mirror of
https://gitee.com/beecue/fastbee.git
synced 2026-11-07 09:28:54 +08:00
fix(规则脚本): 规则引擎 Groovy 脚本注入导致远程代码执行漏洞修复
This commit is contained in:
gx_ma
127
vue/tests/password-change-flow.cjs
Normal file
127
vue/tests/password-change-flow.cjs
Normal file
@@ -0,0 +1,127 @@
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const vm = require('vm');
|
||||
const assert = require('assert');
|
||||
const axios = require('axios');
|
||||
const root = path.resolve(__dirname, '..');
|
||||
const source = file => fs.readFileSync(path.join(root, file), 'utf8');
|
||||
const withoutImports = js => js.replace(/^import .*$/gm, '');
|
||||
|
||||
module.exports = async function passwordChangeFlowTests() {
|
||||
let checks = 0;
|
||||
const check = (label, fn) => { fn(); checks++; console.log('PASS ' + label); };
|
||||
const helper = {module:{exports:{}}};
|
||||
vm.runInNewContext(source('src/utils/passwordChange.js').replace(/^export /gm, '')
|
||||
+ '\nmodule.exports={PASSWORD_CHANGE_ROUTE,isPasswordChangeResponse,allowedWhileChangingPassword};',helper);
|
||||
const helpers = helper.module.exports;
|
||||
check('only explicit mandatory-password responses activate the gate', () => {
|
||||
assert(helpers.isPasswordChangeResponse({needChangePwd:true},403));
|
||||
assert(helpers.isPasswordChangeResponse({needChangePwd:true,code:403},200));
|
||||
assert(!helpers.isPasswordChangeResponse({needChangePwd:true,code:200},200));
|
||||
assert(!helpers.isPasswordChangeResponse({code:403},403));
|
||||
});
|
||||
check('password gate preserves essential endpoints with exact HTTP methods', () => {
|
||||
assert(helpers.allowedWhileChangingPassword({url:'/getInfo?refresh=1',method:'get'}));
|
||||
assert(helpers.allowedWhileChangingPassword({url:'/system/user/profile/updatePwd',method:'put'}));
|
||||
assert(helpers.allowedWhileChangingPassword({url:'/logout',method:'post'}));
|
||||
assert(!helpers.allowedWhileChangingPassword({url:'/system/user/profile/updatePwd',method:'get'}));
|
||||
assert(!helpers.allowedWhileChangingPassword({url:'/iot/device/statistic',method:'get'}));
|
||||
});
|
||||
|
||||
let required=false, token='local-test-token', navigationCount=0, releaseNavigation;
|
||||
const messages=[], notifications=[];
|
||||
const state={user:{needChangePwd:false},settings:{language:'zh-CN'}};
|
||||
const router={currentRoute:{path:'/index'},replace:() => {
|
||||
navigationCount++;
|
||||
return new Promise(resolve => { releaseNavigation=resolve; });
|
||||
}};
|
||||
const store={state,commit:(name,value)=>{assert.strictEqual(name,'SET_NEED_CHANGE_PWD');state.user.needChangePwd=value;required=value;},dispatch:()=>Promise.resolve()};
|
||||
const Message=options=>messages.push(options);
|
||||
Message.error=msg=>messages.push(msg);
|
||||
let closed=0;
|
||||
const requestSandbox={module:{exports:{}},axios,router,store,getToken:()=>token,...helpers,
|
||||
Notification:{error:options=>notifications.push(options)},Message,MessageBox:{confirm:()=>Promise.reject(new Error('unused'))},
|
||||
Loading:{service:()=>({close:()=>{closed++;}})},errorCode:{default:'error'},
|
||||
tansParams:()=>'',blobValidate:()=>true,cache:{session:{getJSON:()=>null,setJSON:()=>{}}},saveAs:()=>{},
|
||||
process:{env:{VUE_APP_BASE_API:'/prod-api'}},console:{log:()=>{},warn:()=>{},error:()=>{}},location:{href:''}};
|
||||
const requestJs=withoutImports(source('src/utils/request.js')).replace('export default service;', 'module.exports={service,download};').replace(/^export /gm,'');
|
||||
vm.runInNewContext(requestJs,requestSandbox,{filename:'request.js'});
|
||||
const {service,download}=requestSandbox.module.exports;
|
||||
let adapterCalls=0;
|
||||
service.defaults.adapter=async config=>{adapterCalls++;return {status:200,data:{code:200,value:'ok'},config,request:{responseType:''}};};
|
||||
let result=await service.get('/iot/device/statistic');
