805 lines
30 KiB
JavaScript
805 lines
30 KiB
JavaScript
#!/usr/bin/env node
|
||
'use strict';
|
||
|
||
/**
|
||
* 军歌嘹亮 · 静态审计与自测流水线
|
||
*
|
||
* 用法:
|
||
* node tools/audit-project.js # 人类可读报告
|
||
* node tools/audit-project.js --json # 机器可读，便于 CI / 迭代
|
||
*
|
||
* 退出码: 0 = 无错误（可能有警告）; 1 = 存在错误
|
||
*/
|
||
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
|
||
const ROOT = path.resolve(__dirname, '..');
|
||
// tools/ 是检查器自身，内部必然包含 importObject 等模式字符串，
|
||
// 当成业务代码审计只会产生假阳性；.zcode/ 是工具链运行产物。
|
||
const IGNORE_DIRS = new Set(['.git', 'node_modules', 'unpackage', '.hbuilderx', '.trae', 'git', 'tools', '.zcode']);
|
||
// P2-1: 已被 .gitignore 忽略的构建产物不参与编码审计（hx_page.html 的 UTF-8 BOM 是 HBuilderX 生成器行为，非源码问题）。
|
||
const IGNORE_FILES = new Set(['hx_page.html']);
|
||
const SOURCE_EXT = new Set(['.vue', '.js', '.ts', '.json', '.scss', '.css', '.md', '.html']);
|
||
const JSON_OUT = process.argv.includes('--json');
|
||
|
||
const errors = [];
|
||
const warnings = [];
|
||
const stats = {};
|
||
|
||
const seen = new Set();
|
||
function push(list, section, msg, file, line) {
|
||
const key = `${section}|${file}|${line}|${msg}`;
|
||
if (seen.has(key)) return;
|
||
seen.add(key);
|
||
list.push({ section, msg, file, line });
|
||
}
|
||
const err = (s, m, f, l) => push(errors, s, m, f, l);
|
||
const warn = (s, m, f, l) => push(warnings, s, m, f, l);
|
||
|
||
const rel = (p) => path.relative(ROOT, p).split(path.sep).join('/');
|
||
const lineAt = (src, idx) => src.slice(0, idx).split('\n').length;
|
||
|
||
function walk(dir, out = []) {
|
||
let entries;
|
||
try {
|
||
entries = fs.readdirSync(dir, { withFileTypes: true });
|
||
} catch {
|
||
return out;
|
||
}
|
||
for (const e of entries) {
|
||
if (e.isDirectory()) {
|
||
if (IGNORE_DIRS.has(e.name)) continue;
|
||
walk(path.join(dir, e.name), out);
|
||
} else if (e.isFile()) {
|
||
if (IGNORE_FILES.has(e.name)) continue;
|
||
out.push(path.join(dir, e.name));
|
||
}
|
||
}
|
||
return out;
|
||
}
|
||
|
||
/** uniCloud 官方内置云函数：不计入业务审计 */
|
||
const STOCK_CLOUD_FNS = new Set([
|
||
'uni-stat-receiver', 'uni-stat-cron', 'uni-analyse-searchhot', 'uni-portal',
|
||
'uni-upgrade-center', 'uni-sms-co', 'uni-id-co', 'uni-captcha-co',
|
||
'uni-media-library-co', 'uni-pay-co', 'uni-cms-unlock-callback',
|
||
]);
|
||
|
||
/** 第三方 / 官方模块：问题降级为警告，不作为阻塞项 */
|
||
function isVendor(r) {
|
||
if (r.startsWith('pages3/uni_modules/')) return true;
|
||
if (r.startsWith('uniCloud-alipay/cloudfunctions/common/')) return true;
|
||
if (r.startsWith('js_sdk/')) return true;
|
||
const cf = r.match(/cloudfunctions\/([\w-]+)\//);
|
||
if (cf && STOCK_CLOUD_FNS.has(cf[1])) return true;
|
||
const m = r.match(/^uni_modules\/([^/]+)\//);
|
||
if (m && !['uni-cms-article', 'hb-comment'].includes(m[1])) return true;
|
||
return false;
|
||
}
|
||
|
||
/** 是否属于云函数源码（用于跳过自调用检查） */
|
||
const isCloudFnPath = (r) => /\/uniCloud\/cloudfunctions\//.test(r) || r.startsWith('uniCloud-alipay/cloudfunctions/');
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 1. 文件编码
|
||
// ─────────────────────────────────────────────
|
||
function sectionEncoding(files) {
|
||
let scanned = 0;
|
||
for (const f of files) {
|
||
if (!SOURCE_EXT.has(path.extname(f).toLowerCase())) continue;
|
||
const r = rel(f);
|
||
const buf = fs.readFileSync(f);
|
||
if (buf.length === 0) continue;
