nxxy335
d05fd4a9b5
导出-每次考试/多考试对比： - 合格次数阈值等标记项抽为常显区块，三类成绩表共用 - 附缺考名单扩展到多考试导出（取所选考试全都没交的人） - 块表每场固定2列（成绩+合并空位），修复漏推空串导致的整行左移/串列 - 列宽按实际内容估算，合并区空位只给最小宽度 - 合格次数始终显示实际次数(含0)，仅 ≥ 阈值标绿底 - 打印标题改为「成绩明细」，缺考名单分页单独成页 - 打印样式加 print-color-adjust:exact，绿底/红字可正常印出 数据大屏： - ?class= 班级大屏免登录公开访问，接口侧放行并按班级裁剪后回传 - 单班大屏移除退出按钮，仅首页保留 - 修复红绿判定真bug：membersTable 误用 window.DASH(DASH为let声明取不到) 改为 scoreGrade() 直接读自由变量，按后台合格率正确判红/黄/绿 测试/样例/文档同步更新，全量回归通过。
263 lines
11 KiB
JavaScript
263 lines
11 KiB
JavaScript
// e2e: 上传文件防护（扩展名白名单 + 随机文件名 + 解析后即删）
|
||
// 运行：node tools/test-upload-guard.js （NY_DEBUG=1 可打印调试信息）
|
||
//
|
||
// 覆盖的漏洞：早期版本按 roster_YYYYMMDD_HHMMSS.<原始扩展名> 存在 data/uploads/，
|
||
// 既不做扩展名校验（可上传 .php 造成 RCE），文件名又可枚举；且 nginx 下 .htaccess 无效。
|
||
const http = require('http');
|
||
const net = require('net');
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
const { spawn } = require('child_process');
|
||
|
||
const ROOT = path.resolve(__dirname, '..');
|
||
const PHP_PORT = 18081;
|
||
const MOCK_PORT = 19911;
|
||
const PHP = process.env.PHP_BIN || 'C:/Users/Zhang/.workbuddy/binaries/php/8.2.34/php.exe';
|
||
const INI = process.env.PHP_INI || ''; // 便携版 php.ini 已开启 pdo_sqlite / zip / mbstring
|
||
const DEBUG = !!process.env.NY_DEBUG;
|
||
|
||
// 数据目录优先读 NY_DATA 环境变量（与 bootstrap.php 一致），让测试整体指向临时目录，
|
||
// 不污染生产库（曾因写 mock 配置把生产 base_url 改成 127.0.0.1）。
|
||
// Git Bash 风格 /c/Users/... 在 Windows 上 path.resolve 会误判成 C:\c\...，需还原；并把规范化后的
|
||
// Windows 绝对路径写回 process.env.NY_DATA，让子进程（PHP 内置服务器）也拿到正确路径。
|
||
function resolveDataDir() {
|
||
let p = process.env.NY_DATA || path.join(ROOT, 'data');
|
||
if (process.platform === 'win32' && /^\/[a-zA-Z]\//.test(p)) p = p[1].toUpperCase() + ':' + p.slice(2);
|
||
p = path.resolve(p);
|
||
process.env.NY_DATA = p;
|
||
return p;
|
||
}
|
||
const DATA = resolveDataDir();
|
||
fs.mkdirSync(DATA, { recursive: true });
|
||
const UPLOADS = path.join(DATA, 'uploads');
|
||
|
||
// ---------- 备份 / 还原运行时数据 ----------
|
||
// ny.db 必须移走：配置是 DB 优先，留着库里的真实配置会盖掉本测试写入的 config.json。
|
||
// roster.json 只能复制不能移走：mock-server 启动时要读它，移走会让 mock 直接崩。
|
||
const moved = []; // [路径, 备份路径] —— 移走
|
||
const copied = []; // [路径, 备份路径] —— 复制
|
||
for (const f of ['ny.db', 'cache/token.json']) {
|
||
const p = path.join(DATA, f);
|
||
if (fs.existsSync(p)) {
|
||
const bak = p + '.nybak';
|
||
try { fs.renameSync(p, bak); moved.push([p, bak]); }
|
||
catch (e) { console.error(' 备份失败（移走）' + f + '：' + e.message); }
|
||
}
|
||
}
|
||
for (const f of ['config.json', 'roster.json', 'project_config.json']) {
|
||
const p = path.join(DATA, f);
|
||
if (fs.existsSync(p)) {
|
||
const bak = p + '.nybak';
|
||
try { fs.copyFileSync(p, bak); copied.push([p, bak]); }
|
||
catch (e) { console.error(' 备份失败（复制）' + f + '：' + e.message); }
|
||
}
|
||
}
|
||
const cfgFile = path.join(DATA, 'config.json');
