security: backend validation for all inputs

- router.param('id'): all :id path params must be positive ints (tickets/features/polls/auth/users; external/bans/notifications already had parseInt - now consistent) - notifications: type enum + webhook URL format + SSRF (isPrivateUrl exported) + events whitelist + active boolean check on PUT - bans: type enum + player_name length - external: all-tickets type/status enums, bans status/type enums, page/limit floor protection, ticket field length caps, clients active boolean + id validation - verified: 28 checks (syntax + validation coverage)
2026-08-21 20:10:05 +08:00
parent 8c5ce78fd0
commit e1cdff2b4a
9 changed files with 108 additions and 21 deletions
--- a/backend/routes/auth.js
+++ b/backend/routes/auth.js
@@ -28,6 +28,12 @@ const { validateLengths } = require('../middleware/security');

 const router = express.Router();

+// 统一校验 :id 路径参数(必须是正整数)
+router.param('id', (req, res, next, id) => {
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' });
+  next();
+});
+
 async function getSiteUrl() {
  const row = await getRow("SELECT v FROM settings WHERE k = 'site_url'");
  return row?.v || 'http://localhost:3100';
--- a/backend/routes/bans.js
+++ b/backend/routes/bans.js
@@ -49,6 +49,8 @@ router.post('/', authenticate, requireRole('owner'), async (req, res) => {
  try {
    const { player_name, player_uid, reason, type, duration, ticket_id, expires_at, source } = req.body;
    if (!player_name) return res.status(400).json({ error: '玩家名为必填' });
+    if (player_name.length > 50) return res.status(400).json({ error: '玩家名过长' });
+    if (type && !['ban','mute','warn','other'].includes(type)) return res.status(400).json({ error: '无效的处罚类型' });

    const durDays = parseDuration(duration);
    const prev = await getRow('SELECT * FROM bans WHERE (player_name = ? OR player_uid = ?) AND type = ? AND status = ? ORDER BY created_at DESC LIMIT 1',
@@ -85,7 +87,9 @@ router.put('/:id', authenticate, requireRole('owner'), async (req, res) => {
 });

 router.delete('/:id', authenticate, requireRole('owner'), async (req, res) => {
-  await query('DELETE FROM bans WHERE id = ?', [req.params.id]);
+  const id = parseInt(req.params.id);
+  if (!id) return res.status(400).json({ error: '无效的ID' });
+  await query('DELETE FROM bans WHERE id = ?', [id]);
  res.json({ message: '已删除' });
 });

--- a/backend/routes/external.js
+++ b/backend/routes/external.js
@@ -112,9 +112,12 @@ router.get('/clients', authenticate, async (req, res) => {
 router.put('/clients/:id', authenticate, async (req, res) => {
  try {
    if (!['owner','admin'].includes(req.user.role)) return res.status(403).json({ error: '无权限' });
+    const id = parseInt(req.params.id);
+    if (!id) return res.status(400).json({ error: '无效的ID' });
    const { active } = req.body;
-    await query('UPDATE api_clients SET active = ? WHERE id = ?', [active ? 1 : 0, req.params.id]);
-    await logSystem('info', 'api', `更新外部API客户端 #${req.params.id}`, { active: !!active });
+    if (active === undefined || (typeof active !== 'boolean' && ![0,1,'0','1'].includes(active))) return res.status(400).json({ error: 'active 必须为布尔值' });
+    await query('UPDATE api_clients SET active = ? WHERE id = ?', [active ? 1 : 0, id]);
+    await logSystem('info', 'api', `更新外部API客户端 #${id}`, { active: !!active });
    res.json({ message: '已更新' });
  } catch (e) { res.status(500).json({ error: e.message }); }
 });
@@ -122,8 +125,10 @@ router.put('/clients/:id', authenticate, async (req, res) => {
 router.delete('/clients/:id', authenticate, async (req, res) => {
  try {
    if (!['owner','admin'].includes(req.user.role)) return res.status(403).json({ error: '无权限' });
-    await query('DELETE FROM api_clients WHERE id = ?', [req.params.id]);
-    await logSystem('info', 'api', `删除外部API客户端 #${req.params.id}`);
+    const id = parseInt(req.params.id);
+    if (!id) return res.status(400).json({ error: '无效的ID' });
+    await query('DELETE FROM api_clients WHERE id = ?', [id]);
+    await logSystem('info', 'api', `删除外部API客户端 #${id}`);
    res.json({ message: '已删除' });
  } catch (e) { res.status(500).json({ error: e.message }); }
 });
@@ -185,6 +190,10 @@ router.post('/tickets', async (req, res) => {
    const { type, title, reporter_game_name, reporter_game_uid, target_game_name, target_game_uid, reason, description, is_admin_complaint, server } = req.body;
    if (!type || !['report','suggestion','appeal'].includes(type)) return res.status(400).json({ error: '类型不正确' });
    if (!title || !reporter_game_name) return res.status(400).json({ error: '必填字段不完整' });
+    if (String(title).length > 100) return res.status(400).json({ error: '标题过长(≤100)' });
+    if (String(reporter_game_name).length > 50) return res.status(400).json({ error: '游戏名过长' });
+    if (reason && String(reason).length > 500) return res.status(400).json({ error: '原因过长(≤500)' });
+    if (description && String(description).length > 5000) return res.status(400).json({ error: '内容过长(≤5000)' });
    if (type === 'report' && !reason) return res.status(400).json({ error: '请填写举报原因' });
    if (type === 'suggestion' && !description) return res.status(400).json({ error: '建议内容不能为空' });
    if (type === 'appeal' && (!reason || !description)) return res.status(400).json({ error: '请填写完整申诉信息' });
@@ -216,8 +225,14 @@ router.get('/tickets/track', async (req, res) => {
 });

