shishengliang/lingniu-vehicle-ingest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(web): sanitize runtime map config

Browse Source
This commit is contained in:
lingniu
2026-07-16 03:15:25 +08:00
parent 4be4aaf265
commit 01150844df
7 changed files with 48 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
vehicle-data-platform/deploy/verify-web-release.test.sh
View File

@@ -16,7 +16,7 @@ trap cleanup EXIT
mkdir -p "$fixture/web/assets"
printf '<!doctype html><div id="root"></div><script src="/assets/new.js"></script>\n' > "$fixture/web/index.html"
printf 'window.__LINGNIU_APP_CONFIG__ = {};\n' > "$fixture/web/app-config.js"
printf 'window.__LINGNIU_APP_CONFIG__={"amapSecurityServiceHost":"/_AMapService"};\n' > "$fixture/web/app-config.js"
printf 'console.log("new");\n' > "$fixture/web/assets/new.js"
printf 'console.log("old");\n' > "$fixture/web/assets/old.js"
printf 'new.js\n' > "$fixture/web/.release-assets"
@@ -48,6 +48,21 @@ fi
success_output=$("$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets")
test "$success_output" = 'web_release_smoke=ok current_assets=1 compatibility_assets=1'
printf 'window.__LINGNIU_APP_CONFIG__={"amapSecurityJsCode":"must-not-ship"};\n' > "$fixture/served/app-config.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/exposed-config.out" 2>&1; then
printf 'expected an exposed AMap security code to fail\n' >&2
exit 1
fi
grep -q 'exposes the server-side AMap security code' "$fixture/exposed-config.out"
printf 'window.__LINGNIU_APP_CONFIG__={};\n' > "$fixture/served/app-config.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/missing-proxy.out" 2>&1; then
printf 'expected a missing AMap security proxy to fail\n' >&2
exit 1
fi
grep -q 'does not enable the server-side AMap proxy' "$fixture/missing-proxy.out"
cp "$fixture/web/app-config.js" "$fixture/served/app-config.js"
rm "$fixture/web/assets/old.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/missing.out" 2>&1; then
printf 'expected a missing compatibility asset to fail\n' >&2