|
||
fs.writeFileSync(cfgFile, JSON.stringify({
|
||
base_url: 'http://127.0.0.1:' + MOCK_PORT,
|
||
api_prefix: '/api',
|
||
username: 'mock',
|
||
password: 'surveyking',
|
||
verify_ssl: false,
|
||
timeout: 10,
|
||
refresh_interval: 15,
|
||
page_size: 50,
|
||
include_temp_save: false,
|
||
dedupe: true,
|
||
name_keywords: '姓名,名字',
|
||
full_score: 100,
|
||
pass_rate: 60,
|
||
layout: 'default',
|
||
}, null, 2));
|
||
|
||
let mock = null, srv = null, cleanedUp = false;
|
||
function killAll() {
|
||
for (const p of [srv, mock]) {
|
||
try { p && p.kill('SIGKILL'); } catch (e) {}
|
||
}
|
||
}
|
||
function cleanup() {
|
||
if (cleanedUp) return;
|
||
cleanedUp = true;
|
||
killAll();
|
||
// 丢弃本次测试产生的运行时数据，换回备份
|
||
for (const f of ['ny.db', 'ny.db-wal', 'ny.db-shm', 'config.json', 'cache/token.json']) {
|
||
const p = path.join(DATA, f);
|
||
try { if (fs.existsSync(p)) fs.unlinkSync(p); } catch (e) {}
|
||
}
|
||
// 统一用「覆盖写回 + 尽力删除备份」的方式还原，避免删除被拦导致还原失败
|
||
for (const [p, bak] of moved.concat(copied)) {
|
||
try { if (fs.existsSync(bak)) fs.copyFileSync(bak, p); } catch (e) {}
|
||
try { if (fs.existsSync(bak)) fs.unlinkSync(bak); } catch (e) {}
|
||
}
|
||
}
|
||
process.on('exit', cleanup);
|
||
process.on('SIGINT', () => { cleanup(); process.exit(1); });
|
||
process.on('uncaughtException', (e) => { console.error('FATAL', e); cleanup(); process.exit(2); });
|
||
|
||
// ---------- 启动依赖服务 ----------
|
||
mock = spawn('node', ['tools/mock-server.js'], { cwd: ROOT, stdio: DEBUG ? 'inherit' : 'ignore' });
|
||
mock.on('exit', (code) => { if (DEBUG) console.log(' [debug] mock 退出，code=' + code); });
|
||
const phpArgs = INI.split(/\s+/).filter(Boolean)
|
||
.concat(['-S', '127.0.0.1:' + PHP_PORT, '-t', ROOT]);
|
||
srv = spawn(PHP, phpArgs, { cwd: ROOT, stdio: DEBUG ? 'inherit' : 'ignore' });
|
||
|
||
/** 轮询直到端口可连接（避免使用固定 sleep 导致的偶发失败） */
|
||
function waitPort(port, timeoutMs) {
|
||
const deadline = Date.now() + timeoutMs;
|
||
return new Promise((resolve) => {
|
||
(function attempt() {
|
||
const s = net.connect({ host: '127.0.0.1', port });
|
||
const done = (ok) => { s.destroy(); resolve(ok); };
|
||
s.setTimeout(800, () => done(false));
|
||
s.on('connect', () => done(true));
|
||
s.on('error', () => {
|
||
if (Date.now() > deadline) return done(false);
|
||
setTimeout(attempt, 300);
|
||
});
|
||
s.on('timeout', () => {
|
||
if (Date.now() > deadline) return done(false);
|
||
setTimeout(attempt, 300);
|
||
});
|
||
})();
|
||
});
|
||
}
|
||
|
||
// ---------- HTTP 辅助 ----------
|
||
const cookieJar = [];
|
||
let CSRF = '';
|
||
function baseHeaders() {
|
||
const h = {};
|
||
if (cookieJar.length) h['Cookie'] = cookieJar.map(c => c.replace(/;.*$/, '')).join('; ');
|
||
return h;
|
||
}
|
||
function absorb(res) {
|
||