 // ============ 工单列表(带 server 过滤) ============
+const TICKET_TYPES = ['report', 'suggestion', 'appeal', 'result_appeal'];
+const TICKET_STATUSES = ['pending', 'processing', 'awaiting_info', 'appealing', 'resolved', 'rejected', 'closed'];
+const BAN_STATUSES = ['active', 'expired', 'appealed', 'lifted'];
+
 router.get('/all-tickets', async (req, res) => {
  const { type, status, server, page, limit } = req.query;
+  if (type && !TICKET_TYPES.includes(type)) return res.status(400).json({ error: '无效的 type' });
+  if (status && !TICKET_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' });
  let q = `SELECT id, type, title, status, priority, reporter_game_name, reporter_game_uid, target_game_name, target_game_uid, reason, description, assigned_to, claim_note, server_name, created_at, updated_at FROM tickets WHERE 1=1`;
  const p = [];
  if (type) { q += ' AND type = ?'; p.push(type); }
@@ -226,17 +241,19 @@ router.get('/all-tickets', async (req, res) => {
    const sv = await resolveServer(server);
    q += ' AND server_name = ?'; p.push(sv.server_name);
  }
-  const pg = parseInt(page) || 1;
-  const lm = Math.min(parseInt(limit) || 50, 200);
+  const pg = Math.max(parseInt(page) || 1, 1);
+  const lm = Math.min(Math.max(parseInt(limit) || 50, 1), 200);
  q += ` ORDER BY updated_at DESC LIMIT ${(pg-1)*lm}, ${lm}`;
  res.json(await query(q, p));
 });

 router.get('/all-tickets/:id', async (req, res) => {
-  const t = await getRow('SELECT * FROM tickets WHERE id = ?', [req.params.id]);
+  const id = parseInt(req.params.id);
+  if (!id) return res.status(400).json({ error: '无效的ID' });
+  const t = await getRow('SELECT * FROM tickets WHERE id = ?', [id]);
  if (!t) return res.status(404).json({ error: 'Not found' });
-  t.responses = await query('SELECT content, is_staff, created_at FROM responses WHERE ticket_id = ? ORDER BY created_at ASC', [req.params.id]);
-  t.attachments = await query('SELECT id, original_name, mime_type, size FROM attachments WHERE ticket_id = ?', [req.params.id]);
+  t.responses = await query('SELECT content, is_staff, created_at FROM responses WHERE ticket_id = ? ORDER BY created_at ASC', [id]);
+  t.attachments = await query('SELECT id, original_name, mime_type, size FROM attachments WHERE ticket_id = ?', [id]);
  res.json(t);
 });

