658 lines
30 KiB
JavaScript
658 lines
30 KiB
JavaScript
const express = require('express');
|
||
const http = require('http');
|
||
const https = require('https');
|
||
const zlib = require('zlib');
|
||
const dns = require('dns');
|
||
const jwt = require('jsonwebtoken');
|
||
const cheerio = require('cheerio');
|
||
const db = require('../db');
|
||
const { authMiddleware, adminOnly, SECRET } = require('../middleware/auth');
|
||
const router = express.Router();
|
||
|
||
// ── SSRF 防护（保留既有逻辑）────────────────────────────────────────
|
||
function isBlockedHost(hostname) {
|
||
if (!hostname) return true;
|
||
let host = String(hostname).toLowerCase();
|
||
if (host.startsWith('[') && host.endsWith(']')) host = host.slice(1, -1);
|
||
const mapped = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
|
||
if (mapped) host = mapped[1];
|
||
if (host === 'localhost' || host === '127.0.0.1' || host === '::1'
|
||
|| host === '0' || host === '0.0.0.0' || host === '::') return true;
|
||
if (host.startsWith('10.')) return true;
|
||
if (host.startsWith('192.168.')) return true;
|
||
if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(host)) return true;
|
||
if (host.startsWith('169.254.')) return true;
|
||
if (host.startsWith('fc00:') || host.startsWith('fd00:')) return true;
|
||
if (host.startsWith('fe80:')) return true;
|
||
return false;
|
||
}
|
||
|
||
function lookupIpv4(hostname) {
|
||
return new Promise((resolve) => {
|
||
dns.lookup(hostname, { family: 4, all: true }, (err, addrs) => {
|
||
if (err) return resolve([]);
|
||
resolve((addrs || []).map(a => a.address));
|
||
});
|
||
});
|
||
}
|
||
|
||
function ipv4ToInt(ip) {
|
||
const parts = String(ip).split('.');
|
||
if (parts.length !== 4) return null;
|
||
let n = 0;
|
||
for (const p of parts) {
|
||
if (!/^\d{1,3}$/.test(p)) return null;
|
||
const v = parseInt(p, 10);
|
||
if (v > 255) return null;
|
||
n = (n << 8) + v;
|
||
}
|
||
return n >>> 0;
|
||
}
|
||
|
||
function ipv4CidrContains(cidr, host) {
|
||
const m = String(cidr).match(/^(\d{1,3}(?:\.\d{1,3}){3})\/(\d{1,2})$/);
|
||
if (!m) return null;
|
||
const net = ipv4ToInt(m[1]);
|
||
const hostInt = ipv4ToInt(host);
|
||
const prefix = parseInt(m[2], 10);
|
||
if (net === null || hostInt === null || prefix < 0 || prefix > 32) return null;
|
||
const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
|
||
return (net & mask) === (hostInt & mask);
|
||
}
|
||
|
||
function proxyAllowed(hostname) {
|
||
if (!hostname) return false;
|
||
let host = String(hostname).toLowerCase();
|
||
if (host.startsWith('[') && host.endsWith(']')) host = host.slice(1, -1);
|
||
const mapped = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
|
||
if (mapped) host = mapped[1];
|
||
const raw = (db.getSetting('proxy_allowed_hosts') || '').trim();
|
||
if (!raw) return false;
|
||
for (const entry of raw.split(/[,;\s]+/)) {
|
||
let e = entry.trim().toLowerCase();
|
||
if (!e) continue;
|
||
const lastColon = e.lastIndexOf(':');
|
||
if (lastColon > 0 && e.indexOf('.') !== -1 && !e.includes('/')) e = e.slice(0, lastColon);
|
||
if (e === host) return true;
|
||
if (e.includes('/') && ipv4CidrContains(e, host) === true) return true;
|
||
}
|
||
return false;
|
||
}
|
||
|
||
// SSRF 校验：返回 null=放行，否则为错误信息
|
||
async function ssrfCheck(hostname) {
|
||
if (isBlockedHost(hostname) && !proxyAllowed(hostname)) return '禁止访问内网地址';
|
||
const resolvedIps = await lookupIpv4(hostname);
|
||
if (resolvedIps.length > 0) {
|
||
const hitInternal = resolvedIps.some(ip => isBlockedHost(ip) && !proxyAllowed(ip));
|
||
if (hitInternal) return '禁止访问内网地址';
|
||
}
|
||
return null;
|
||
}
|
||
|
||
// ── 面板解析 ─────────────────────────────────────────────────────────
|
||