|
||
scanned++;
|
||
|
||
const utf16Bom = buf.length >= 2 && ((buf[0] === 0xff && buf[1] === 0xfe) || (buf[0] === 0xfe && buf[1] === 0xff));
|
||
const utf8Bom = buf.length >= 3 && buf[0] === 0xef && buf[1] === 0xbb && buf[2] === 0xbf;
|
||
|
||
const n = Math.min(buf.length, 8192);
|
||
let zeros = 0;
|
||
for (let i = 0; i < n; i++) if (buf[i] === 0) zeros++;
|
||
|
||
const report = (msg) => (isVendor(r) ? warn : err)('编码', msg, r, 1);
|
||
|
||
if (utf16Bom) {
|
||
report('文件是 UTF-16 (带 BOM)，编辑器/终端下必然乱码');
|
||
continue;
|
||
}
|
||
if (zeros > n * 0.1) {
|
||
report(`疑似 UTF-16 裸编码（零字节 ${zeros}/${n}），应转为 UTF-8`);
|
||
continue;
|
||
}
|
||
if (utf8Bom) {
|
||
warn('编码', '存在 UTF-8 BOM（建议移除）', r, 1);
|
||
continue;
|
||
}
|
||
try {
|
||
new TextDecoder('utf-8', { fatal: true }).decode(buf);
|
||
} catch {
|
||
report('不是合法 UTF-8 字节序列（很可能是 GBK 或二次编码损坏）');
|
||
}
|
||
}
|
||
stats.encodedFiles = scanned;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 2. 页面注册表
|
||
// ─────────────────────────────────────────────
|
||
function sectionPages() {
|
||
let pagesJson;
|
||
try {
|
||
pagesJson = JSON.parse(fs.readFileSync(path.join(ROOT, 'pages.json'), 'utf8'));
|
||
} catch (e) {
|
||
err('页面', `pages.json 无法解析: ${e.message}`, 'pages.json', 1);
|
||
return { routes: new Set(), tabBar: new Set() };
|
||
}
|
||
|
||
const routes = new Set();
|
||
const tabBar = new Set();
|
||
|
||
for (const p of pagesJson.pages || []) routes.add(p.path);
|
||
for (const sp of pagesJson.subPackages || []) {
|
||
const root = String(sp.root || '').replace(/\/+$/, '');
|
||
for (const p of sp.pages || []) routes.add(root ? `${root}/${p.path}` : p.path);
|
||
}
|
||
|
||
const tabList = (pagesJson.tabBar && pagesJson.tabBar.list) || [];
|
||
for (const t of tabList) {
|
||
tabBar.add(t.pagePath);
|
||
if (!routes.has(t.pagePath)) {
|
||
err('页面', `tabBar 页面未在 pages/subPackages 中注册: ${t.pagePath}`, 'pages.json', 1);
|
||
}
|
||
for (const key of ['iconPath', 'selectedIconPath']) {
|
||
const icon = t[key];
|
||
if (!icon) continue;
|
||
const abs = path.join(ROOT, icon.replace(/^\//, ''));
|
||
if (!fs.existsSync(abs)) {
|
||
err('页面', `tabBar「${t.text}」的 ${key} 图标文件不存在: ${icon}`, 'pages.json', 1);
|
||
}
|
||
}
|
||
}
|
||
|
||
for (const r of routes) {
|
||
if (!fs.existsSync(path.join(ROOT, r + '.vue'))) {
|
||
err('页面', `pages.json 注册了页面，但文件不存在: ${r}.vue`, 'pages.json', 1);
|
||
}
|
||
}
|
||
|
||
stats.routes = routes.size;
|
||
stats.tabBar = tabBar.size;
|
||
return { routes, tabBar, pagesJson };
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 3. 路由跳转交叉比对
|
||
// ─────────────────────────────────────────────
|
||
const NAV_RE = /(?:uni\.)?(navigateTo|redirectTo|reLaunch|switchTab)\s*\(([\s\S]{0,400}?)\)/g;
|
||
const URL_RE = /url\s*:\s*(['"`])([^'"`]+)\1/;
|
||
|
||
/** 把 url 归一化成 pages.json 里那种根相对路径 */
|
||
function resolveRoute(raw, fileRel, routes) {
|
||
const p = raw.split('?')[0].split('#')[0].trim();
|
||
if (!p) return null;
|
||
if (p.startsWith('/')) return p.slice(1).replace(/\/+$/, '');
|
||
if (p.startsWith('./') || p.startsWith('../')) {
|
||
const dir = path.posix.dirname(fileRel);
|
||
return path.posix.normalize(path.posix.join(dir, p)).replace(/^\.\//, '').replace(/\/+$/, '');
|
||
}
|
||
// 无前导斜杠：优先按根相对理解，其次按文件相对理解
|
||
if (routes.has(p)) return p;
|
||
return path.posix
|
