xuans/Smail
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

完善自定义证书路径校验
Some checks are pending
Security Checks / security (push) Waiting to run
Details

Browse Source
This commit is contained in:
smail 2026-09-08 13:18:17 +08:00
parent 7553a9bfba
commit 44ac49feb9
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
frontend/src/views/components/ConfigSettings/ConfigForm/ConfigForm.js
View File

@ -72,6 +72,10 @@ const certificateManagement = config => {
}
const projectManagedCertificate = config => certificateManagement(config) === 'project'
const externalManagedCertificate = config => !projectManagedCertificate(config)
const absoluteCertificatePath = value => typeof value === 'string'
&& value === value.trim()
&& /^(?:[a-z]:[\\/]|\\\\|\/)/i.test(value)
&& !/(^|[\\/])\.\.(?:[\\/]|$)/.test(value)
const normalizedDomain = value => value.toLowerCase().replace(/\.$/, '')
const validDomain = value => {
if (typeof value !== 'string' || value !== value.trim()) return false
@ -368,7 +372,10 @@ export function validateFormConfig(section, config) {
if (!controlled(tls[name])) errors[`tls.${name}`] = '请填写受管存储中的相对目录，不允许绝对路径或上级目录'
}
for (const name of ['certificateRef', 'privateKeyRef']) {
if (tls[name] && (!controlled(tls[name]) || !tls[name].startsWith(`${directory}/`))) errors[`tls.${name}`] = '文件引用必须位于当前证书目录内'
if (!tls[name]) continue
const managedReference = controlled(tls[name]) && tls[name].startsWith(`${directory}/`)
const externalReference = management === 'custom' && absoluteCertificatePath(tls[name])
if (!managedReference && !externalReference) errors[`tls.${name}`] = '文件引用必须是受管存储引用或自定义服务器绝对路径'
}
if (!!tls.certificateRef !== !!tls.privateKeyRef) errors['tls.privateKeyRef'] = '证书与私钥引用必须成对填写'
}

6
test/frontend/config-form.test.mjs
View File

@ -319,6 +319,12 @@ test('证书管理方式只展示三种业务模式并同步底层托管配置',
}
assert.ok(validateFormConfig('ssl', { tls: { ...tls, privateKeyRef: '' } })['tls.privateKeyRef'])
assert.ok(validateFormConfig('ssl', { tls: { ...tls, certificateRef: 'config/ssl/outside.pem' } })['tls.certificateRef'])
for (const certificateRef of ['C:\\certs\\site.crt', 'D:/certs/site.crt', '/etc/ssl/site.crt', '\\\\server\\share\\site.crt']) {
assert.deepEqual(validateFormConfig('ssl', { tls: { ...tls, certificateRef, privateKeyRef: certificateRef.replace(/(?:crt|pem)$/, 'key') } }), {})
}
for (const certificateRef of ['C:\\certs\\..\\site.crt', '/etc/ssl/../site.crt', 'C:relative\\site.crt']) {
assert.ok(validateFormConfig('ssl', { tls: { ...tls, certificateRef } })['tls.certificateRef'])
}
let updated = readFormConfig(updateFormConfig(JSON.stringify({ tls }), 'ssl', ['tls', 'management'], 'project'))
assert.equal(updated.tls.mode, tls.mode)
assert.equal(updated.tls.customDirectory, tls.customDirectory)