const RESERVED_SLUGS = new Set(['token', 'fetch']);
|
||
|
||
function getPanelBySlug(slug) {
|
||
return db.get('SELECT * FROM admin_links WHERE slug = ?', [String(slug || '').toLowerCase()]);
|
||
}
|
||
|
||
// 短 TTL 代理 token 认证 cookie 名（同源子资源鉴权用，Path=/proxy/{slug}/）
|
||
function authCookieName(slug) {
|
||
return 'rwp_' + String(slug).replace(/[^a-z0-9-]/g, '');
|
||
}
|
||
|
||
// 手动解析 Cookie 头（项目未用 cookie-parser，req.cookies 不存在）
|
||
function getCookie(req, name) {
|
||
const raw = req.headers.cookie || '';
|
||
for (const part of raw.split(';')) {
|
||
const idx = part.indexOf('=');
|
||
if (idx === -1) continue;
|
||
if (part.slice(0, idx).trim() === name) return part.slice(idx + 1).trim();
|
||
}
|
||
return undefined;
|
||
}
|
||
|
||
// 校验请求者是否为管理员：Authorization header → ?token= → rwp cookie 任一有效即可
|
||
function isAuthorized(req, slug) {
|
||
const token = req.headers.authorization && req.headers.authorization.startsWith('Bearer ')
|
||
? req.headers.authorization.slice(7)
|
||
: (req.query.token || getCookie(req, authCookieName(slug)));
|
||
if (!token) return false;
|
||
try {
|
||
const p = jwt.verify(token, SECRET);
|
||
if (!p || p.role !== 'admin') return false;
|
||
// 短代理 token（query/cookie）：带 slug 时须匹配当前面板；旧版无 slug 的 5 分钟 token 任意面板放行
|
||
if (p.proxy && p.slug && p.slug !== slug) return false;
|
||
return true;
|
||
} catch { return false; }
|
||
}
|
||
|
||
// 签发面板访问 cookie（同源子资源自动携带）
|
||
function setPanelCookie(res, slug) {
|
||
const token = jwt.sign({ id: 0, username: 'panel', role: 'admin', proxy: true, slug }, SECRET, { expiresIn: '12h' });
|
||
const cookie = `${authCookieName(slug)}=${token}; Path=/proxy/${slug}/; HttpOnly; SameSite=Lax; Max-Age=43200`;
|
||
const setCookieHeader = res.getHeader('Set-Cookie');
|
||
if (setCookieHeader) {
|
||
const arr = Array.isArray(setCookieHeader) ? setCookieHeader : [String(setCookieHeader)];
|
||
arr.push(cookie);
|
||
res.setHeader('Set-Cookie', arr);
|
||
} else {
|
||
res.setHeader('Set-Cookie', cookie);
|
||
}
|
||
}
|
||
|
||
// ── URL 改写 ─────────────────────────────────────────────────────────
|
||
// 根相对路径 /xxx → basePath + xxx；同 host 绝对 URL → basePath + path；其余原样
|
||
function rewriteUrl(value, basePath, originHost) {
|
||
const v = String(value || '').trim();
|
||
if (!v) return v;
|
||
if (/^(data:|javascript:|blob:|mailto:|tel:|about:)/i.test(v)) return v;
|
||
if (v.startsWith('//')) return v; // 协议相对外部资源：保持原样（base 下仍解析到外部 host）
|
||
if (v.startsWith('/proxy/')) return v; // 已是代理路径
|
||
if (v.startsWith('/')) return basePath + v.slice(1);
|
||
if (/^https?:\/\//i.test(v)) {
|
||
try {
|
||
const u = new URL(v);
|
||
if (u.hostname === originHost) return basePath + u.pathname + u.search + u.hash;
|
||
return v;
|
||
} catch { return v; }
|
||
}
|
||
return v; // 相对路径：<base> 已处理
|
||
}
|
||
|
||
// srcset 逗号分隔项改写
|
||
function rewriteSrcset(value, basePath, originHost) {
|
||
return String(value || '').split(',').map((part) => {
|
||
const trimmed = part.trim();
|
||
if (!trimmed) return part;
|
||
const m = trimmed.match(/^(\S+)(\s+.*)?$/);
|
||
if (!m) return part;
|
||
return rewriteUrl(m[1], basePath, originHost) + (m[2] || '');
|
||
}).join(', ');
|
||
}
|
||
|
||
// ── 运行时 shim（Layer 2 客户端注入）────────────────────────────────
|
||
// 在目标 JS 前执行：patch fetch/XHR/WS/EventSource/元素属性 setter/history/存储隔离
|
||
function shimScript(slug, basePath) {
|
||
return `<script>/* RainWeb 面板代理 shim */
|
||
(function(){
|
||
var P=${JSON.stringify(basePath)};
|
||
var SLUG=${JSON.stringify(slug)};
|
||
// 恢复前缀：根相对/同 host 绝对 → 加 /proxy/{slug}/ 前缀
|
||
function rP(u){
|
||
if(typeof u!=='string'||!u) return u;
|
||
if(u.charAt(0)==='/'&&u.charAt(1)!=='/') return P+u.slice(1);
|
||