||
.normalize(path.posix.join(path.posix.dirname(fileRel), p))
|
||
.replace(/^\.\//, '')
|
||
.replace(/\/+$/, '');
|
||
}
|
||
|
||
function sectionNavigation(files, routes, tabBar) {
|
||
let checked = 0;
|
||
for (const f of files) {
|
||
const ext = path.extname(f).toLowerCase();
|
||
if (ext !== '.vue' && ext !== '.js') continue;
|
||
const r = rel(f);
|
||
if (isVendor(r)) continue;
|
||
|
||
const src = fs.readFileSync(f, 'utf8');
|
||
let m;
|
||
NAV_RE.lastIndex = 0;
|
||
while ((m = NAV_RE.exec(src))) {
|
||
const api = m[1];
|
||
const um = URL_RE.exec(m[2]);
|
||
if (!um) continue;
|
||
const raw = um[2];
|
||
if (raw.includes('${')) continue; // 动态拼接，静态不可判定
|
||
const target = resolveRoute(raw, r, routes);
|
||
if (!target) continue;
|
||
checked++;
|
||
|
||
const line = lineAt(src, m.index);
|
||
const isTab = tabBar.has(target);
|
||
|
||
if (!routes.has(target)) {
|
||
err('路由', `${api} 跳转到未注册页面: ${target}`, r, line);
|
||
} else if (isTab && (api === 'navigateTo' || api === 'redirectTo')) {
|
||
err('路由', `${api} 不能跳转 tabBar 页面（须用 switchTab）: ${target}`, r, line);
|
||
} else if (!isTab && api === 'switchTab') {
|
||
err('路由', `switchTab 只能跳转 tabBar 页面: ${target}`, r, line);
|
||
}
|
||
}
|
||
}
|
||
stats.navChecked = checked;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 4. 云函数导出解析
|
||
// ─────────────────────────────────────────────
|
||
const JS_KEYWORDS = new Set([
|
||
'function', 'return', 'if', 'else', 'for', 'while', 'do', 'switch', 'case', 'default',
|
||
'break', 'continue', 'try', 'catch', 'finally', 'throw', 'new', 'delete', 'typeof',
|
||
'instanceof', 'in', 'of', 'var', 'let', 'const', 'class', 'extends', 'super', 'this',
|
||
'null', 'true', 'false', 'undefined', 'await', 'async', 'yield', 'void', 'export', 'import',
|
||
]);
|
||
|
||
function extractExports(src) {
|
||
const methods = new Set();
|
||
|
||
// module.exports = { key: ..., async key(...) {} }
|
||
const i = src.indexOf('module.exports');
|
||
if (i >= 0) {
|
||
const start = src.indexOf('{', i);
|
||
if (start >= 0) {
|
||
let depth = 0;
|
||
let end = -1;
|
||
for (let k = start; k < src.length; k++) {
|
||
const c = src[k];
|
||
if (c === '{') depth++;
|
||
else if (c === '}') {
|
||
depth--;
|
||
if (depth === 0) {
|
||
end = k;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
const body = src.slice(start + 1, end < 0 ? src.length : end);
|
||
let d = 0;
|
||
for (let j = 0; j < body.length; j++) {
|
||
const c = body[j];
|
||
if (c === '{' || c === '(' || c === '[') {
|
||
d++;
|
||
continue;
|
||
}
|
||
if (c === '}' || c === ')' || c === ']') {
|
||
d--;
|
||
continue;
|
||
}
|
||
if (d !== 0) continue;
|
||
if (j > 0 && !/[\s,{]/.test(body[j - 1])) continue;
|
||
|
||
const m = /^(?:async\s+\*?\s*)?([A-Za-z_$][\w$]*)\s*/.exec(body.slice(j));
|
||
if (!m || JS_KEYWORDS.has(m[1])) continue;
|
||
const name = m[1];
|
||
const rest = body.slice(j + m[0].length);
|
||
|
||
// 方法简写：`name(...) {}`
|
||
if (rest.startsWith('(')) {
|
||
methods.add(name);
|
||
continue;
|
||
}
|
||
// 键值对：只有值确实是函数才计为方法，`name: 1` 不算
|
||
if (rest.startsWith(':')) {
|
||
const after = rest.slice(1).replace(/^\s+/, '');
|
||
const isFn =
|
||
/^(async\s+)?function\b/.test(after) ||
|
||
/^(async\s*)?\(/.test(after) ||
|
||
/^(async\s+)?[A-Za-z_$][\w$]*\s*=>/.test(after);
|
||
if (isFn) methods.add(name);
