Security: patch critical vulnerabilities and remove hardcoded secrets

build/sysroot/usr/share/casaos/shell/helper.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 
 # 获取系统信息
 GetSysInfo() {
   if [ -s "/etc/redhat-release" ]; then
     SYS_VERSION=$(cat /etc/redhat-release)
   elif [ -s "/etc/issue" ]; then
     SYS_VERSION=$(cat /etc/issue)
@@ -18,9 +18,9 @@
 }
 
 #获取网卡信息
 GetNetCard() {
   if [ "$1" == "1" ]; then
     if [ -d "/sys/devices/virtual/net" ]; then
       ls /sys/devices/virtual/net
     fi
   else
@@ -31,20 +31,20 @@
 }
 
 
 GetTimeZone(){
   timedatectl | grep "Time zone" | awk '{printf $3}'
 }
 
 #查看网卡状态
 #param 网卡名称
 CatNetCardState() {
   if [ -e "/sys/class/net/$1/operstate" ]; then
-    cat /sys/class/net/$1/operstate
+    cat "/sys/class/net/$1/operstate"
   fi
 }
 
 #获取docker根目录
 GetDockerRootDir() {
   if hash docker 2>/dev/null; then
     docker info | grep 'Docker Root Dir' | awk -F ':' '{print $2}'
   else
@@ -55,8 +55,8 @@
 #删除安装应用文件夹
 #param 需要删除的文件夹路径
 DelAppConfigDir() {
-  if [ -d $1 ]; then
-    rm -fr $1
+  if [ -d "$1" ]; then
+    rm -fr "$1"
   fi
 }
 
@@ -69,25 +69,25 @@
 #格式化fat32磁盘
 #param 需要格式化的目录 /dev/sda1
 #param 格式
 FormatDisk() {
   if [ "$2" == "fat32" ]; then
-    mkfs.vfat -F 32 $1
+    mkfs.vfat -F 32 "$1"
   elif [ "$2" == "ntfs" ]; then
-    mkfs.ntfs $1
+    mkfs.ntfs "$1"
   elif [ "$2" == "ext4" ]; then
-    mkfs.ext4 -m 1 -F $1
+    mkfs.ext4 -m 1 -F "$1"
   elif [ "$2" == "exfat" ]; then
-    mkfs.exfat $1
+    mkfs.exfat "$1"
   else
-    mkfs.ext4 -m 1 -F $1
+    mkfs.ext4 -m 1 -F "$1"
   fi
 }
 
 #删除分区
 #param 路径   /dev/sdb
 #param 删除分区的区号
 DelPartition() {
-  fdisk $1 <<EOF
+  fdisk "$1" <<EOF
   d
   $2
   wq
@@ -97,21 +97,21 @@
 #添加分区只有一个分区
 #param 路径   /dev/sdb
 #param 要挂载的目录
 AddPartition() {
 
-  DelPartition $1
-  parted -s $1 mklabel gpt
+  DelPartition "$1"
+  parted -s "$1" mklabel gpt
 
-  parted -s $1 mkpart primary ext4 0 100%
-  P=`lsblk -r $1 | sort | grep part | head -n 1 | awk '{print $1}'`
-  mkfs.ext4 -m 1 -F /dev/${P}
+  parted -s "$1" mkpart primary ext4 0 100%
+  P=$(lsblk -r "$1" | sort | grep part | head -n 1 | awk '{print $1}')
+  mkfs.ext4 -m 1 -F "/dev/${P}"
 
-  partprobe $1
+  partprobe "$1"
 
 }
 
 #磁盘类型
 GetDiskType() {
   fdisk $1 -l | grep Disklabel | awk -F: '{print $2}'
 }
 
@@ -127,14 +127,14 @@
 #param 磁盘路径  /dev/sda
 #result bytes
 #result sectors
 GetDiskSizeAndSectors() {
   fdisk $1 -l | grep "$1:" | awk -F, 'BEGIN {OFS="\n"}{print $2,$3}' | awk '{print $1}'
 }
 
 #获取磁盘分区数据扇区
 #param 磁盘路径  /dev/sda
 #result start,end,sectors
 GetPartitionSectors() {
   fdisk $1 -l | grep "$1[1-9]" | awk 'BEGIN{OFS=","}{print $1,$2,$3,$4}'
 }
 
@@ -158,7 +158,7 @@
 }
 
 #重载samba服务
 ReloadSamba() {
   /etc/init.d/smbd reload
 }
 
@@ -170,13 +170,14 @@
   # See if this drive is already mounted, and if so where
   MOUNT_POINT=$(lsblk -o name,mountpoint | grep ${DEVICE} | awk '{print $2}')
 
   if [ -n "${MOUNT_POINT}" ]; then
     ${log} "Warning: ${DEVICE} is already mounted at ${MOUNT_POINT}"
     exit 1
   fi
 