if(/^https?:\/\//i.test(u)){ try{var a=new URL(u);if(a.host===location.host)return P+a.pathname+a.search+a.hash;}catch(e){} }
|
||
return u;
|
||
}
|
||
function rWs(u){
|
||
if(typeof u!=='string'||!u) return u;
|
||
var proto=(location.protocol==='https:')?'wss://':'ws://';
|
||
if(u.charAt(0)==='/') return proto+location.host+P+u.slice(1);
|
||
if(/^wss?:/i.test(u)){ try{var a=new URL(u.replace(/^ws/i,'http'));if(a.host===location.host)return proto+location.host+P+a.pathname+a.search;}catch(e){} }
|
||
if(/^https?:\/\//i.test(u)){ try{var b=new URL(u);if(b.host===location.host)return proto+location.host+P+b.pathname+b.search;}catch(e){} }
|
||
return u;
|
||
}
|
||
// document.baseURI 指向代理前缀
|
||
try{Object.defineProperty(document,'baseURI',{configurable:true,get:function(){return location.origin+P;}});}catch(e){}
|
||
// fetch
|
||
if(window.fetch){
|
||
var of=window.fetch;
|
||
window.fetch=function(input,init){
|
||
if(typeof input==='string'){input=rP(input);}
|
||
else if(input&&input.url){input=new Request(rP(input.url),input);}
|
||
return of(input,init);
|
||
};
|
||
}
|
||
// XHR
|
||
var _ox=XMLHttpRequest.prototype.open;
|
||
XMLHttpRequest.prototype.open=function(method,url){return _ox.apply(this,arguments.length>1?[method,rP(url)]:arguments);};
|
||
// sendBeacon
|
||
if(navigator.sendBeacon){var _sb=navigator.sendBeacon.bind(navigator);navigator.sendBeacon=function(url,data){return _sb(rP(url),data);};}
|
||
// WebSocket
|
||
var _WS=window.WebSocket;
|
||
window.WebSocket=function(url,protocols){return protocols?new _WS(rWs(url),protocols):new _WS(rWs(url));};
|
||
window.WebSocket.prototype=_WS.prototype;
|
||
window.WebSocket.CONNECTING=0;window.WebSocket.OPEN=1;window.WebSocket.CLOSING=2;window.WebSocket.CLOSED=3;
|
||
// EventSource
|
||
if(window.EventSource){var _ES=window.EventSource;window.EventSource=function(url,c){return c?new _ES(rWs(url),c):new _ES(rWs(url));};window.EventSource.prototype=_ES.prototype;}
|
||
// 元素属性 setter 同步改写
|
||
function patch(proto,prop){
|
||
var d=Object.getOwnPropertyDescriptor(proto,prop);
|
||
if(!d||!d.set)return;
|
||
Object.defineProperty(proto,prop,{configurable:true,get:function(){return d.get.call(this);},set:function(v){if(typeof v==='string')v=rP(v);d.set.call(this,v);}});
|
||
}
|
||
if(HTMLImageElement)patch(HTMLImageElement.prototype,'src');
|
||
if(HTMLScriptElement)patch(HTMLScriptElement.prototype,'src');
|
||
if(HTMLLinkElement)patch(HTMLLinkElement.prototype,'href');
|
||
if(HTMLAnchorElement)patch(HTMLAnchorElement.prototype,'href');
|
||
if(HTMLFormElement)patch(HTMLFormElement.prototype,'action');
|
||
if(HTMLIFrameElement)patch(HTMLIFrameElement.prototype,'src');
|
||
if(HTMLVideoElement)patch(HTMLVideoElement.prototype,'src');
|
||
if(HTMLAudioElement)patch(HTMLAudioElement.prototype,'src');
|
||
if(HTMLSourceElement)patch(HTMLSourceElement.prototype,'src');
|
||
if(HTMLEmbedElement)patch(HTMLEmbedElement.prototype,'src');
|
||
if(HTMLObjectElement)patch(HTMLObjectElement.prototype,'data');
|
||
// history：写入干净路径时自动加回前缀；location.pathname 读取时去前缀
|
||
var _hs=history.pushState,_rs=history.replaceState;
|
||
function cleanPath(p){p=p||'';if(p.indexOf(P)===0)return p.slice(P.length-1);return p;}
|
||
history.pushState=function(s,t,u){return _hs.call(this,s,t,u?P+String(u).replace(/^\\/,'').replace(/^\//,''):u);};
|
||
history.replaceState=function(s,t,u){return _rs.call(this,s,t,u?P+String(u).replace(/^\\/,'').replace(/^\//,''):u);};
|
||
try{var _pl=Object.getOwnPropertyDescriptor(Location.prototype,'pathname');
|
||
Object.defineProperty(Location.prototype,'pathname',{configurable:true,get:function(){var v=_pl.get.call(this);return cleanPath(v);},set:function(v){_pl.set.call(this,v.indexOf(P)===0?v:P+String(v).replace(/^\\/,'').replace(/^\//,''));}});