|
||
continue;
|
||
}
|
||
// ES6 简写属性：`name,` / `name\n}`
|
||
if (rest.startsWith(',') || /^\s*}/.test(rest)) {
|
||
methods.add(name);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
// exports.foo = / module.exports.foo =
|
||
let m;
|
||
const re = /(?:module\.)?exports\.([A-Za-z_$][\w$]*)\s*=/g;
|
||
while ((m = re.exec(src))) methods.add(m[1]);
|
||
|
||
return methods;
|
||
}
|
||
|
||
function sectionCloudFunctions() {
|
||
const out = new Map();
|
||
const roots = [
|
||
['uniCloud-alipay/cloudfunctions', path.join(ROOT, 'uniCloud-alipay/cloudfunctions')],
|
||
['uni_modules', path.join(ROOT, 'uni_modules')],
|
||
['pages3/uni_modules', path.join(ROOT, 'pages3/uni_modules')],
|
||
];
|
||
|
||
const consider = (dirPath, dirRel) => {
|
||
if (/[/\\]common$/.test(dirRel)) return;
|
||
const objFile = path.join(dirPath, 'index.obj.js');
|
||
const plainFile = path.join(dirPath, 'index.js');
|
||
const name = path.basename(dirRel);
|
||
|
||
// 普通云函数（index.js）不是云对象，只能 callFunction，不能 importObject
|
||
if (!fs.existsSync(objFile)) {
|
||
if (fs.existsSync(plainFile)) {
|
||
out.set(name, { file: rel(plainFile), methods: null, hasBefore: false, isVendor: isVendor(rel(plainFile)) });
|
||
return;
|
||
}
|
||
if (!isVendor(dirRel + '/index.obj.js')) {
|
||
err('云函数', '目录里既没有 index.obj.js 也没有 index.js，无法被调用', dirRel, 1);
|
||
}
|
||
return;
|
||
}
|
||
const src = fs.readFileSync(objFile, 'utf8');
|
||
out.set(name, {
|
||
file: rel(objFile),
|
||
methods: extractExports(src),
|
||
hasBefore: /_before\s*[:(]/.test(src),
|
||
isVendor: isVendor(rel(objFile)),
|
||
});
|
||
};
|
||
|
||
const [envRel, envAbs] = roots[0];
|
||
let entries = [];
|
||
try {
|
||
entries = fs.readdirSync(envAbs, { withFileTypes: true });
|
||
} catch {
|
||
err('云函数', '找不到 uniCloud-alipay/cloudfunctions 目录', envRel, 1);
|
||
}
|
||
for (const e of entries) {
|
||
if (e.isDirectory()) consider(path.join(envAbs, e.name), `${envRel}/${e.name}`);
|
||
}
|
||
|
||
for (const [, base] of roots.slice(1)) {
|
||
let mods = [];
|
||
try {
|
||
mods = fs.readdirSync(base, { withFileTypes: true });
|
||
} catch {
|
||
continue;
|
||
}
|
||
for (const m of mods) {
|
||
if (!m.isDirectory()) continue;
|
||
const cfDir = path.join(base, m.name, 'uniCloud/cloudfunctions');
|
||
if (!fs.existsSync(cfDir)) continue;
|
||
for (const c of fs.readdirSync(cfDir, { withFileTypes: true })) {
|
||
if (!c.isDirectory()) continue;
|
||
consider(path.join(cfDir, c.name), rel(path.join(cfDir, c.name)));
|
||
}
|
||
}
|
||
}
|
||
|
||
stats.cloudFunctions = out.size;
|
||
return out;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 5. importObject / callFunction 交叉比对
|
||
// ─────────────────────────────────────────────
|
||
const IMPORT_RE = /(\w+)\s*=\s*uniCloud\.importObject\(\s*['"]([\w-]+)['"]/g;
|
||
const CALLFN_RE = /callFunction\s*\(\s*\{([\s\S]{0,400}?)\}/g;
|
||
const NAME_RE = /name\s*:\s*['"]([\w-]+)['"]/;
|
||
const SKIP_METHODS = new Set(['then', 'catch', 'finally', 'toString', 'valueOf']);
|
||
|
||
function sectionCloudCalls(files, cloudfns) {
|
||
let checked = 0;
|
||
for (const f of files) {
|
||
const ext = path.extname(f).toLowerCase();
|
||
if (ext !== '.vue' && ext !== '.js') continue;
|
||
const r = rel(f);
|
||
if (isVendor(r)) continue;
|
||
|
||
const src = fs.readFileSync(f, 'utf8');
|
||
|
||
