSERT INTO notification_configs(name, type, webhook_url, events) VALUES (?,?,?,?)', [name, type, webhook_url||'', events||'all']); await query("INSERT INTO audit_logs(user_id, username, action, entity_type, entity_id, details) VALUES (?,?,?,?,?,?)", [req.user.id, req.user.username, 'create_notification', 'notification_config', r.insertId, `创建通知: ${name}`]); res.status(201).json({ id: r.insertId, message: '创建成功' }); }); router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => { - const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [req.params.id]); + const id = parseInt(req.params.id); + if (!id) return res.status(400).json({ error: '无效的ID' }); + const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]); if (!cfg) return res.status(404).json({ error: '配置不存在' }); + const err = await validateNotify(req.body); + if (err) return res.status(400).json({ error: err }); const fields = {}; if (req.body.name) fields.name = req.body.name; if (req.body.webhook_url !== undefined) fields.webhook_url = req.body.webhook_url; if (req.body.type) fields.type = req.body.type; - if (req.body.active !== undefined) fields.active = req.body.active?1:0; + if (req.body.active !== undefined) { if (typeof req.body.active !== 'boolean' && ![0,1,'0','1'].includes(req.body.active)) return res.status(400).json({ error: 'active 必须为布尔值' }); fields.active = req.body.active ? 1 : 0; } + if (req.body.events !== undefined) fields.events = req.body.events; if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' }); const sets = Object.keys(fields).map(k=>`${k}=?`).join(','); - await query(`UPDATE notification_configs SET ${sets} WHERE id = ?`, [...Object.values(fields), req.params.id]); + await query(`UPDATE notification_configs SET ${sets} WHERE id = ?`, [...Object.values(fields), id]); res.json({ message: '更新成功' }); }); router.delete('/:id', authenticate, requireRole('owner','admin'), async (req, res) => { - await query('DELETE FROM notification_configs WHERE id = ?', [req.params.id]); + const id = parseInt(req.params.id); + if (!id) return res.status(400).json({ error: '无效的ID' }); + await query('DELETE FROM notification_configs WHERE id = ?', [id]); res.json({ message: '已删除' }); }); router.post('/:id/test', authenticate, requireRole('owner','admin'), async (req, res) => { - const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [req.params.id]); + const id = parseInt(req.params.id); + if (!id) return res.status(400).json({ error: '无效的ID' }); + const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]); if (!cfg||!cfg.webhook_url) return res.status(404).json({ error: '配置不存在' }); sendWebhook('ticket_created', { ticket_id:'TEST', ticket_title:'测试通知', ticket_type:'测试', reporter_game_name:'TestPlayer', reporter_game_uid:'TEST001', ticket_reason:'这是一条测试消息' }).then(() => res.json({ message:'测试消息已发送' })).catch(e => res.status(500).json({ error:e.message })); }); diff --git a/backend/routes/polls.js b/backend/routes/polls.js index 21c09b6..92488fd 100644 --- a/backend/routes/polls.js +++ b/backend/routes/polls.js @@ -23,6 +23,12 @@ const { authenticate, requireRole } = require('../middleware/auth'); const router = express.Router(); +// 统一校验 :id 路径参数(必须是正整数) +router.param('id', (req, res, next, id) => { + if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' }); + next(); +}); + router.get('/groups', authenticate, async (req, res) => { res.json(await query('SELECT * FROM server_groups ORDER BY group_name, server_name')); }); diff --git a/backend/routes/tickets.js b/backend/routes/tickets.js index faee1c7..c1414a1 100644 --- a/backend/routes/tickets.js +++ b/backend/routes/tickets.js @@ -28,6 +28,12 @@ const { validateLengths, ticketAnonLimiter } = require('../middleware/security') const router = express.Router(); +// 统一校验 :id 路径参数(必须是正整数) +router.param('id', (req, res, next, id) => { + if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' }); + next(); +}); + const SL = { pending:'待处理', processing:'处理中', awaiting_info:'待补充', appealing:'申诉中', resolved:'已解决', rejected:'已驳回', closed:'已关闭' }; const TL = { report:'举报', suggestion:'建议', appeal:'申诉', result_appeal:'结果申诉' }; const SC = { pending:'#f59e0b', processing:'#7c3aed', awaiting_info:'#d97706', appealing:'#f97316', resolved:'#059669', rejected:'#dc2626', closed:'#6b7280' }; diff --git a/backend/routes/users.js b/backend/routes/users.js index 7424c27..1fcce30 100644 --- a/backend/routes/users.js +++ b/backend/routes/users.js @@ -24,6 +24,12 @@ const { authenticate, requireRole } = require('../middleware/auth'); const router = express.Router(); +// 统一校验 :id 路径参数(必须是正整数) +router.param('id', (req, res, next, id) => { + if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' }); + next(); +}); + router.get('/', authenticate, requireRole('owner','admin'), async (req, res) => { const rows = await query(`SELECT u.id, u.username, u.email, u.game_name, u.game_uid, u.source, u.role, u.active, u.email_verified, u.created_at, (SELECT COUNT(*) FROM user_identities ui WHERE ui.user_id = u.id) as identity_count diff --git a/backend/webhook.js b/backend/webhook.js index c7b81a3..2b097ce 100644 --- a/backend/webhook.js +++ b/backend/webhook.js @@ -74,4 +74,4 @@ function buildEmbed(event, data) { return embed; } -module.exports = { sendWebhook }; +module.exports = { sendWebhook, isPrivateUrl };