|
||||
check('normal homepage requests still reach the server',()=>assert(result.value==='ok' && adapterCalls===1));
|
||||
state.user.needChangePwd=true;
|
||||
await assert.rejects(service.get('/iot/device/statistic'),err=>axios.isCancel(err)&&err.needChangePwd===true);
|
||||
check('restricted homepage requests never reach the network or show errors',()=>assert(adapterCalls===1 && messages.length===0 && notifications.length===0));
|
||||
await service.get('/getInfo');
|
||||
await service.put('/system/user/profile/updatePwd',{oldPassword:'old',newPassword:'new'});
|
||||
await service.post('/logout');
|
||||
check('getInfo password update and logout remain available',()=>assert.strictEqual(adapterCalls,4));
|
||||
await service.get('/captchaImage',{headers:{isToken:false}});
|
||||
check('anonymous login prerequisites are not blocked by a stale flag',()=>assert.strictEqual(adapterCalls,5));
|
||||
await download('/iot/device/export',{},'test.xlsx');
|
||||
check('blocked downloads close loading without a second error toast',()=>assert(closed===1 && messages.length===0 && adapterCalls===5));
|
||||
releaseNavigation(); await new Promise(resolve=>setImmediate(resolve)); navigationCount=0;
|
||||
state.user.needChangePwd=false;
|
||||
service.defaults.adapter=async config=>{throw Object.assign(new Error('Request failed with status code 403'),{config,response:{status:403,data:{code:403,needChangePwd:true,msg:'change password'}}});};
|
||||
const responses=await Promise.allSettled(Array.from({length:6},()=>service.get('/iot/device/statistic')));
|
||||
check('concurrent mandatory-password 403s produce one redirect and no toasts',()=> {
|
||||
assert(responses.every(r=>r.status==='rejected'&&axios.isCancel(r.reason)));
|
||||
assert(required && navigationCount===1 && messages.length===0 && notifications.length===0);
|
||||
});
|
||||
releaseNavigation(); await new Promise(resolve=>setImmediate(resolve)); navigationCount=0;
|
||||
state.user.needChangePwd=false;required=false;
|
||||
service.defaults.adapter=async config=>{throw Object.assign(new Error('Request failed with status code 403'),{config,response:{status:403,data:{code:403,msg:'forbidden'}}});};
|
||||
await assert.rejects(service.get('/iot/device/statistic'));
|
||||
check('ordinary authorization errors still show their original error',()=>assert(messages.length===1 && navigationCount===0 && !required));
|
||||
service.defaults.adapter=async config=>({status:200,data:{code:403,msg:'forbidden'},config,request:{responseType:''}});
|
||||
await assert.rejects(service.get('/iot/device/statistic'));
|
||||
check('ordinary application-level 403 notifications remain visible',()=>assert.strictEqual(notifications.length,1));
|
||||
service.defaults.adapter=async config=>({status:200,data:{code:403,needChangePwd:true},config,request:{responseType:''}});
|
||||
await assert.rejects(service.get('/iot/device/statistic'),err=>axios.isCancel(err));
|
||||
check('application-level mandatory-password responses use the same quiet gate',()=>assert(required && messages.length===1 && notifications.length===1 && navigationCount===1));
|
||||
releaseNavigation(); await new Promise(resolve=>setImmediate(resolve));
|
||||
|
||||
let guard,afterEach,serverRequires=true,generated=0,languageLoads=0;
|
||||
let roles=[];state.user.needChangePwd=false; token='local-test-token';
|
||||
const guardStore={state,getters:{get roles(){return roles;}},dispatch:async name=>{
|
||||
if(name==='GetInfo'){state.user.needChangePwd=serverRequires;roles=['general'];}
|
||||
if(name==='GenerateRoutes'){generated++;return [];}
|
||||
if(name==='LogOut'){token='';roles=[];state.user.needChangePwd=false;}
|
||||
}};
|
||||
const guardSandbox={router:{beforeEach:fn=>{guard=fn;},afterEach:fn=>{afterEach=fn;},addRoutes:()=>{}},store:guardStore,
|
||||