// 云函数自身内部调用（this.xxx）不算跨函数调用
|
||
if (!isCloudFnPath(r)) {
|
||
const vars = [];
|
||
let m;
|
||
IMPORT_RE.lastIndex = 0;
|
||
while ((m = IMPORT_RE.exec(src))) {
|
||
vars.push({ varName: m[1], fn: m[2] });
|
||
const decl = cloudfns.get(m[2]);
|
||
if (!decl) {
|
||
err('云调用', `importObject 引用了不存在的云函数: ${m[2]}`, r, lineAt(src, m.index));
|
||
} else if (decl.methods === null) {
|
||
err('云调用', `${m[2]} 是普通云函数（index.js），不能用 importObject 调用`, r, lineAt(src, m.index));
|
||
}
|
||
}
|
||
for (const v of vars) {
|
||
const callRe = new RegExp(`\\b${v.varName}\\.([A-Za-z_$][\\w$]*)\\s*\\(`, 'g');
|
||
let c;
|
||
while ((c = callRe.exec(src))) {
|
||
if (SKIP_METHODS.has(c[1])) continue;
|
||
checked++;
|
||
const fn = cloudfns.get(v.fn);
|
||
if (!fn) continue;
|
||
if (fn.methods.has(c[1])) continue;
|
||
err('云调用', `${v.fn} 不存在方法 ${c[1]}()`, r, lineAt(src, c.index));
|
||
}
|
||
}
|
||
}
|
||
|
||
CALLFN_RE.lastIndex = 0;
|
||
let k;
|
||
while ((k = CALLFN_RE.exec(src))) {
|
||
const nm = NAME_RE.exec(k[1]);
|
||
if (!nm) continue;
|
||
checked++;
|
||
if (!cloudfns.has(nm[1])) {
|
||
err('云调用', `callFunction 调用了不存在的云函数: ${nm[1]}`, r, lineAt(src, k.index));
|
||
}
|
||
}
|
||
}
|
||
stats.cloudCallsChecked = checked;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 6. 未完成代码
|
||
// ─────────────────────────────────────────────
|
||
const TODO_RE = /\b(TODO|FIXME|XXX|HACK)\b/g;
|
||
|
||
function sectionTodos(files) {
|
||
let count = 0;
|
||
for (const f of files) {
|
||
const ext = path.extname(f).toLowerCase();
|
||
if (ext !== '.vue' && ext !== '.js') continue;
|
||
const r = rel(f);
|
||
if (isVendor(r) || r.startsWith('tools/')) continue;
|
||
const src = fs.readFileSync(f, 'utf8');
|
||
let m;
|
||
TODO_RE.lastIndex = 0;
|
||
while ((m = TODO_RE.exec(src))) {
|
||
count++;
|
||
const line = lineAt(src, m.index);
|
||
warn('未完成', `${m[1]}: ${src.split('\n')[line - 1].trim().slice(0, 90)}`, r, line);
|
||
}
|
||
}
|
||
stats.todos = count;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 7. 硬编码敏感信息
|
||
// ─────────────────────────────────────────────
|
||
const SECRET_RE =
|
||
/\b(secret|sk|password|passwd|pwd|api[_-]?key|access[_-]?key|bucketSecret|appSecret)\b\s*[:=]\s*['"]([A-Za-z0-9+/=_\-]{16,})['"]/gi;
|
||
const IP_RE = /\b((?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d))\b/g;
|
||
|
||
function sectionSecrets(files) {
|
||
let count = 0;
|
||
for (const f of files) {
|
||
const ext = path.extname(f).toLowerCase();
|
||
if (ext !== '.vue' && ext !== '.js' && ext !== '.json') continue;
|
||
const r = rel(f);
|
||
if (isVendor(r)) continue;
|
||
const src = fs.readFileSync(f, 'utf8');
|
||
|
||
let m;
|
||
SECRET_RE.lastIndex = 0;
|
||
while ((m = SECRET_RE.exec(src))) {
|
||
count++;
|
||
warn('敏感信息', `疑似硬编码 ${m[1]}（长度 ${m[2].length}），应移入环境变量`, r, lineAt(src, m.index));
|
||
}
|
||
|
||
IP_RE.lastIndex = 0;
|
||
const privateOk = (ip) => {
|
||
if (/^(127|192\.168|10|0)\./.test(ip)) return true;
|
||
// 保留地址：广播 / 未指定 / 链路本地 / 组播，出现在 IP 校验逻辑里属正常
|
||
if (ip === '255.255.255.255' || ip === '0.0.0.0' || /^(169\.254|22[4-9]|23\d)\./.test(ip)) return true;
|
||
// 形如 3.0.0.0 的版本号，每段都很小，不算硬编码业务地址
|
||
return ip.split('.').every((o) => Number(o) <= 20);
|
||
};
|
||
while ((m = IP_RE.exec(src))) {
|
||
if (privateOk(m[1])) continue;
|
||
count++;
|
||
