feat: pin remote spider.jar behind SHA-256, default fallback-only + CSP diagnostics - #219
Open
libertydragonn wants to merge 2 commits into
Open
feat: pin remote spider.jar behind SHA-256, default fallback-only + CSP diagnostics#219libertydragonn wants to merge 2 commits into
libertydragonn wants to merge 2 commits into
Conversation
- New src/lib/proxy-security.ts: validateProxyTargetUrl blocks localhost,
private/link-local/CGNAT ranges, cloud metadata hosts and credentialed
URLs, resolves DNS and rejects targets answering with blocked addresses;
fetchWithValidatedRedirects re-validates every redirect hop.
- Opt-in allowlisting for self-hosted LAN media (NAS/Jellyfin) via
PROXY_ALLOW_PRIVATE_HOSTS=true + PROXY_PRIVATE_HOST_ALLOWLIST
(exact IPs, hostnames, IPv4 CIDRs).
- Apply validation to /api/proxy/{cms,key,logo,m3u8,segment,stream},
/api/download/{proxy,ffmpeg,ffmpeg/file}, /api/live/precheck and
/api/douban/health.
- Documented threat model: this significantly reduces SSRF exposure but
resolved IPs are not pinned to the socket, so DNS rebinding is
mitigated best-effort, not eliminated.
- Add proxy target validation regression tests.
No auth/cookie/middleware changes in this PR.
…back-only - spiderJar.ts now serves a bundled minimal fallback JAR by default; remote JARs require ALLOW_REMOTE_SPIDER_JAR=true plus SPIDER_JAR_URL(S) and a SPIDER_JAR_SHA256 pin, and are fetched through the validated redirect fetcher so they cannot reach private hosts. - Remove hardcoded third-party spider.jar candidates from TVBox config, diagnostics and admin demo source; ?spider= only accepts configured pinned candidates. - TVBox config emits spider_warning when fallback-only mode is active and the config contains CSP (csp_) sources; /api/tvbox/spider-status spells out the CSP impact and the exact env vars needed to restore a pinned remote JAR (addresses the jar-load reports in Decohererk#210). - Fix TVBox timeout fallback metadata so ;md5;... reflects the actual fallback JAR bytes. - Add migration guide to TVBox配置优化说明.md and spider jar policy tests. Depends on the proxy-security PR (uses fetchWithValidatedRedirects).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
重做系列的 spider.jar 供应链加固。依赖 SSRF 防护 PR（#218）（复用
fetchWithValidatedRedirects），在其合并前，本 PR 的 diff 会包含那一支的 commit。改动
spiderJar.ts默认使用内置最小 fallback JAR；远程 JAR 需显式ALLOW_REMOTE_SPIDER_JAR=true+SPIDER_JAR_URL(S)+SPIDER_JAR_SHA256校验，并通过校验过的重定向 fetch 拉取，无法访问私网。?spider=仅接受已配置的 pinned 候选地址。csp_）源，/api/tvbox/config输出spider_warning，/api/tvbox/spider-status明确说明「csp_ 源会没数据 / jar 加载失败」的表现与恢复所需的环境变量，避免用户只看到「没找到数据」而无从排查。;md5;...元数据使其来自真实 fallback JAR 字节。TVBox配置优化说明.md，新增 spider jar 策略测试。兼容性 / 迁移
只使用普通 CMS 采集源的用户不受影响。依赖 CSP spider 的 TVBox / 影视仓用户升级后这些源会失效，需按迁移指南显式配置以下三个环境变量恢复：
验证
jest --runInBand通过（21 套件 / 110 测试）pnpm typecheck通过docker build本分支镜像成功（干净 checkout 下构建）不改动登录 / 鉴权流程。