|
||
}catch(e){}
|
||
// 存储命名空间隔离（按 slug）
|
||
function nsStore(st){
|
||
var prefix=SLUG+':';
|
||
var g=st.getItem.bind(st),s=st.setItem.bind(st),r=st.removeItem.bind(st),c=st.clear.bind(st),k=st.key.bind(st),gl=st.length;
|
||
st.getItem=function(n){return g(prefix+n);};
|
||
st.setItem=function(n,v){return s(prefix+n,v);};
|
||
st.removeItem=function(n){return r(prefix+n);};
|
||
st.clear=function(){var keys=[];for(var i=0;i<gl;i++){var kk=k(i);if(kk&&kk.indexOf(prefix)===0)keys.push(kk);}keys.forEach(function(x){r(x);});};
|
||
st.key=function(i){return k(i);};
|
||
}
|
||
try{if(window.localStorage)nsStore(window.localStorage);}catch(e){}
|
||
try{if(window.sessionStorage)nsStore(window.sessionStorage);}catch(e){}
|
||
// serviceWorker 禁用
|
||
if(navigator.serviceWorker&&navigator.serviceWorker.register){navigator.serviceWorker.register=function(){return Promise.resolve({});};}
|
||
// parent/top 隔离到自身
|
||
try{Object.defineProperty(window,'parent',{configurable:true,get:function(){return window;}});}catch(e){}
|
||
try{Object.defineProperty(window,'top',{configurable:true,get:function(){return window;}});}catch(e){}
|
||
// MutationObserver 兜底：动态插入元素的属性改写
|
||
try{
|
||
function fixNode(n){
|
||
if(!n||n.nodeType!==1)return;
|
||
var attrs=['src','href','action','poster','data-src','data-href'];
|
||
for(var i=0;i<attrs.length;i++){var a=attrs[i];if(n.hasAttribute&&n.hasAttribute(a)){n.setAttribute(a,rP(n.getAttribute(a)));}}
|
||
if(n.tagName==='IMG'&&n.src)try{n.src=rP(n.src);}catch(e){}
|
||
if(n.tagName==='SCRIPT'&&n.src)try{n.src=rP(n.src);}catch(e){}
|
||
}
|
||
var _mo=window.MutationObserver;
|
||
if(_mo){var mo=new _mo(function(muts){muts.forEach(function(mu){if(mu.type==='childList'){mu.addedNodes.forEach(fixNode);}});});mo.observe(document.documentElement,{childList:true,subtree:true});}
|
||
}catch(e){}
|
||
})();
|
||
</script>`;
|
||
}
|
||
|
||
// ── HTML 改写（Layer 1，cheerio 静态）──────────────────────────────
|
||
function rewriteHtml(html, basePath, originHost, slug) {
|
||
try {
|
||
const $ = cheerio.load(html);
|
||
// <base> 指向代理前缀（带尾斜杠）
|
||
if ($('base').length) { $('base').attr('href', basePath); }
|
||
else { $('head').prepend('<base href="' + basePath + '">'); }
|
||
|
||
// 改写根相对/同 host 属性
|
||
$('a,link,script,img,iframe,form,video,audio,source,embed,object').each((i, el) => {
|
||
const $el = $(el);
|
||
const tag = el.tagName;
|
||
if (tag === 'a' || tag === 'link') { if ($el.attr('href')) $el.attr('href', rewriteUrl($el.attr('href'), basePath, originHost)); }
|
||
if (['script', 'img', 'iframe', 'video', 'audio', 'source', 'embed'].includes(tag)) { if ($el.attr('src')) $el.attr('src', rewriteUrl($el.attr('src'), basePath, originHost)); }
|
||
if (tag === 'form') { if ($el.attr('action')) $el.attr('action', rewriteUrl($el.attr('action'), basePath, originHost)); }
|
||
if (tag === 'object') { if ($el.attr('data')) $el.attr('data', rewriteUrl($el.attr('data'), basePath, originHost)); }
|
||
if ($el.attr('poster')) $el.attr('poster', rewriteUrl($el.attr('poster'), basePath, originHost));
|
||
if ($el.attr('srcset')) $el.attr('srcset', rewriteSrcset($el.attr('srcset'), basePath, originHost));
|
||
if ($el.attr('data-src')) $el.attr('data-src', rewriteUrl($el.attr('data-src'), basePath, originHost));
|
||
if ($el.attr('data-href')) $el.attr('data-href', rewriteUrl($el.attr('data-href'), basePath, originHost));
|
||
});
|
||
// meta[content]（og 等 URL 型）
|
||
$('meta[content]').each((i, el) => {
|
||
const $el = $(el);
|
||
const prop = String($el.attr('property') || $el.attr('name') || '').toLowerCase();
|
||
if (prop.includes('image') || prop.includes('url') || prop.includes('og:')) {
|
||