warn('敏感信息', `硬编码公网 IP 地址: ${m[1]}`, r, lineAt(src, m.index));
|
||
}
|
||
}
|
||
stats.secrets = count;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 8. 云函数安全基线
|
||
// ─────────────────────────────────────────────
|
||
const WRITE_METHOD_RE = /\basync\s+([A-Za-z_$][\w$]*)\s*\(/g;
|
||
const READONLY_HINTS = /^(get|list|query|search|count|is[A-Z]|_)/;
|
||
|
||
/**
|
||
* 把行注释内容替换为等量空格：长度不变，字节偏移不变，
|
||
* 因此 lineAt(src, idx) 与 src.slice 仍指向同一位置。
|
||
*
|
||
* 不做这层剥离时，被注释掉的 `async foo() {}` 会被 WRITE_METHOD_RE 当成
|
||
* 活方法，产生「未校验登录态」的假警报（ext-storage-co.downloadFile 就是）。
|
||
*/
|
||
function blankLineComments(src) {
|
||
return src.replace(/^([ \t]*)\/\/.*$/gm, (line) => ' '.repeat(line.length));
|
||
}
|
||
|
||
/**
|
||
* 云对象方法按"是否写库"与"是否校验登录"分类。
|
||
* 写方法缺少 checkToken 即为越权风险；读方法缺少则提示可能泄露数据。
|
||
*/
|
||
function sectionCloudAuth(files, cloudfns) {
|
||
let checked = 0;
|
||
for (const [name, decl] of cloudfns) {
|
||
if (decl.isVendor || decl.methods === null) continue;
|
||
|
||
let raw;
|
||
try {
|
||
raw = fs.readFileSync(path.join(ROOT, decl.file), 'utf8');
|
||
} catch {
|
||
continue;
|
||
}
|
||
const src = blankLineComments(raw);
|
||
|
||
// 逐个方法切分，判断方法体内是否有写操作且无鉴权
|
||
const marks = [];
|
||
let m;
|
||
WRITE_METHOD_RE.lastIndex = 0;
|
||
while ((m = WRITE_METHOD_RE.exec(src))) marks.push({ name: m[1], idx: m.index });
|
||
|
||
const bodyOf = (i) => {
|
||
const start = marks[i].idx;
|
||
const end = i + 1 < marks.length ? marks[i + 1].idx : src.length;
|
||
return { start, body: src.slice(start, end) };
|
||
};
|
||
|
||
// 鉴权可能被抽成辅助方法（如 _requireLogin / _requireOwner），
|
||
// 调用这些方法与直接调 checkToken 等价
|
||
const authHelpers = new Set();
|
||
for (let i = 0; i < marks.length; i++) {
|
||
const { body } = bodyOf(i);
|
||
if (/checkToken\s*\(/.test(body)) authHelpers.add(marks[i].name);
|
||
}
|
||
const helperCallRe = authHelpers.size
|
||
? new RegExp(`this\\.(?:${[...authHelpers].join('|')})\\s*\\(`)
|
||
: null;
|
||
|
||
if (!/checkToken\s*\(/.test(src)) {
|
||
const hasAnyWrite = /\.(add|update|remove)\s*\(/.test(src);
|
||
if (hasAnyWrite) {
|
||
err('云鉴权', `${name} 整个云对象没有鉴权，却存在写库操作`, decl.file, 1);
|
||
}
|
||
continue;
|
||
}
|
||
|
||
for (let i = 0; i < marks.length; i++) {
|
||
if (!decl.methods.has(marks[i].name)) continue;
|
||
const { start, body } = bodyOf(i);
|
||
checked++;
|
||
|
||
const writes = /\.(add|update|remove)\s*\(/.test(body);
|
||
const auths = /checkToken\s*\(/.test(body) || (helperCallRe && helperCallRe.test(body));
|
||
const isGetter = READONLY_HINTS.test(marks[i].name);
|
||
|
||
if (writes && !auths) {
|
||
err(
|
||
'云鉴权',
|
||
`${name}.${marks[i].name}() 有写库操作但未校验登录态`,
|
||
decl.file,
|
||
lineAt(src, start)
|
||
);
|
||
} else if (!writes && !auths && !isGetter) {
|
||
warn(
|
||
'云鉴权',
|
||
`${name}.${marks[i].name}() 未校验登录态（读取他人数据风险）`,
|
||
decl.file,
|
||
lineAt(src, start)
|
||
);
|
||
}
|
||
}
|
||
}
|
||
stats.cloudAuthChecked = checked;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 0. 自测：确认检查器本身有效（防止"永远通过"）
|
||
// ─────────────────────────────────────────────
|
||
function selfTest() {
|
||
const cases = [];
|
||
const check = (label, actual, expected) => {
|
||
const ok = actual === expected;
|
||
cases.push({ label, ok, actual, expected });
|
||
};
|
||
|
||
// 导出解析：四种写法都要认出来
|
||
const sample = `
|
||
const a = 1;
|
||
module.exports = {
|
||
