Repository navigation
fix(security): 修复静态文件穿越、默认凭据与令牌混用等严重漏洞 - #33
Merged
Merged
Conversation
- 新增自研滑块验证码（服务端渲染 PNG，票据一次性、绑定 IP、2 分钟过期） - 滑块失败与密码失败共用登录锁定计数 - 风控设置新增 AdminLoginSlider 开关，登录页接入滑块组件 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- 静态站点：请求路径解析后必须位于根目录内，修复 //etc/passwd 等任意文件读取 - SignedToken 签名绑定 payload 类型，挑战状态不能再当作 Bot/风控 clearance 使用 - JWT 密钥未配置或为历史默认值时按安装随机生成（data/jwt-secret），ClockSkew 改为 5 分钟 - 未配置管理员密码时生成随机初始密码（data/admin-password），不再回退 Aa123456 - 默认 TunnelToken 视为未配置并禁用全局注册；常数时间比较，失败延迟；手动创建的节点不能被全局 Token 冒用 - 隧道 Route 白名单校验，防止 http://node_x@host 形式的 SSRF - 集群：邀请码一次性使用、令牌常数时间比较、中继隧道恢复 TLS 校验、证书文件名防穿越 - X-Forwarded-For 改取最右段，避免客户端伪造 IP - 修正部署文档中 JWT 配置节名（JwtOptions → Jwt） BREAKING CHANGE: 未设置 PASSWORD 的部署升级后需使用 data/admin-password 中的密码登录； 使用默认 TunnelToken 的隧道客户端需改用节点密钥或配置自定义 TunnelToken。 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
全项目安全审计后修复的严重漏洞，另附管理后台登录滑块验证功能（独立提交 f589dc1）。
修复内容
GET //etc/passwd任意文件读取（无需登录）GetFullPath后必须位于根目录内appsettings.json，可伪造管理员 tokendata/jwt-secret；ClockSkew30 天 → 5 分钟Aa123456data/admin-password，启动日志提示Aa123456.可匿名注册/冒用节点@169.254.169.254）SignedToken签名绑定 payload 类型Path.GetFileName、FixedTimeEqualsX-Forwarded-For取最左段可伪造PASSWORD的部署升级后需用data/admin-password中的密码登录。验证
dotnet build通过；dotnet test213 个测试全部通过（新增SecurityHardeningTests）。admin-password/jwt-secret（权限 600）；旧公开密钥签发的 JWT 返回 401，新密钥返回 200。npm run lint未通过：主分支已有 125 个问题，本 PR 涉及的前端文件中 4 处no-explicit-any为既有问题，需另行处理。未包含（后续跟进）
可信代理列表、隧道 Domains 白名单、文件管理接口限制根目录、证书 PFX 固定密码、502 错误详情泄露上游地址、IPv6 地区黑名单、
/api/v1/system/info匿名访问、MessagePack 3.1.8 已知漏洞（GHSA-qhrr-8q5h-9q3h）。🤖 Generated with Claude Code