$el.attr('content', rewriteUrl($el.attr('content'), basePath, originHost));
|
||
}
|
||
});
|
||
// 剥 SRI integrity / crossorigin（同源代理下无意义且可能失败）
|
||
$('[integrity]').removeAttr('integrity');
|
||
$('[crossorigin]').removeAttr('crossorigin');
|
||
// 剥 CSP/XFO meta
|
||
$('meta[http-equiv]').each((i, el) => {
|
||
const he = String($(el).attr('http-equiv') || '').toLowerCase();
|
||
if (he === 'content-security-policy' || he === 'x-frame-options' || he === 'content-script-type') $(el).remove();
|
||
});
|
||
// 注入 shim（head 最前，早于目标脚本执行）
|
||
$('head').prepend(shimScript(slug, basePath));
|
||
return $.html();
|
||
} catch (e) {
|
||
console.error('Proxy HTML rewrite error:', e.message);
|
||
// 改写失败：至少注入 base + shim（降级）
|
||
return html.replace('<head>', `<head><base href="${basePath}">` + shimScript(slug, basePath)) || html;
|
||
}
|
||
}
|
||
|
||
// ── 响应头处理（Layer 3）────────────────────────────────────────────
|
||
const HOP_BY_HOP = ['connection', 'keep-alive', 'transfer-encoding', 'te', 'trailer', 'upgrade', 'proxy-authenticate', 'proxy-authorization'];
|
||
|
||
function rewriteCookie(cookie, basePath, isHttps) {
|
||
return String(cookie).split(';').map((part, i) => {
|
||
const p = part.trim();
|
||
if (i === 0) return p; // name=value
|
||
const l = p.toLowerCase();
|
||
if (l.startsWith('path=')) return 'Path=' + basePath;
|
||
if (l.startsWith('domain=')) return ''; // 去 Domain
|
||
if (l === 'secure' && !isHttps) return ''; // http 下剥 Secure
|
||
if (l.startsWith('samesite')) return 'SameSite=Lax';
|
||
return p;
|
||
}).filter(Boolean).join('; ');
|
||
}
|
||
|
||
function rewriteLocationHeader(value, basePath, originHost) {
|
||
const v = String(value || '');
|
||
if (v.startsWith('/proxy/')) return v;
|
||
if (v.startsWith('/')) return basePath + v.slice(1);
|
||
if (/^https?:\/\//i.test(v)) {
|
||
try {
|
||
const u = new URL(v);
|
||
if (u.hostname === originHost) return basePath + u.pathname + u.search;
|
||
} catch {}
|
||
}
|
||
return v;
|
||
}
|
||
|
||
// ── 解压响应流（支持 gzip/deflate/br）──────────────────────────────
|
||
function decodeStream(stream, encoding) {
|
||
const enc = String(encoding || '').toLowerCase();
|
||
if (enc === 'gzip' || enc === 'x-gzip') return stream.pipe(zlib.createGunzip());
|
||
if (enc === 'deflate') return stream.pipe(zlib.createInflate());
|
||
if (enc === 'br') return stream.pipe(zlib.createBrotliDecompress());
|
||
return stream;
|
||
}
|
||
|
||
// ── HTTP 代理（全方法 + body 透传）──────────────────────────────────
|
||
function proxyHttp(slug, reqPath, query, req, res, panel) {
|
||
let base;
|
||
try { base = new URL(panel.url); } catch { return sendError(res, '面板 URL 无效'); }
|
||
const basePath = '/proxy/' + slug + '/';
|
||
const client = base.protocol === 'https:' ? https : http;
|
||
const targetPath = base.pathname.replace(/\/+$/, '') + reqPath + (query ? '?' + query : '');
|
||
|
||
// 转发头：剥 hop-by-hop，host 重写为目标，合并 proxy_headers
|
||
const headers = {};
|
||
for (const [k, v] of Object.entries(req.headers)) {
|
||
const lk = k.toLowerCase();
|
||
if (HOP_BY_HOP.includes(lk) || lk === 'host' || lk.startsWith('rwp_') || lk === 'content-length') continue;
|
||
if (lk === 'cookie') {
|
||
// 只透传非面板鉴权 cookie（剥 rwp_*）
|
||
const kept = String(v).split(';').map(c => c.trim()).filter(c => !/^rwp_/i.test(c)).join('; ');
|
||
if (kept) headers[k] = kept;
|
||
continue;
|
||
}
|
||
headers[k] = v;
|
||
}
|
||
headers.host = base.host;
|
||
// 自定义转发头（proxy_headers JSON）
|
||
try {
|
||
const ph = JSON.parse(panel.proxy_headers || '{}');
|
||
if (ph && typeof ph === 'object') {
|
||
for (const [k, v] of Object.entries(ph)) {
|
||
if (!/^content-length$/i.test(k) && !HOP_BY_HOP.includes(k.toLowerCase())) headers[k] = String(v);
|