_before: function () {},
|
||
async foo(x) { return x },
|
||
bar: async () => 1,
|
||
baz,
|
||
qux: function () {},
|
||
notAMethod: 1,
|
||
}`;
|
||
const got = extractExports(sample);
|
||
check('解析 async 方法', got.has('foo'), true);
|
||
check('解析箭头函数属性', got.has('bar'), true);
|
||
check('解析 ES6 简写属性', got.has('baz'), true);
|
||
check('解析 function 属性', got.has('qux'), true);
|
||
check('解析 _before 钩子', got.has('_before'), true);
|
||
check('不把普通值当方法', got.has('notAMethod'), false);
|
||
|
||
// 路由归一化：相对路径要解析成根相对
|
||
const routes = new Set(['pages3/uni_modules/x/y', 'pages/index/index']);
|
||
check(
|
||
'解析相对路径 ../',
|
||
resolveRoute('../../pages3/uni_modules/x/y', 'pages2/a/b.vue', routes),
|
||
'pages3/uni_modules/x/y'
|
||
);
|
||
check('解析绝对路径 /', resolveRoute('/pages/index/index', 'any/where.vue', routes), 'pages/index/index');
|
||
check('剥离查询串', resolveRoute('/pages/index/index?x=1', 'a.vue', routes), 'pages/index/index');
|
||
|
||
// 下面这些必须被"真实项目扫描"覆盖，否则说明扫描没生效
|
||
check('真实扫描到页面路由', stats.routes > 0, true);
|
||
check('真实扫描到云函数', stats.cloudFunctions > 0, true);
|
||
check('真实检查了路由跳转', stats.navChecked > 0, true);
|
||
check('真实检查了云调用', stats.cloudCallsChecked > 0, true);
|
||
check('真实检查了云函数鉴权', stats.cloudAuthChecked > 0, true);
|
||
|
||
// 云鉴权判定逻辑：写操作无鉴权必须报警，有鉴权则不报
|
||
const unsafeFn = `
|
||
module.exports = {
|
||
async dropAll(id) {
|
||
const db = uniCloud.database()
|
||
await db.collection('x').doc(id).remove()
|
||
return { code: 200 }
|
||
}
|
||
}`;
|
||
const safeFn = `
|
||
module.exports = {
|
||
async dropAll(id) {
|
||
const payload = await this.uniID.checkToken(this.getUniIdToken())
|
||
if (payload.errCode) throw new Error('未登录')
|
||
await db.collection('x').doc(id).remove()
|
||
return { code: 200 }
|
||
}
|
||
}`;
|
||
const scanAuth = (src) => {
|
||
const marks = [];
|
||
let m;
|
||
WRITE_METHOD_RE.lastIndex = 0;
|
||
while ((m = WRITE_METHOD_RE.exec(src))) marks.push({ name: m[1], idx: m.index });
|
||
let hasUnsafeWrite = false;
|
||
for (let i = 0; i < marks.length; i++) {
|
||
const start = marks[i].idx;
|
||
const end = i + 1 < marks.length ? marks[i + 1].idx : src.length;
|
||
const body = src.slice(start, end);
|
||
if (/\.(add|update|remove)\s*\(/.test(body) && !/checkToken\s*\(/.test(body)) {
|
||
hasUnsafeWrite = true;
|
||
}
|
||
}
|
||
return hasUnsafeWrite;
|
||
};
|
||
check('识别出无鉴权的写方法', scanAuth(unsafeFn), true);
|
||
check('不误报已鉴权的写方法', scanAuth(safeFn), false);
|
||
|
||
// 鉴权抽成辅助方法时，调用辅助方法也算已鉴权
|
||
const helperFn = `
|
||
module.exports = {
|
||
async _requireLogin() {
|
||
const payload = await this.uniID.checkToken(this.getUniIdToken())
|
||
if (payload.errCode) throw new Error('未登录')
|
||
return payload
|
||
},
|
||
async dropAll(id) {
|
||
await this._requireLogin()
|
||
await db.collection('x').doc(id).remove()
|
||
return { code: 200 }
|
||
}
|
||
}`;
|
||
const detectHelpers = (src2) => {
|
||
const marks2 = [];
|
||
let mm;
|
||
WRITE_METHOD_RE.lastIndex = 0;
|
||
while ((mm = WRITE_METHOD_RE.exec(src2))) marks2.push({ name: mm[1], idx: mm.index });
|
||
const helperSet = new Set();
|
||
for (let i = 0; i < marks2.length; i++) {
|
||
const s = marks2[i].idx;
|
||
const e = i + 1 < marks2.length ? marks2[i + 1].idx : src2.length;
|
||
if (/checkToken\s*\(/.test(src2.slice(s, e))) helperSet.add(marks2[i].name);
|
||
}
|