   # Get info for this drive: $ID_FS_LABEL and $ID_FS_TYPE
-  eval $(blkid -o udev ${DEVICE} | grep -i -e "ID_FS_LABEL" -e "ID_FS_TYPE")
+  # shellcheck disable=SC2046
+  eval "$(blkid -o udev "${DEVICE}" | grep -i -e "ID_FS_LABEL" -e "ID_FS_TYPE")"
 
   LABEL=$2
   if grep -q " ${LABEL} " /etc/mtab; then
@@ -186,7 +187,7 @@
   DEV_LABEL="${LABEL}"
 
   # Use the device name in case the drive doesn't have label
   if [ -z ${DEV_LABEL} ]; then
     DEV_LABEL="${DEVBASE}"
   fi
 
@@ -232,7 +233,7 @@
     /bin/kill -9 $(lsof ${MOUNT_POINT})
     umount -l ${DEVICE}
     ${log} "Unmounted ${DEVICE} from ${MOUNT_POINT}"
     if [ "`ls -A ${MOUNT_POINT}`" = "" ]; then
       /bin/rm -fr "${MOUNT_POINT}"
     fi
 
@@ -247,20 +248,20 @@
   docker="/mnt/casa_docker"
   #判断目录docker存在不存在则创建,存在检查是否为空
 
   if [ ! -d "$docker" ]; then
-    mkdir ${docker}
+    mkdir "${docker}"
   fi
 
-  if [ "$(ls -A $docker)" = "" ]; then
+  if [ "$(ls -A "$docker")" = "" ]; then
     echo "$docker count is 0"
   else
-    mkdir ${docker}_bak
-    mv -r ${docker} ${docker}_bak
+    mkdir "${docker}_bak"
+    mv -r "${docker}" "${docker}_bak"
   fi
 
   daemon="/etc/docker/daemon.json"
   #1创建img文件在挂载的目录
   fallocate -l $2 $image
   #2初始化img文件
   mkfs -t ext4 $image
   #3挂载img文件
@@ -280,14 +281,14 @@
   systemctl start docker
 }
 
 DockerImgMove() {
   image=$1
   systemctl stop docker.socket
   systemctl stop docker
   sudo umount -f $image
 }
 
 GetDockerDataRoot() {
   docker info | grep "Docker Root Dir:"
 }
 
@@ -314,7 +315,7 @@
   du -sh /DATA
 }
 
 USB_Start_Auto() {
   ((EUID)) && sudo_cmd="sudo"
   $sudo_cmd systemctl enable devmon@devmon
   $sudo_cmd systemctl start devmon@devmon
@@ -332,27 +333,27 @@
 }
 
 # restart samba service
 RestartSMBD(){
   $sudo_cmd systemctl restart smbd
 }
 
 # edit user password $1:username
 EditSmabaUserPassword(){
   $sudo_cmd smbpasswd $1
 }
 
 AddSmabaUser(){
-  $sudo_cmd useradd $1
-  $sudo_cmd smbpasswd -a $1 <<EOF
+  $sudo_cmd useradd "$1"
+  $sudo_cmd smbpasswd -a "$1" <<EOF
     $2
     $2
 EOF
 }
 
 # $1:username $2:host $3:share $4:port $5:mountpoint $6:password 
 MountCIFS(){
- $sudo_cmd mount -t cifs -o username=$1,password=$6,port=$4 //$2/$3 $5
+ $sudo_cmd mount -t cifs -o "username=$1,password=$6,port=$4" "//$2/$3" "$5"
 }
 
 UDEVILUmount(){
   $sudo_cmd udevil umount -f $1

drivers/dropbox/meta.go

@@ -9,8 +9,8 @@ const ICONURL = "./img/driver/Dropbox.svg"
 type Addition struct {
 	driver.RootID
 	RefreshToken   string `json:"refresh_token" required:"true" omit:"true"`
-	AppKey         string `json:"app_key" type:"string" default:"tciqajyazzdygt9" omit:"true"`
-	AppSecret      string `json:"app_secret" type:"string" default:"e7gtmv441cwdf0n" omit:"true"`
+	AppKey         string `json:"app_key" type:"string" default:"" omit:"true"`
+	AppSecret      string `json:"app_secret" type:"string" default:"" omit:"true"`
 	OrderDirection string `json:"order_direction" type:"select" options:"asc,desc" omit:"true"`
 	AuthUrl        string `json:"auth_url" type:"string" default:""`
 	Icon           string `json:"icon" type:"string" default:"./img/driver/Dropbox.svg"`

drivers/dropbox/util.go

@@ -11,8 +11,8 @@ import (
 )
 
 var (
-	app_key    = "private build"
-	app_secret = "private build"
+	app_key    = ""
+	app_secret = ""
 )
 
 func (d *Dropbox) getRefreshToken() error {
@@ -29,7 +29,7 @@ func (d *Dropbox) getRefreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("get refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
 		return fmt.Errorf(e.Error)
 	}
@@ -50,7 +50,7 @@ func (d *Dropbox) refreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
 		return fmt.Errorf(e.Error)
 	}

drivers/google_drive/util.go

@@ -17,8 +17,8 @@ import (
 )
 
 var (
-	client_id     = "private build"
-	client_secret = "private build"
+	client_id     = ""
+	client_secret = ""
 )
 