for (const sc of res.headers['set-cookie'] || []) {
|
||
const pair = sc.split(';')[0];
|
||
const name = pair.split('=')[0];
|
||
const i = cookieJar.findIndex(x => x.startsWith(name + '='));
|
||
if (i >= 0) cookieJar[i] = pair; else cookieJar.push(pair);
|
||
}
|
||
}
|
||
function request(method, urlPath, headers, bodyBuf) {
|
||
return new Promise((resolve, reject) => {
|
||
const h = Object.assign({}, headers || {});
|
||
if (bodyBuf) h['Content-Length'] = bodyBuf.length;
|
||
const r = http.request({ host: '127.0.0.1', port: PHP_PORT, method, path: urlPath, headers: h }, res => {
|
||
const chunks = [];
|
||
res.on('data', c => chunks.push(c));
|
||
res.on('end', () => {
|
||
absorb(res);
|
||
const raw = Buffer.concat(chunks).toString('utf8');
|
||
let j = null;
|
||
try { j = JSON.parse(raw); } catch (e) {}
|
||
resolve({ status: res.statusCode, body: j, raw });
|
||
});
|
||
});
|
||
r.on('error', reject);
|
||
if (bodyBuf) r.write(bodyBuf);
|
||
r.end();
|
||
});
|
||
}
|
||
const get = (p) => request('GET', p, baseHeaders());
|
||
function formPost(p, fields) {
|
||
const body = Buffer.from(new URLSearchParams(fields).toString());
|
||
return request('POST', p, Object.assign({ 'Content-Type': 'application/x-www-form-urlencoded' }, baseHeaders()), body);
|
||
}
|
||
function upload(urlPath, fields, file) {
|
||
const boundary = '----nyUpload' + Math.random().toString(16).slice(2);
|
||
const parts = [];
|
||
for (const [k, v] of Object.entries(fields)) {
|
||
parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${k}"\r\n\r\n${v}\r\n`));
|
||
}
|
||
parts.push(Buffer.from(
|
||
`--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${file.filename}"\r\n` +
|
||
'Content-Type: application/octet-stream\r\n\r\n'));
|
||
parts.push(Buffer.isBuffer(file.content) ? file.content : Buffer.from(file.content));
|
||
parts.push(Buffer.from(`\r\n--${boundary}--\r\n`));
|
||
const body = Buffer.concat(parts);
|
||
return request('POST', urlPath,
|
||
Object.assign({ 'Content-Type': 'multipart/form-data; boundary=' + boundary }, baseHeaders()), body);
|
||
}
|
||
function listUploads() {
|
||
if (!fs.existsSync(UPLOADS)) return [];
|
||
return fs.readdirSync(UPLOADS).filter(f => f !== '.htaccess' && f !== 'index.html');
|
||
}
|
||
|
||
// ---------- 断言 ----------
|
||
let pass = 0, fail = 0;
|
||
function chk(name, cond, extra) {
|
||
if (cond) { pass++; console.log(' PASS ' + name + (extra ? ' — ' + extra : '')); }
|
||
else { fail++; console.log(' FAIL ' + name + (extra ? ' — ' + extra : '')); }
|
||
}
|
||
|
||
(async () => {
|
||
const mockUp = await waitPort(MOCK_PORT, 15000);
|
||
const phpUp = await waitPort(PHP_PORT, 15000);
|
||
chk('mock 卷王服务已就绪', mockUp);
|
||
chk('PHP 内置服务器已就绪', phpUp);
|
||
if (!mockUp || !phpUp) {
|
||
console.log(' 服务未就绪，终止测试');
|
||
cleanup();
