tcjlj/OpenFlare
1
0
Fork 0
mirror of https://github.com/Rain-kl/OpenFlare.git synced 2026-10-05 15:26:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(core): sync framework security hardening and accessibility improvements

Browse Source 
- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md
This commit is contained in:
ryan
2026-08-27 23:01:28 +08:00
parent b66cf3ae9c
commit ae3b792e16
63 changed files with 570 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/apps/user/errs.go
+1
View File
@@ -44,4 +44,5 @@ const (
errParseEmailPayloadFailed = "解析邮件发送参数失败: %w"
errSMTPConfigIncomplete = "系统 SMTP 邮件服务配置不完整"
errSendMailFailed = "发送邮件失败: %w"
errLoginRateLimited = "请求过于频繁，请稍后再试"
)
internal/apps/user/logics.go
+51 -4
View File
@@ -6,14 +6,17 @@ package user
import (
"context"
"crypto/rand"
"crypto/sha256"
"crypto/subtle"
"encoding/json"
"errors"
"fmt"
"math/big"
"strings"
"time"
"github.com/Rain-kl/Wavelet/internal/apps/oauth"
"github.com/Rain-kl/Wavelet/internal/infra/persistence"
db "github.com/Rain-kl/Wavelet/internal/infra/persistence"
"github.com/Rain-kl/Wavelet/internal/infra/task"
"github.com/Rain-kl/Wavelet/internal/model"
"github.com/Rain-kl/Wavelet/internal/repository"
@@ -49,6 +52,48 @@ type updateProfileInput struct {
Location string
}
const (
loginFailLimitKeyFormat = "login:fail:%s"
loginFailLimitMax = 20
loginFailLimitWindow = 10 * time.Minute
)
func loginFailLimitKey(ip string) string {
return fmt.Sprintf(loginFailLimitKeyFormat, strings.TrimSpace(ip))
}
func loginAttemptsBlocked(ctx context.Context, ip string) bool {
if db.Redis == nil {
return false
}
n, err := db.Redis.Get(ctx, db.PrefixedKey(loginFailLimitKey(ip))).Int()
if err != nil {
return false
}
return n >= loginFailLimitMax
}
func recordFailedLogin(ctx context.Context, ip string) {
if db.Redis == nil {
return
}
key := db.PrefixedKey(loginFailLimitKey(ip))
n, err := db.Redis.Incr(ctx, key).Result()
if err != nil {
return
}
if n == 1 {
_ = db.Redis.Expire(ctx, key, loginFailLimitWindow).Err()
}
}
func clearFailedLogins(ctx context.Context, ip string) {
if db.Redis == nil {
return
}
_ = db.Redis.Del(ctx, db.PrefixedKey(loginFailLimitKey(ip))).Err()
}
func isPasswordLoginEnabled(ctx context.Context) bool {
enabled, err := repository.GetBoolByKey(ctx, model.ConfigKeyPasswordLoginEnabled)
if err != nil {
@@ -60,7 +105,7 @@ func isPasswordLoginEnabled(ctx context.Context) bool {
func isPasswordRegisterEnabled(ctx context.Context) bool {
enabled, err := repository.GetBoolByKey(ctx, model.ConfigKeyPasswordRegisterEnabled)
if err != nil {
return true
return false
}
return enabled
}
@@ -68,7 +113,7 @@ func isPasswordRegisterEnabled(ctx context.Context) bool {
func isRegistrationEnabled(ctx context.Context) bool {
enabled, err := repository.GetBoolByKey(ctx, model.ConfigKeyRegistrationEnabled)
if err != nil {
return true
return false
}
return enabled
}
@@ -161,7 +206,9 @@ func verifyEmailCode(ctx context.Context, email, scene, code string) bool {
if err := db.GetJSON(ctx, codeKey, &storedCode); err != nil {
return false