@@ -244,6 +261,7 @@ router.get('/all-tickets/:id', async (req, res) => {
 // 拉取封禁: ?server=alias|server_name|分组/服务器&status=active|expired|appealed|lifted&player=&limit=
 router.get('/bans', async (req, res) => {
  const { server, status, player, page, limit } = req.query;
+  if (status && !BAN_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' });
  let q = 'SELECT id, player_name, player_uid, source, reason, type, duration, server_name, status, created_at, expires_at FROM bans WHERE 1=1';
  const p = [];
  if (server) {
@@ -252,8 +270,8 @@ router.get('/bans', async (req, res) => {
  }
  if (status) { q += ' AND status = ?'; p.push(status); }
  if (player) { q += ' AND (player_name = ? OR player_uid = ?)'; p.push(player, player); }
-  const pg = parseInt(page) || 1;
-  const lm = Math.min(parseInt(limit) || 100, 500);
+  const pg = Math.max(parseInt(page) || 1, 1);
+  const lm = Math.min(Math.max(parseInt(limit) || 100, 1), 500);
  q += ` ORDER BY created_at DESC LIMIT ${(pg-1)*lm}, ${lm}`;
  res.json(await query(q, p));
 });
@@ -263,6 +281,9 @@ router.post('/bans', async (req, res) => {
  try {
    const { player_name, player_uid, source, reason, type, duration, expires_at, server, status } = req.body;
    if (!player_name) return res.status(400).json({ error: 'player_name 必填' });
+    if (player_name.length > 50) return res.status(400).json({ error: 'player_name 过长' });
+    if (type && !['ban','mute','warn','other'].includes(type)) return res.status(400).json({ error: '无效的 type' });
+    if (status && !BAN_STATUSES.includes(status)) return res.status(400).json({ error: '无效的 status' });
    const sv = await resolveServer(server);
    const r = await query(`INSERT INTO bans(player_name, player_uid, source, reason, type, duration, server_name, status, expires_at) VALUES (?,?,?,?,?,?,?,?,?)`,
      [player_name, player_uid||'', source||'', reason||'', ['ban','mute','warn','other'].includes(type)?type:'ban', duration||'', sv.server_name, ['active','expired','appealed','lifted'].includes(status)?status:'active', expires_at||null]);
--- a/backend/routes/features.js
+++ b/backend/routes/features.js
@@ -23,6 +23,12 @@ const { authenticate, requireRole } = require('../middleware/auth');

 const router = express.Router();

+// 统一校验 :id 路径参数(必须是正整数)
+router.param('id', (req, res, next, id) => {
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' });
+  next();
+});
+
 router.get('/', authenticate, async (req, res) => {
  const { group_name, server_name, sort, status } = req.query;
  let orderClause = 'ORDER BY fi.created_at DESC';
--- a/backend/routes/notifications.js
+++ b/backend/routes/notifications.js
@@ -20,10 +20,31 @@
 const express = require('express');
 const { query, getRow } = require('../db');
 const { authenticate, requireRole } = require('../middleware/auth');
-const { sendWebhook } = require('../webhook');
+const { sendWebhook, isPrivateUrl } = require('../webhook');

 const router = express.Router();

+const NOTIFY_TYPES = ['webhook', 'email', 'generic'];
+const NOTIFY_EVENTS = ['all', 'ticket_created', 'ticket_claimed', 'ticket_transferred', 'ticket_updated'];
+
+// 校验通知配置字段(创建/更新共用)
+async function validateNotify(body) {
+  const { name, type, webhook_url, events } = body;
+  if (name !== undefined && (!name || String(name).length > 100)) return '名称不能为空且不超过100字符';
+  if (type !== undefined && !NOTIFY_TYPES.includes(type)) return '无效的通知类型';
+  if (webhook_url !== undefined && webhook_url !== '') {
+    let u;
+    try { u = new URL(webhook_url); } catch { return 'Webhook地址格式无效'; }
+    if (u.protocol !== 'https:' && u.protocol !== 'http:') return 'Webhook地址协议不支持';
+    if (await isPrivateUrl(webhook_url)) return 'Webhook地址不允许指向内网';
+  }
+  if (events !== undefined) {
+    const list = String(events).split(',').map(s => s.trim());
+    if (!list.every(e => NOTIFY_EVENTS.includes(e))) return '无效的触发事件';
+  }
+  return null;
+}
+
 router.get('/', authenticate, requireRole('owner','admin'), async (req, res) => {
  res.json(await query('SELECT * FROM notification_configs ORDER BY id'));
 });
@@ -31,6 +52,8 @@ router.get('/', authenticate, requireRole('owner','admin'), async (req, res) =>
 router.post('/', authenticate, requireRole('owner','admin'), async (req, res) => {
  const { name, type, webhook_url, events } = req.body;
  if (!name || !type) return res.status(400).json({ error: '名称和类型为必填' });
+  const err = await validateNotify({ name, type, webhook_url, events });
+  if (err) return res.status(400).json({ error: err });
  if (type === 'webhook' && !webhook_url) return res.status(400).json({ error: 'Webhook地址必填' });
  const r = await query('INSERT INTO notification_configs(name, type, webhook_url, events) VALUES (?,?,?,?)', [name, type, webhook_url||'', events||'all']);
  await query("INSERT INTO audit_logs(user_id, username, action, entity_type, entity_id, details) VALUES (?,?,?,?,?,?)", [req.user.id, req.user.username, 'create_notification', 'notification_config', r.insertId, `创建通知: ${name}`]);
@@ -38,26 +61,35 @@ router.post('/', authenticate, requireRole('owner','admin'), async (req, res) =>
 });