Message:{error:()=>{}},NProgress:{configure:()=>{},start:()=>{},done:()=>{}},getToken:()=>token,isRelogin:{show:false},
|
||||
PASSWORD_CHANGE_ROUTE:helpers.PASSWORD_CHANGE_ROUTE,loadLanguageNames:()=>{languageLoads++;}};
|
||||
vm.runInNewContext(withoutImports(source('src/permission.js')),guardSandbox,{filename:'permission.js'});
|
||||
const navigate=path=>new Promise(resolve=>guard({path,fullPath:path,meta:{}},{path:'/'},resolve));
|
||||
result=await navigate('/index');
|
||||
check('refresh with a deleted browser flag redirects before generating business routes',()=>assert(result.path==='/change-password' && generated===0));
|
||||
result=await navigate('/change-password');
|
||||
check('the isolated password page is reachable without a redirect loop',()=>assert.strictEqual(result,undefined));
|
||||
result=await navigate('/bigScreen');
|
||||
check('direct business routes cannot mount while a password change is required',()=>assert.strictEqual(result.path,'/change-password'));
|
||||
afterEach();check('restricted navigation does not request optional language metadata',()=>assert.strictEqual(languageLoads,0));
|
||||
state.user.needChangePwd=false;serverRequires=false;roles=[];
|
||||
result=await navigate('/index');
|
||||
check('normal and demo sessions retain route generation and homepage navigation',()=>assert(result.path==='/index' && generated===1));
|
||||
afterEach();check('normal navigation still loads configured language names',()=>assert.strictEqual(languageLoads,1));
|
||||
result=await navigate('/change-password');
|
||||
check('unrestricted users do not get trapped on the password page',()=>assert.strictEqual(result.path,'/index'));
|
||||
token='';result=await navigate('/change-password');
|
||||
check('anonymous access to the password page follows the normal login flow',()=>assert.strictEqual(result,'/login?redirect=/change-password'));
|
||||
|
||||
const context=function(){return {};};context.keys=()=>[];
|
||||
const fakeRequire={context:()=>context};
|
||||
let languageCalls=0;
|
||||
const languageSandbox={module:{exports:{}},Vue:{use:()=>{}},Element:{},VueI18n:function(options){this.locale=options.locale;this.t=k=>k;},
|
||||
locale:{use:()=>{}},enLocale:{},zhLocale:{},defaultSettings:{language:'zh-CN'},require:fakeRequire,
|
||||
listLanguage:async()=>{languageCalls++;return {rows:[{language:'en-US',langName:'Custom English'}]};}};
|
||||
vm.runInNewContext(withoutImports(source('src/lang/index.js')).replace('export { i18n, langs, loadLanguageNames };','module.exports={langs,loadLanguageNames};'),languageSandbox);
|
||||
check('importing translations no longer starts an eager HTTP request',()=>assert.strictEqual(languageCalls,0));
|
||||
const languageModule=languageSandbox.module.exports;
|
||||
await Promise.all([languageModule.loadLanguageNames(),languageModule.loadLanguageNames()]);
|
||||
await languageModule.loadLanguageNames();
|
||||
check('language metadata is loaded once and preserves custom names',()=>assert(languageCalls===1 && languageModule.langs['en-US'].language==='Custom English'));
|
||||
return checks;
|
||||
};
|
||||
62
vue/tests/security-regression.cjs
Normal file
62
vue/tests/security-regression.cjs
Normal file
@@ -0,0 +1,62 @@
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const vm = require('vm');
|
||||
const assert = require('assert');
|
||||
const compiler = require('vue-template-compiler');
|
||||
const root = path.resolve(__dirname, '..');
|
||||
let checks = 0;
|
||||
function check(label, fn) { fn(); checks++; console.log('PASS ' + label); }
|
||||
const source = p => fs.readFileSync(path.join(root, p), 'utf8');
|
||||
|
||||
async function main() {
|
||||
for (const file of ['src/components/ForceChangePwd/index.vue', 'src/layout/index.vue']) {
|
||||
const sfc = compiler.parseComponent(source(file));
|
||||
check('compile ' + file, () => assert.deepStrictEqual(compiler.compile(sfc.template.content).errors, []));