|
||
process.exit(1);
|
||
}
|
||
|
||
// 登录（最多重试 3 次）
|
||
for (let i = 0; i < 3 && CSRF === ''; i++) {
|
||
const lg = await formPost('/login.php', { username: 'mock', password: 'surveyking' });
|
||
const ac = await get('/api.php?action=auth_check');
|
||
if (DEBUG) {
|
||
const m = (lg.raw || '').match(/登录失败[\s\S]{0,160}?<\/div>|尝试次数[^<]*/);
|
||
console.log(' [debug] login ' + lg.status + ' auth=' + JSON.stringify(ac.body && ac.body.data) +
|
||
' err=' + (m ? m[0].replace(/\s+/g, ' ').slice(0, 160) : '(none)'));
|
||
}
|
||
if (ac.body && ac.body.data && ac.body.data.auth === true) {
|
||
const cg = await get('/api.php?action=config_get');
|
||
CSRF = (cg.body && cg.body.data && cg.body.data.csrf_token) || '';
|
||
}
|
||
}
|
||
chk('已登录并取到 CSRF token', CSRF !== '');
|
||
if (CSRF === '') {
|
||
console.log(' 登录失败，终止测试');
|
||
cleanup();
|
||
process.exit(1);
|
||
}
|
||
|
||
console.log('\n--- 1) 危险扩展名必须被拒绝 ---');
|
||
const evil = await upload('/api.php?action=roster_import', { mode: 'replace', _csrf: CSRF }, {
|
||
filename: 'shell.php', content: '<?php system($_GET["c"]); ?>',
|
||
});
|
||
// 失败响应字段为 msg（ny_fail 输出 {"ok":false,"msg":...}）
|
||
const evilMsg = (evil.body && (evil.body.error || evil.body.msg)) || '';
|
||
chk('上传 .php 被拒绝', !!(evil.body && evil.body.ok === false), evilMsg || evil.raw.slice(0, 120));
|
||
chk('拒绝原因是扩展名白名单', /仅支持/.test(evilMsg), evilMsg);
|
||
|
||
const phtml = await upload('/api.php?action=roster_import', { mode: 'replace', _csrf: CSRF }, {
|
||
filename: 'a.phtml', content: 'x',
|
||
});
|
||
chk('上传 .phtml 被拒绝', !!(phtml.body && phtml.body.ok === false));
|
||
|
||
console.log('\n--- 2) 被拒绝后不留残留文件 ---');
|
||
chk('data/uploads 无残留', listUploads().length === 0, JSON.stringify(listUploads()));
|
||
|
||
console.log('\n--- 3) 合法 csv 正常导入且文件即删 ---');
|
||
const csv = '学号,姓名,班级\n90001,测试甲,1班\n90002,测试乙,1班\n';
|
||
const good = await upload('/api.php?action=roster_import', { mode: 'replace', _csrf: CSRF }, {
|
||
filename: 'roster.csv', content: Buffer.from('\xEF\xBB\xBF' + csv, 'utf8'),
|
||
});
|
||
chk('合法 .csv 导入成功', !!(good.body && good.body.ok === true),
|
||
(good.body && (good.body.error || good.body.msg)) || '');
|
||
chk('导入人数为 2', !!(good.body && good.body.data && good.body.data.imported === 2),
|
||
good.body ? String(good.body.data && good.body.data.imported) : '');
|
||
chk('导入后 data/uploads 已清空', listUploads().length === 0, JSON.stringify(listUploads()));
|
||
|
||
console.log('\n--- 4) 文件名不可枚举 ---');
|
||
const leaked = listUploads().filter(f => /^roster_\d{8}_\d{6}\./.test(f));
|
||
chk('不存在可枚举的 roster_时间戳 文件', leaked.length === 0, JSON.stringify(leaked));
|
||
|
||
console.log('');
|
||
console.log(`结果：${pass} 通过 / ${fail} 失败（共 ${pass + fail}）`);
|
||
cleanup();
|
||
process.exit(fail === 0 ? 0 : 1);
|
||
})();
|