||
}
|
||
}
|
||
} catch {}
|
||
|
||
const upReq = client.request({
|
||
hostname: base.hostname,
|
||
port: base.port || (base.protocol === 'https:' ? 443 : 80),
|
||
path: targetPath,
|
||
method: req.method,
|
||
headers,
|
||
timeout: 20000,
|
||
family: 4,
|
||
// proxy_skip_tls_verify=1 时跳过 TLS 校验（内网自签面板）；默认校验（公网面板）
|
||
rejectUnauthorized: Number(panel.proxy_skip_tls_verify) ? false : true,
|
||
}, (upRes) => {
|
||
// 响应头：剥 XFO/CSP/Permissions-Policy，改写 Cookie/Location
|
||
const out = {};
|
||
const isHttps = req.secure || req.protocol === 'https';
|
||
for (const [k, v] of Object.entries(upRes.headers)) {
|
||
const lk = k.toLowerCase();
|
||
if (['x-frame-options', 'content-security-policy', 'permissions-policy'].includes(lk)) continue;
|
||
if (lk === 'set-cookie') { out[k] = (Array.isArray(v) ? v : [v]).map(c => rewriteCookie(c, basePath, isHttps)); continue; }
|
||
if (lk === 'location' || lk === 'refresh') { out[k] = rewriteLocationHeader(v, basePath, base.hostname); continue; }
|
||
if (HOP_BY_HOP.includes(lk)) continue;
|
||
if (lk === 'content-length' || lk === 'content-encoding') continue; // 统一转码后重算
|
||
out[k] = v;
|
||
}
|
||
out['Referrer-Policy'] = 'no-referrer';
|
||
out['X-Content-Type-Options'] = 'nosniff';
|
||
|
||
const ctype = (upRes.headers['content-type'] || '').toLowerCase();
|
||
const status = upRes.statusCode || 200;
|
||
|
||
// HTML：解压 → 改写 → 按 identity 发送
|
||
if (ctype.includes('text/html') && (status >= 200 && status < 300)) {
|
||
const chunks = [];
|
||
const dec = decodeStream(upRes, upRes.headers['content-encoding']);
|
||
dec.on('data', c => chunks.push(c));
|
||
dec.on('end', () => {
|
||
try {
|
||
let html = Buffer.concat(chunks).toString('utf8');
|
||
html = rewriteHtml(html, basePath, base.hostname, slug);
|
||
setPanelCookie(res, slug); // 首次加载即下发面板 cookie，子资源同源自动携带
|
||
const buf = Buffer.from(html, 'utf8');
|
||
out['Content-Type'] = 'text/html; charset=utf-8';
|
||
out['Content-Length'] = buf.length;
|
||
res.writeHead(status, out);
|
||
res.end(buf);
|
||
} catch (e) {
|
||
console.error('Proxy HTML process error:', e.message);
|
||
sendError(res, '代理响应处理失败: ' + e.message);
|
||
}
|
||
});
|
||
dec.on('error', (e) => { console.error('Proxy decode error:', e.message); sendError(res, '代理响应解码失败'); });
|
||
return;
|
||
}
|
||
|
||
// 非 HTML：原样透传（保留 content-encoding/content-length）
|
||
if (upRes.headers['content-length']) out['Content-Length'] = upRes.headers['content-length'];
|
||
if (upRes.headers['content-encoding']) out['Content-Encoding'] = upRes.headers['content-encoding'];
|
||
res.writeHead(status, out);
|
||
upRes.pipe(res);
|
||
});
|
||
|
||
upReq.on('timeout', () => { upReq.destroy(); sendError(res, '代理请求超时（20秒）'); });
|
||
upReq.on('error', (e) => { sendError(res, '代理请求失败: ' + e.message); });
|
||
// body 透传（POST/PUT/PATCH）：application/json 已被 express.json 消费 → 重新序列化发送；
|
||
// 其余 content-type（form/multipart/raw）请求流完整 → 直接 pipe
|
||
const isJsonBody = /^application\/json/i.test(String(req.headers['content-type'] || ''));
|
||
if (isJsonBody && req.body !== undefined) {
|
||
const body = JSON.stringify(req.body);
|
||
upReq.setHeader('Content-Length', Buffer.byteLength(body));
|
||
upReq.end(body);
|
||
} else {
|
||
req.pipe(upReq);
|
||
}
|
||
}
|
||
|
||
// ── WebSocket 代理（upgrade 事件用）────────────────────────────────
|
||
// 返回 true=已接管；false=不处理（调用方销毁 socket）
|
||
function proxyWsUpgrade(slug, reqPath, query, request, socket, head) {
|
||
const panel = getPanelBySlug(slug);
|
||
if (!panel || !panel.url) return false;
|
||
let base;
|
||
try { base = new URL(panel.url); } catch { return false; }
|
||
// SSRF 校验
|
||
if (isBlockedHost(base.hostname) && !proxyAllowed(base.hostname)) return false;
