shishengliang/lingniu-vehicle-ingest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(web): sanitize runtime map config

Browse Source
This commit is contained in:
lingniu
2026-07-16 03:15:25 +08:00
parent 4be4aaf265
commit 01150844df
7 changed files with 48 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
vehicle-data-platform/deploy/verify-web-release.sh
View File

@@ -56,6 +56,10 @@ fetch_exact / "$WEB_ROOT/index.html" 'root document'
config_status=$(curl --silent --show-error --max-time "$CURL_TIMEOUT_SEC" --output "$response_file" --write-out '%{http_code}' "$BASE_URL/app-config.js" || true)
test "$config_status" = 200 || fail "app config returned HTTP ${config_status:-000}"
grep -q 'window\.__LINGNIU_APP_CONFIG__' "$response_file" || fail 'app config response does not expose the runtime configuration object'
if grep -q '"amapSecurityJsCode"' "$response_file"; then
fail 'app config response exposes the server-side AMap security code'
fi
grep -q '"amapSecurityServiceHost":"/_AMapService"' "$response_file" || fail 'app config response does not enable the server-side AMap proxy'
current_count=$(verify_manifest "$CURRENT_MANIFEST" current)
compatibility_count=0