|
||||
}
|
||||
for (const locale of ['zh-CN', 'en-US']) {
|
||||
const messages = JSON.parse(source('src/lang/' + locale + '/common.json'));
|
||||
check(locale + ' password prompt translations', () => assert(messages.forceChangePwdTitle && messages.forceChangePwdTip && messages.forceChangePwdConfirm));
|
||||
}
|
||||
const storage = new Map();
|
||||
let info = {user: {userId: 42, userName: 'owner'}, roles: ['general'], permissions: [], needChangePwd: true};
|
||||
const sandbox = {
|
||||
module: {exports: {}}, process: {env: {}}, defAva: 'avatar',
|
||||
localStorage: {getItem: k => storage.get(k), setItem: (k,v) => storage.set(k,v), removeItem: k => storage.delete(k)},
|
||||
getToken: () => 'local-test-token', setToken: () => {}, removeToken: () => {},
|
||||
getInfo: () => Promise.resolve(info), login: () => Promise.resolve({token:'test-token',needChangePwd:true}), logout: () => Promise.resolve(),
|
||||
isHttp: () => false, isEmpty: value => !value,
|
||||
};
|
||||
const js = source('src/store/modules/user.js').replace(/^import .*$/gm, '').replace('export default user', 'module.exports = user');
|
||||
vm.runInNewContext(js, sandbox, {filename: 'user.js'});
|
||||
const store = sandbox.module.exports;
|
||||
const commit = (name, value) => store.mutations[name](store.state, value);
|
||||
const context = {commit, state: store.state};
|
||||
check('missing client flag initially false', () => assert.strictEqual(store.state.needChangePwd, false));
|
||||
await store.actions.GetInfo(context);
|
||||
check('server restores mandatory change after localStorage removal', () => assert.strictEqual(store.state.needChangePwd, true));
|
||||
info = {...info, needChangePwd: false};
|
||||
await store.actions.GetInfo(context);
|
||||
check('normal password does not display forced prompt', () => assert.strictEqual(store.state.needChangePwd, false));
|
||||
await store.actions.Login(context, {username:'owner',password:'test'});
|
||||
check('login response enables mandatory change', () => assert.strictEqual(store.state.needChangePwd, true));
|
||||
await store.actions.LogOut(context);
|
||||
check('logout clears token and prompt state', () => assert.strictEqual(store.state.token + ':' + store.state.needChangePwd, ':false'));
|
||||
|
||||
let submitted = null, loggedOut = false;
|
||||
const componentSandbox = {module:{exports:{}}, location:{href:''}, updateUserPwd: input => {submitted=input; return Promise.resolve();}};
|
||||
const componentScript = compiler.parseComponent(source('src/components/ForceChangePwd/index.vue')).script.content
|
||||
.replace(/^import .*$/gm, '').replace('export default', 'module.exports =');
|
||||
vm.runInNewContext(componentScript, componentSandbox, {filename:'ForceChangePwd.vue'});
|
||||
const component = componentSandbox.module.exports;
|
||||
const instance = {$t:k=>k, $refs:{form:{validate:cb=>cb(true)}}, $modal:{msgSuccess:()=>{}},
|
||||
$store:{state:{user:{needChangePwd:true}}, commit:()=>{}, dispatch:()=>{loggedOut=true;return Promise.resolve();}}};
|
||||
Object.assign(instance,component.data.call(instance));
|
||||
instance.form.oldPassword='old'; instance.form.newPassword='NewPassword!'; instance.form.confirmPassword='NewPassword!';
|
||||
component.methods.submit.call(instance);
|
||||
await new Promise(resolve => setImmediate(resolve));
|
||||
check('password form posts old and new password', () => assert(submitted.oldPassword==='old' && submitted.newPassword==='NewPassword!'));
|
||||
check('successful change logs out and returns to login', () => assert(loggedOut && !instance.loading && componentSandbox.location.href==='/login'));
|
||||
checks += await require('./password-change-flow.cjs')();
|
||||
console.log('SECURITY_FRONTEND_PASS checks=' + checks);
|
||||
}
|
||||
main().catch(error => {console.error(error);process.exitCode=1;});
|
||||
Reference in New Issue
Block a user