shishengliang/lingniu-vehicle-ingest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(web): sanitize runtime map config

Browse Source
This commit is contained in:
lingniu
2026-07-16 03:15:25 +08:00
parent 4be4aaf265
commit 01150844df
7 changed files with 48 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
vehicle-data-platform/deploy/verify-web-release.sh
View File

@@ -56,6 +56,10 @@ fetch_exact / "$WEB_ROOT/index.html" 'root document'
config_status=$(curl --silent --show-error --max-time "$CURL_TIMEOUT_SEC" --output "$response_file" --write-out '%{http_code}' "$BASE_URL/app-config.js" || true)
test "$config_status" = 200 || fail "app config returned HTTP ${config_status:-000}"
grep -q 'window\.__LINGNIU_APP_CONFIG__' "$response_file" || fail 'app config response does not expose the runtime configuration object'
if grep -q '"amapSecurityJsCode"' "$response_file"; then
fail 'app config response exposes the server-side AMap security code'
fi
grep -q '"amapSecurityServiceHost":"/_AMapService"' "$response_file" || fail 'app config response does not enable the server-side AMap proxy'
current_count=$(verify_manifest "$CURRENT_MANIFEST" current)
compatibility_count=0

17
vehicle-data-platform/deploy/verify-web-release.test.sh
View File

@@ -16,7 +16,7 @@ trap cleanup EXIT
mkdir -p "$fixture/web/assets"
printf '<!doctype html><div id="root"></div><script src="/assets/new.js"></script>\n' > "$fixture/web/index.html"
printf 'window.__LINGNIU_APP_CONFIG__ = {};\n' > "$fixture/web/app-config.js"
printf 'window.__LINGNIU_APP_CONFIG__={"amapSecurityServiceHost":"/_AMapService"};\n' > "$fixture/web/app-config.js"
printf 'console.log("new");\n' > "$fixture/web/assets/new.js"
printf 'console.log("old");\n' > "$fixture/web/assets/old.js"
printf 'new.js\n' > "$fixture/web/.release-assets"
@@ -48,6 +48,21 @@ fi
success_output=$("$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets")
test "$success_output" = 'web_release_smoke=ok current_assets=1 compatibility_assets=1'
printf 'window.__LINGNIU_APP_CONFIG__={"amapSecurityJsCode":"must-not-ship"};\n' > "$fixture/served/app-config.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/exposed-config.out" 2>&1; then
printf 'expected an exposed AMap security code to fail\n' >&2
exit 1
fi
grep -q 'exposes the server-side AMap security code' "$fixture/exposed-config.out"
printf 'window.__LINGNIU_APP_CONFIG__={};\n' > "$fixture/served/app-config.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/missing-proxy.out" 2>&1; then
printf 'expected a missing AMap security proxy to fail\n' >&2
exit 1
fi
grep -q 'does not enable the server-side AMap proxy' "$fixture/missing-proxy.out"
cp "$fixture/web/app-config.js" "$fixture/served/app-config.js"
rm "$fixture/web/assets/old.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/missing.out" 2>&1; then
printf 'expected a missing compatibility asset to fail\n' >&2