Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: backend validation for all inputs

Browse Source 
- router.param('id'): all :id path params must be positive ints
  (tickets/features/polls/auth/users; external/bans/notifications already
  had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
  exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
  page/limit floor protection, ticket field length caps, clients active
  boolean + id validation
- verified: 28 checks (syntax + validation coverage)
This commit is contained in:
canglan
2026-08-21 20:10:05 +08:00
parent 8c5ce78fd0
commit e1cdff2b4a
9 changed files with 108 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
backend/routes/notifications.js
View File

@@ -20,44 +20,76 @@
const express = require('express');
const { query, getRow } = require('../db');
const { authenticate, requireRole } = require('../middleware/auth');
const { sendWebhook } = require('../webhook');
const { sendWebhook, isPrivateUrl } = require('../webhook');
const router = express.Router();
const NOTIFY_TYPES = ['webhook', 'email', 'generic'];
const NOTIFY_EVENTS = ['all', 'ticket_created', 'ticket_claimed', 'ticket_transferred', 'ticket_updated'];
// 校验通知配置字段(创建/更新共用)
async function validateNotify(body) {
const { name, type, webhook_url, events } = body;
if (name !== undefined && (!name || String(name).length > 100)) return '名称不能为空且不超过100字符';
if (type !== undefined && !NOTIFY_TYPES.includes(type)) return '无效的通知类型';
if (webhook_url !== undefined && webhook_url !== '') {
let u;
try { u = new URL(webhook_url); } catch { return 'Webhook地址格式无效'; }
if (u.protocol !== 'https:' && u.protocol !== 'http:') return 'Webhook地址协议不支持';
if (await isPrivateUrl(webhook_url)) return 'Webhook地址不允许指向内网';
}
if (events !== undefined) {
const list = String(events).split(',').map(s => s.trim());
if (!list.every(e => NOTIFY_EVENTS.includes(e))) return '无效的触发事件';
}
return null;
}
router.get('/', authenticate, requireRole('owner','admin'), async (req, res) => {
res.json(await query('SELECT * FROM notification_configs ORDER BY id'));
});
router.post('/', authenticate, requireRole('owner','admin'), async (req, res) => {
const { name, type, webhook_url, events } = req.body;
if (!name||!type) return res.status(400).json({ error: '名称和类型为必填' });
if (type==='webhook' && !webhook_url) return res.status(400).json({ error: 'Webhook地址必填' });
if (!name || !type) return res.status(400).json({ error: '名称和类型为必填' });
const err = await validateNotify({ name, type, webhook_url, events });
if (err) return res.status(400).json({ error: err });
if (type === 'webhook' && !webhook_url) return res.status(400).json({ error: 'Webhook地址必填' });
const r = await query('INSERT INTO notification_configs(name, type, webhook_url, events) VALUES (?,?,?,?)', [name, type, webhook_url||'', events||'all']);
await query("INSERT INTO audit_logs(user_id, username, action, entity_type, entity_id, details) VALUES (?,?,?,?,?,?)", [req.user.id, req.user.username, 'create_notification', 'notification_config', r.insertId, `创建通知: ${name}`]);
res.status(201).json({ id: r.insertId, message: '创建成功' });
});
router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [req.params.id]);
const id = parseInt(req.params.id);
if (!id) return res.status(400).json({ error: '无效的ID' });
const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]);
if (!cfg) return res.status(404).json({ error: '配置不存在' });
const err = await validateNotify(req.body);
if (err) return res.status(400).json({ error: err });
const fields = {};
if (req.body.name) fields.name = req.body.name;
if (req.body.webhook_url !== undefined) fields.webhook_url = req.body.webhook_url;
if (req.body.type) fields.type = req.body.type;
if (req.body.active !== undefined) fields.active = req.body.active?1:0;
if (req.body.active !== undefined) { if (typeof req.body.active !== 'boolean' && ![0,1,'0','1'].includes(req.body.active)) return res.status(400).json({ error: 'active 必须为布尔值' }); fields.active = req.body.active ? 1 : 0; }
if (req.body.events !== undefined) fields.events = req.body.events;
if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
const sets = Object.keys(fields).map(k=>`${k}=?`).join(',');
await query(`UPDATE notification_configs SET ${sets} WHERE id = ?`, [...Object.values(fields), req.params.id]);
await query(`UPDATE notification_configs SET ${sets} WHERE id = ?`, [...Object.values(fields), id]);
res.json({ message: '更新成功' });
});
router.delete('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
await query('DELETE FROM notification_configs WHERE id = ?', [req.params.id]);
const id = parseInt(req.params.id);
if (!id) return res.status(400).json({ error: '无效的ID' });
await query('DELETE FROM notification_configs WHERE id = ?', [id]);
res.json({ message: '已删除' });
});
router.post('/:id/test', authenticate, requireRole('owner','admin'), async (req, res) => {
const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [req.params.id]);
const id = parseInt(req.params.id);
if (!id) return res.status(400).json({ error: '无效的ID' });
const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]);
if (!cfg||!cfg.webhook_url) return res.status(404).json({ error: '配置不存在' });
sendWebhook('ticket_created', { ticket_id:'TEST', ticket_title:'测试通知', ticket_type:'测试', reporter_game_name:'TestPlayer', reporter_game_uid:'TEST001', ticket_reason:'这是一条测试消息' }).then(() => res.json({ message:'测试消息已发送' })).catch(e => res.status(500).json({ error:e.message }));
});