||
const re = helperSet.size ? new RegExp(`this\\.(?:${[...helperSet].join('|')})\\s*\\(`) : null;
|
||
let unsafe = false;
|
||
for (let i = 0; i < marks2.length; i++) {
|
||
const s = marks2[i].idx;
|
||
const e = i + 1 < marks2.length ? marks2[i + 1].idx : src2.length;
|
||
const b = src2.slice(s, e);
|
||
const isHelperItself = helperSet.has(marks2[i].name);
|
||
if (isHelperItself) continue;
|
||
if (/\.(add|update|remove)\s*\(/.test(b) && !/checkToken\s*\(/.test(b) && !(re && re.test(b))) {
|
||
unsafe = true;
|
||
}
|
||
}
|
||
return unsafe;
|
||
};
|
||
check('识别经辅助方法鉴权的写操作', detectHelpers(helperFn), false);
|
||
|
||
return cases;
|
||
}
|
||
|
||
// ─────────────────────────────────────────────
|
||
// 主流程
|
||
// ─────────────────────────────────────────────
|
||
function main() {
|
||
const files = walk(ROOT);
|
||
|
||
sectionEncoding(files);
|
||
const { routes, tabBar } = sectionPages();
|
||
sectionNavigation(files, routes, tabBar);
|
||
const cloudfns = sectionCloudFunctions();
|
||
sectionCloudCalls(files, cloudfns);
|
||
sectionCloudAuth(files, cloudfns);
|
||
sectionTodos(files);
|
||
sectionSecrets(files);
|
||
|
||
const selfCases = selfTest();
|
||
const selfFailed = selfCases.filter((c) => !c.ok);
|
||
|
||
if (process.argv.includes('--selftest')) {
|
||
console.log('');
|
||
console.log('检查器自测：');
|
||
for (const c of selfCases) {
|
||
console.log(` ${c.ok ? '✓' : '✗'} ${c.label}${c.ok ? '' : `（期望 ${c.expected}，实得 ${c.actual}）`}`);
|
||
}
|
||
console.log('');
|
||
console.log(selfFailed.length ? `✗ ${selfFailed.length} 项失败` : '✓ 检查器工作正常');
|
||
return selfFailed.length === 0 ? 0 : 1;
|
||
}
|
||
|
||
if (JSON_OUT) {
|
||
console.log(
|
||
JSON.stringify(
|
||
{ ok: errors.length === 0 && selfFailed.length === 0, selfTest: selfCases, errors, warnings, stats },
|
||
null,
|
||
2
|
||
)
|
||
);
|
||
return errors.length === 0 && selfFailed.length === 0 ? 0 : 1;
|
||
}
|
||
|
||
const fmt = (list) =>
|
||
list.map((x) => ` ${x.file}${x.line ? ':' + x.line : ''}\n ▸ [${x.section}] ${x.msg}`).join('\n');
|
||
|
||
console.log('');
|
||
console.log('═══════════════════════════════════════════════');
|
||
console.log(' 军歌嘹亮 · 静态审计报告');
|
||
console.log('═══════════════════════════════════════════════');
|
||
console.log('');
|
||
console.log(` 页面路由 ${stats.routes} 条 / tabBar ${stats.tabBar} 项`);
|
||
console.log(` 云函数 ${stats.cloudFunctions} 个`);
|
||
console.log(` 路由跳转检查 ${stats.navChecked} 处 / 云调用检查 ${stats.cloudCallsChecked} 处`);
|
||
console.log(` 云函数鉴权检查 ${stats.cloudAuthChecked} 个方法`);
|
||
console.log(` 编码扫描 ${stats.encodedFiles} 个文件`);
|
||
console.log(
|
||
selfFailed.length
|
||
? ` ✗ 检查器自测 ${selfFailed.length} 项失败（结果不可信，先跑 --selftest）`
|
||
: ` ✓ 检查器自测通过（${selfCases.length} 项）`
|
||
);
|
||
console.log('');
|
||
|
||
if (errors.length) {
|
||
console.log(`✗ 错误 ${errors.length} 项`);
|
||
console.log(fmt(errors));
|
||
console.log('');
|
||
}
|
||
if (warnings.length) {
|
||
console.log(`⚠ 警告 ${warnings.length} 项`);
|
||
console.log(fmt(warnings));
|
||
console.log('');
|
||
}
|
||
if (!errors.length && !warnings.length) console.log('✓ 全部检查通过\n');
|
||
|
||
console.log(`结论: ${errors.length} 错误 / ${warnings.length} 警告`);
|
||
console.log('═══════════════════════════════════════════════');
|
||
return errors.length === 0 ? 0 : 1;
|
||
}
|
||
|
||
process.exit(main());
|