|
||
const client = base.protocol === 'https:' ? https : http;
|
||
const wsPath = base.pathname.replace(/\/+$/, '') + reqPath + (query ? '?' + query : '');
|
||
const headers = {};
|
||
for (const h of ['upgrade', 'connection', 'sec-websocket-key', 'sec-websocket-version', 'sec-websocket-protocol', 'sec-websocket-extensions']) {
|
||
if (request.headers[h]) headers[h] = request.headers[h];
|
||
}
|
||
headers.host = base.host;
|
||
headers.origin = base.protocol + '//' + base.host;
|
||
|
||
const upReq = client.request({
|
||
hostname: base.hostname,
|
||
port: base.port || (base.protocol === 'https:' ? 443 : 80),
|
||
path: wsPath,
|
||
method: 'GET',
|
||
headers,
|
||
family: 4,
|
||
rejectUnauthorized: false,
|
||
});
|
||
upReq.on('upgrade', (upRes, upSocket, upHead) => {
|
||
// 转发 101 头：Connection/Upgrade 必须保留（Node 客户端据此识别 upgrade），
|
||
// 仅剥 transfer-encoding/keep-alive 等无关 hop-by-hop
|
||
let respHead = 'HTTP/1.1 101 Switching Protocols\r\n';
|
||
const skip101 = ['transfer-encoding', 'keep-alive', 'te', 'trailer', 'proxy-authenticate', 'proxy-authorization'];
|
||
for (const [k, v] of Object.entries(upRes.headers)) {
|
||
if (skip101.includes(k.toLowerCase())) continue;
|
||
const val = Array.isArray(v) ? v.join(', ') : v;
|
||
respHead += k + ': ' + val + '\r\n';
|
||
}
|
||
respHead += '\r\n';
|
||
try {
|
||
socket.write(respHead);
|
||
if (upHead && upHead.length) socket.write(upHead);
|
||
upSocket.pipe(socket);
|
||
socket.pipe(upSocket);
|
||
socket.on('error', () => { try { upSocket.destroy(); } catch {} });
|
||
upSocket.on('error', () => { try { socket.destroy(); } catch {} });
|
||
} catch (e) {
|
||
console.error('WS proxy pipe error:', e.message);
|
||
try { upSocket.destroy(); } catch {}
|
||
try { socket.destroy(); } catch {}
|
||
}
|
||
});
|
||
upReq.on('error', (e) => { console.error('WS proxy error:', e.message); socket.destroy(); });
|
||
upReq.on('timeout', () => { upReq.destroy(); socket.destroy(); });
|
||
upReq.end();
|
||
return true;
|
||
}
|
||
|
||
// 供 server.js upgrade 事件调用：解析 /proxy/:slug/ 前缀的 WS 请求
|
||
function handleProxyUpgrade(request, socket, head) {
|
||
try {
|
||
const u = new URL(request.url, 'http://x');
|
||
const m = u.pathname.match(/^\/proxy\/([^/]+)\/?(.*)$/);
|
||
if (!m) return false;
|
||
const slug = m[1];
|
||
const reqPath = m[2] ? '/' + m[2] : '/';
|
||
return proxyWsUpgrade(slug, reqPath, u.search ? u.search.slice(1) : '', request, socket, head);
|
||
} catch { return false; }
|
||
}
|
||
|
||
function sendError(res, msg) {
|
||
console.error('Proxy error:', msg);
|
||
const html = `<!DOCTYPE html><html><head><meta charset="utf-8"><style>
|
||
body{font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5;color:#333}
|
||
.box{max-width:480px;padding:32px;text-align:center;background:#fff;border-radius:16px;box-shadow:0 4px 24px rgba(0,0,0,0.08)}
|
||
h2{color:#d32f2f;margin:0 0 8px;font-size:20px}
|
||
p{color:#666;font-size:14px;line-height:1.6;margin:0}
|
||
code{display:block;font-size:13px;background:#f5f5f5;padding:8px 12px;border-radius:8px;margin-top:12px;word-break:break-all}
|
||
</style></head><body><div class="box"><h2>⚠️ 代理加载失败</h2><p>${msg}</p></div></body></html>`;
|
||
if (res && !res.headersSent) res.status(502).send(html);
|
||
}
|
||
|
||
// ── 路由 ─────────────────────────────────────────────────────────────
|
||
|
||
// 兼容 iframe/直链的 query token 认证（旧 /fetch 用）
|
||
function queryTokenAuth(req, res, next) {
|
||
if (req.query.token) req.headers.authorization = 'Bearer ' + req.query.token;
|
||
next();
|
||
}
|
||
|
||
// 短 TTL 代理 token（保留）
|
||
router.get('/token', authMiddleware, adminOnly, (req, res) => {
|
||
const token = jwt.sign(
|
||