 // do others that not defined in Driver interface
@@ -38,7 +38,7 @@ func (d *GoogleDrive) getRefreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("get refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
 		return fmt.Errorf(e.Error)
 	}

drivers/onedrive/util.go

@@ -11,8 +11,8 @@ import (
 )
 
 var (
-	client_id     = "private build"
-	client_secret = "private build"
+	client_id     = ""
+	client_secret = ""
 )
 
 var onedriveHostMap = map[string]Host{
@@ -81,7 +81,7 @@ func (d *Onedrive) getRefreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("get refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
 		return fmt.Errorf("%s", e.ErrorDescription)
 	}
@@ -107,7 +107,7 @@ func (d *Onedrive) _refreshToken() error {
 	if err != nil {
 		return err
 	}
-	logger.Info("get refresh token", zap.String("res", res.String()))
+	logger.Info("get refresh token", zap.String("status", res.Status()))
 	if e.Error != "" {
 		return fmt.Errorf("%s", e.ErrorDescription)
 	}

go.mod

@@ -1,6 +1,6 @@
 module github.com/IceWhaleTech/CasaOS
 
-go 1.21
+go 1.25.0
 
 require (
 	github.com/Curtis-Milo/nat-type-identifier-go v0.0.0-20220215191915-18d42168c63d
@@ -10,7 +10,7 @@ require (
 	github.com/deepmap/oapi-codegen v1.12.4
 	github.com/disintegration/imaging v1.6.2
 	github.com/dsoprea/go-exif/v3 v3.0.1
-	github.com/getkin/kin-openapi v0.117.0
+	github.com/getkin/kin-openapi v0.146.0
 	github.com/glebarez/sqlite v1.8.0
 	github.com/go-ini/ini v1.67.0
 	github.com/go-resty/resty/v2 v2.7.0
@@ -23,9 +23,9 @@ require (
 	github.com/h2non/filetype v1.1.3
 	github.com/hirochachacha/go-smb2 v1.1.0
 	github.com/json-iterator/go v1.1.12
-	github.com/labstack/echo/v4 v4.12.0
+	github.com/labstack/echo-jwt/v4 v4.2.0
+	github.com/labstack/echo/v4 v4.15.4
 	github.com/maruel/natural v1.1.0
-	github.com/mholt/archiver/v3 v3.5.1
 	github.com/mileusna/useragent v1.2.1
 	github.com/moby/sys/mount v0.3.3
 	github.com/moby/sys/mountinfo v0.6.2
@@ -35,14 +35,14 @@ require (
 	github.com/samber/lo v1.38.1
 	github.com/shirou/gopsutil/v3 v3.23.2
 	github.com/sirupsen/logrus v1.9.3
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.11.1
 	github.com/tidwall/gjson v1.17.0
 	go.uber.org/goleak v1.2.1
 	go.uber.org/zap v1.24.0
-	golang.org/x/crypto v0.23.0
-	golang.org/x/oauth2 v0.7.0
-	golang.org/x/sync v0.3.0
-	golang.org/x/sys v0.20.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/oauth2 v0.27.0
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
 	gorm.io/gorm v1.25.0
 	gotest.tools v2.2.0+incompatible
 )
@@ -61,60 +61,53 @@ require (
 	github.com/glebarez/go-sqlite v1.21.1 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-openapi/jsonpointer v0.22.5 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gofrs/uuid v4.4.0+incompatible // indirect
-	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
-	github.com/golang-jwt/jwt/v5 v5.0.0 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/safetext v0.0.0-20240104143208-7a7d9b3d812f // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/invopop/yaml v0.2.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
 	github.com/klauspost/compress v1.16.7 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
-	github.com/labstack/echo-jwt/v4 v4.2.0 // indirect
-	github.com/labstack/gommon v0.4.2 // indirect
+	github.com/labstack/gommon v0.5.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20230110061619-bbe2e5e100de // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mholt/archiver/v3 v3.5.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
 	github.com/nwaples/rardecode v1.1.3 // indirect
-	github.com/perimeterx/marshmallow v1.1.4 // indirect
+	github.com/oasdiff/yaml v0.1.1 // indirect
+	github.com/oasdiff/yaml3 v0.0.14 // indirect
 	github.com/pierrec/lz4/v4 v4.1.17 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20221212215047-62379fc7944b // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tklauser/go-sysconf v0.3.11 // indirect
 	github.com/tklauser/numcpus v0.6.0 // indirect
-	github.com/ugorji/go/codec v1.2.11 // indirect
-	github.com/ulikunitz/xz v0.5.11 // indirect
+	github.com/ulikunitz/xz v0.5.16 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20230713183714-613f0c0eb8a1 // indirect
-	golang.org/x/image v0.6.0 // indirect
-	golang.org/x/net v0.25.0 // indirect
-	golang.org/x/text v0.15.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	golang.org/x/image v0.44.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect