增强安全性

internal/const/const.go

@@ -13,4 +13,6 @@ const (
 	EncryptMethod = "aes-256-cfb"
 
 	ErrServer = "服务器出了点小问题，请联系技术人员处理。"
+
+	EnabledFrame = false // 是否允许被嵌入到别的网站中 TODO 做成可配置
 )

internal/nodes/admin_node.go

@@ -13,6 +13,7 @@ import (
 	"os/exec"
 	"os/signal"
 	"syscall"
+	"time"
 )
 
 type AdminNode struct {
@@ -52,12 +53,13 @@ func (this *AdminNode) Run() {
 	// 启动API节点
 	this.startAPINode()
 
-	server := TeaGo.NewServer(false).
+	TeaGo.NewServer(false).
 		AccessLog(false).
 		EndAll().
-
-		Session(sessions.NewFileSessionManager(86400, secret))
-	server.Start()
+		Session(sessions.NewFileSessionManager(86400, secret)).
+		ReadHeaderTimeout(3 * time.Second).
+		ReadTimeout(600 * time.Second).
+		Start()
 }
 
 // 检查Server配置

internal/web/actions/default/ui/download.go

@@ -2,6 +2,7 @@ package ui
 
 import (
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
+	"github.com/TeaOSLab/EdgeAdmin/internal/web/helpers"
 )
 
 // 下载指定的文本内容
@@ -16,8 +17,9 @@ func (this *DownloadAction) Init() {
 func (this *DownloadAction) RunGet(params struct {
 	File string
 	Text string
+
+	Auth *helpers.UserMustAuth
 }) {
 	this.AddHeader("Content-Disposition", "attachment; filename=\""+params.File+"\";")
 	this.WriteString(params.Text)
-
 }

internal/web/helpers/user_must_auth.go

@@ -24,6 +24,12 @@ func NewUserMustAuth() *UserMustAuth {
 func (this *UserMustAuth) BeforeAction(actionPtr actions.ActionWrapper, paramName string) (goNext bool) {
 	var action = actionPtr.Object()
 
+	// 安全相关
+	if !teaconst.EnabledFrame {
+		action.AddHeader("X-Frame-Options", "SAMEORIGIN")
+	}
+	action.AddHeader("Content-Security-Policy", "default-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'")
+
 	// 检查系统是否已经配置过
 	if !setup.IsConfigured() {
 		action.RedirectURL("/setup")

internal/web/helpers/user_should_auth.go

@@ -1,6 +1,7 @@
 package helpers
 
 import (
+	teaconst "github.com/TeaOSLab/EdgeAdmin/internal/const"
 	"github.com/iwind/TeaGo/actions"
 	"net/http"
 	"strconv"
@@ -12,6 +13,14 @@ type UserShouldAuth struct {
 
 func (this *UserShouldAuth) BeforeAction(actionPtr actions.ActionWrapper, paramName string) (goNext bool) {
 	this.action = actionPtr.Object()
+
+	// 安全相关
+	action := this.action
+	if !teaconst.EnabledFrame {
+		action.AddHeader("X-Frame-Options", "SAMEORIGIN")
+	}
+	action.AddHeader("Content-Security-Policy", "default-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'")
+
 	return true
 }
 
@@ -20,18 +29,28 @@ func (this *UserShouldAuth) StoreAdmin(adminId int, remember bool) {
 	// 修改sid的时间
 	if remember {
 		cookie := &http.Cookie{
-			Name:   "sid",
-			Value:  this.action.Session().Sid,
-			Path:   "/",
-			MaxAge: 14 * 86400,
+			Name:     "sid",
+			Value:    this.action.Session().Sid,
+			Path:     "/",
+			MaxAge:   14 * 86400,
+			HttpOnly: true,
+		}
+		if this.action.Request.TLS != nil {
+			cookie.SameSite = http.SameSiteStrictMode
+			cookie.Secure = true
 		}
 		this.action.AddCookie(cookie)
 	} else {
 		cookie := &http.Cookie{
-			Name:   "sid",
-			Value:  this.action.Session().Sid,
-			Path:   "/",
-			MaxAge: 0,
+			Name:     "sid",
+			Value:    this.action.Session().Sid,
+			Path:     "/",
+			MaxAge:   0,
+			HttpOnly: true,
+		}
+		if this.action.Request.TLS != nil {
+			cookie.SameSite = http.SameSiteStrictMode
+			cookie.Secure = true
 		}
 		this.action.AddCookie(cookie)
 	}