{ id: req.user.id, username: req.user.username, role: req.user.role, proxy: true },
|
||
SECRET,
|
||
{ expiresIn: '5m' }
|
||
);
|
||
res.json({ token });
|
||
});
|
||
|
||
// 旧版单 URL 透传（保留兼容）
|
||
router.get('/fetch', queryTokenAuth, authMiddleware, adminOnly, async (req, res) => {
|
||
if (!req.query.url) return res.status(400).json({ error: '缺少 url 参数' });
|
||
let url;
|
||
try { url = new URL(req.query.url); } catch { return res.status(400).json({ error: '无效的 URL' }); }
|
||
const err = await ssrfCheck(url.hostname);
|
||
if (err) return res.status(403).json({ error: err });
|
||
proxyLegacyFetch(url, res, '/proxy/legacy/');
|
||
});
|
||
|
||
// 旧 /fetch 的底层实现（保留原行为：HTML 注入 <base> + shim + 剥头）
|
||
function proxyLegacyFetch(url, res, basePath) {
|
||
const client = url.protocol === 'https:' ? https : http;
|
||
const req = client.get({
|
||
hostname: url.hostname,
|
||
port: url.port || (url.protocol === 'https:' ? 443 : 80),
|
||
path: url.pathname + url.search,
|
||
timeout: 15000,
|
||
family: 4,
|
||
headers: { 'User-Agent': 'Mozilla/5.0', 'Accept': '*/*' },
|
||
rejectUnauthorized: false,
|
||
}, (upRes) => {
|
||
const headers = { ...upRes.headers };
|
||
delete headers['x-frame-options'];
|
||
delete headers['content-security-policy'];
|
||
headers['Referrer-Policy'] = 'no-referrer';
|
||
headers['X-Content-Type-Options'] = 'nosniff';
|
||
const ctype = (headers['content-type'] || '').toLowerCase();
|
||
if (ctype.includes('text/html')) {
|
||
const chunks = [];
|
||
upRes.on('data', c => chunks.push(c));
|
||
upRes.on('end', () => {
|
||
const origin = url.hostname;
|
||
let html = Buffer.concat(chunks).toString('utf8');
|
||
html = rewriteHtml(html, basePath, origin, 'legacy');
|
||
const buf = Buffer.from(html, 'utf8');
|
||
headers['Content-Length'] = buf.length;
|
||
headers['Content-Type'] = 'text/html; charset=utf-8';
|
||
res.writeHead(upRes.statusCode || 200, headers);
|
||
res.end(buf);
|
||
});
|
||
} else {
|
||
res.writeHead(upRes.statusCode || 200, headers);
|
||
upRes.pipe(res);
|
||
}
|
||
});
|
||
req.on('error', e => sendError(res, '代理请求失败: ' + e.message));
|
||
req.on('timeout', () => { req.destroy(); sendError(res, '代理请求超时'); });
|
||
}
|
||
|
||
// ── /proxy/:slug 前缀代理（核心）──────────────────────────────────
|
||
// 挂载于 server.js 的 app.use('/proxy', proxyRoutes)（在 express.json 之前，保证 body 流完整）
|
||
|
||
// 解析 slug 与鉴权的公共处理器
|
||
function prefixAuth(req, res, next) {
|
||
const slug = req.params.slug;
|
||
if (!slug || RESERVED_SLUGS.has(slug)) return sendError(res, '面板不存在');
|
||
const panel = getPanelBySlug(slug);
|
||
if (!panel) return sendError(res, '面板不存在');
|
||
if (!isAuthorized(req, slug)) return res.status(403).json({ error: '未授权' });
|
||
req.panel = panel;
|
||
req.proxySlug = slug;
|
||
next();
|
||
}
|
||
|
||
// 面板内网/SSRF 校验（异步）
|
||
async function prefixCheck(req, res, next) {
|
||
try {
|
||
const base = new URL(req.panel.url);
|
||
const err = await ssrfCheck(base.hostname);
|
||
if (err) return res.status(403).json({ error: err });
|
||
next();
|
||
} catch { return sendError(res, '面板 URL 无效'); }
|
||
}
|
||
|
||
function prefixProxy(req, res) {
|
||
const slug = req.proxySlug;
|
||
const basePath = '/proxy/' + slug + '/';
|
||
// 去掉 /proxy/{slug} 前缀后的目标路径
|
||
const m = String(req.path).match(/^\/[^/]+(?:\/(.*))?$/);
|
||
const reqPath = m && m[1] ? '/' + m[1] : '/';
|
||
const query = req.url.indexOf('?') !== -1 ? req.url.slice(req.url.indexOf('?') + 1) : '';
|
||
proxyHttp(slug, reqPath, query, req, res, req.panel);
|
||
}
|
||
|
||
router.all('/:slug', prefixAuth, prefixCheck, prefixProxy);
|
||
router.all('/:slug/*', prefixAuth, prefixCheck, prefixProxy);
|
||
|
||
module.exports = router;
|
||
module.exports.handleProxyUpgrade = handleProxyUpgrade;
|