 router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
-  const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [req.params.id]);
+  const id = parseInt(req.params.id);
+  if (!id) return res.status(400).json({ error: '无效的ID' });
+  const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]);
  if (!cfg) return res.status(404).json({ error: '配置不存在' });
+  const err = await validateNotify(req.body);
+  if (err) return res.status(400).json({ error: err });
  const fields = {};
  if (req.body.name) fields.name = req.body.name;
  if (req.body.webhook_url !== undefined) fields.webhook_url = req.body.webhook_url;
  if (req.body.type) fields.type = req.body.type;
-  if (req.body.active !== undefined) fields.active = req.body.active?1:0;
+  if (req.body.active !== undefined) { if (typeof req.body.active !== 'boolean' && ![0,1,'0','1'].includes(req.body.active)) return res.status(400).json({ error: 'active 必须为布尔值' }); fields.active = req.body.active ? 1 : 0; }
+  if (req.body.events !== undefined) fields.events = req.body.events;
  if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
  const sets = Object.keys(fields).map(k=>`${k}=?`).join(',');
-  await query(`UPDATE notification_configs SET ${sets} WHERE id = ?`, [...Object.values(fields), req.params.id]);
+  await query(`UPDATE notification_configs SET ${sets} WHERE id = ?`, [...Object.values(fields), id]);
  res.json({ message: '更新成功' });
 });

 router.delete('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
-  await query('DELETE FROM notification_configs WHERE id = ?', [req.params.id]);
+  const id = parseInt(req.params.id);
+  if (!id) return res.status(400).json({ error: '无效的ID' });
+  await query('DELETE FROM notification_configs WHERE id = ?', [id]);
  res.json({ message: '已删除' });
 });

 router.post('/:id/test', authenticate, requireRole('owner','admin'), async (req, res) => {
-  const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [req.params.id]);
+  const id = parseInt(req.params.id);
+  if (!id) return res.status(400).json({ error: '无效的ID' });
+  const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]);
  if (!cfg||!cfg.webhook_url) return res.status(404).json({ error: '配置不存在' });
  sendWebhook('ticket_created', { ticket_id:'TEST', ticket_title:'测试通知', ticket_type:'测试', reporter_game_name:'TestPlayer', reporter_game_uid:'TEST001', ticket_reason:'这是一条测试消息' }).then(() => res.json({ message:'测试消息已发送' })).catch(e => res.status(500).json({ error:e.message }));
 });
--- a/backend/routes/polls.js
+++ b/backend/routes/polls.js
@@ -23,6 +23,12 @@ const { authenticate, requireRole } = require('../middleware/auth');

 const router = express.Router();

+// 统一校验 :id 路径参数(必须是正整数)
+router.param('id', (req, res, next, id) => {
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' });
+  next();
+});
+
 router.get('/groups', authenticate, async (req, res) => {
  res.json(await query('SELECT * FROM server_groups ORDER BY group_name, server_name'));
 });
--- a/backend/routes/tickets.js
+++ b/backend/routes/tickets.js
@@ -28,6 +28,12 @@ const { validateLengths, ticketAnonLimiter } = require('../middleware/security')

 const router = express.Router();

+// 统一校验 :id 路径参数(必须是正整数)
+router.param('id', (req, res, next, id) => {
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' });
+  next();
+});
+
 const SL = { pending:'待处理', processing:'处理中', awaiting_info:'待补充', appealing:'申诉中', resolved:'已解决', rejected:'已驳回', closed:'已关闭' };
 const TL = { report:'举报', suggestion:'建议', appeal:'申诉', result_appeal:'结果申诉' };
 const SC = { pending:'#f59e0b', processing:'#7c3aed', awaiting_info:'#d97706', appealing:'#f97316', resolved:'#059669', rejected:'#dc2626', closed:'#6b7280' };
--- a/backend/routes/users.js
+++ b/backend/routes/users.js
@@ -24,6 +24,12 @@ const { authenticate, requireRole } = require('../middleware/auth');

 const router = express.Router();

+// 统一校验 :id 路径参数(必须是正整数)
+router.param('id', (req, res, next, id) => {
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' });
+  next();
+});
+
 router.get('/', authenticate, requireRole('owner','admin'), async (req, res) => {
  const rows = await query(`SELECT u.id, u.username, u.email, u.game_name, u.game_uid, u.source, u.role, u.active, u.email_verified, u.created_at,
    (SELECT COUNT(*) FROM user_identities ui WHERE ui.user_id = u.id) as identity_count
--- a/backend/webhook.js
+++ b/backend/webhook.js
@@ -74,4 +74,4 @@ function buildEmbed(event, data) {
  return embed;
 }

-module.exports = { sendWebhook };
+module.exports = { sendWebhook, isPrivateUrl };