}
if storedCode != code {
sumGot := sha256.Sum256([]byte(strings.TrimSpace(code)))
sumWant := sha256.Sum256([]byte(strings.TrimSpace(storedCode)))
if subtle.ConstantTimeCompare(sumGot[:], sumWant[:]) != 1 {
return false
}
_ = db.Redis.Del(ctx, db.PrefixedKey(codeKey)).Err()
internal/apps/user/routers.go
+18 -50
View File
@@ -4,20 +4,17 @@
package user
import (
"context"
"net/http"
"strings"
"time"
"github.com/Rain-kl/Wavelet/internal/apps/oauth"
"github.com/Rain-kl/Wavelet/internal/infra/config"
"github.com/Rain-kl/Wavelet/internal/infra/persistence/idgen"
"github.com/Rain-kl/Wavelet/internal/listener"
"github.com/Rain-kl/Wavelet/internal/model"
"github.com/Rain-kl/Wavelet/internal/repository"
"github.com/Rain-kl/Wavelet/internal/shared"
"github.com/Rain-kl/Wavelet/internal/shared/response"
"github.com/Rain-kl/Wavelet/pkg/logger"
pkgu "github.com/Rain-kl/Wavelet/pkg/util"
"github.com/gin-contrib/sessions"
"github.com/gin-gonic/gin"
)
@@ -53,41 +50,6 @@ type updateProfileRequest struct {
Location string `json:"location"`
}
func setLoginSession(ctx context.Context, c *gin.Context, user *model.User) error {
session := sessions.Default(c)
session.Set(oauth.UserIDKey, user.ID)
session.Set(oauth.UserNameKey, user.Username)
session.Set(oauth.PasswordHashKey, user.Password)
// 根据系统配置动态设置 Session 过期时间
maxAge := config.Config.App.SessionAge
isSessionCookie := false
ttlHours, err := repository.GetIntByKey(ctx, model.ConfigKeyLoginSessionTTLHours)
if err == nil {
switch {
case ttlHours == -1:
// 永不过期，设置为 10 年
maxAge = 10 * 365 * 24 * 3600
case ttlHours > 0:
maxAge = ttlHours * 3600
case ttlHours == 0:
isSessionCookie = true
}
}
session.Options(oauth.GetSessionOptions(maxAge))
if err := session.Save(); err != nil {
return err
}
if isSessionCookie {
oauth.StripCookieMaxAgeAndExpires(c.Writer.Header(), config.Config.App.SessionCookieName)
}
return nil
}
// Login 用户密码登录
// @Summary 用户密码登录
// @Description 使用用户名和密码登录，登录成功后建立 Session。若管理员已关闭密码登录功能则返回错误。
@@ -96,7 +58,7 @@ func setLoginSession(ctx context.Context, c *gin.Context, user *model.User) erro
// @Produce json
// @Param request body user.loginRequest true "登录请求参数"
// @Success 200 {object} response.Any{data=oauth.BasicUserInfo} "登录成功，返回用户信息"
// @Failure 400 {object} response.Any "用户名或密码错误、帐号已禁用等"
// @Failure 400 {object} response.Any "用户名或密码错误"
// @Failure 500 {object} response.Any "服务内部错误"
// @Router /api/v1/user/login [post]
func Login(c *gin.Context) {
@@ -105,6 +67,10 @@ func Login(c *gin.Context) {
response.AbortBadRequest(c, errPasswordLoginDisabled)
return
}
if loginAttemptsBlocked(ctx, c.ClientIP()) {
response.AbortBadRequest(c, errLoginRateLimited)
return
}
var req loginRequest
if err := c.ShouldBindJSON(&req); err != nil {
response.AbortBadRequest(c, err.Error())
@@ -118,13 +84,16 @@ func Login(c *gin.Context) {
user, err := getUserByUsernameOrEmail(ctx, req.Username)
if err != nil {
pkgu.DummyCheckPassword(req.Password)
recordFailedLogin(ctx, c.ClientIP())
logger.WarnF(ctx, "[LoginAudit] failed login attempt (username not found) for input: %s, IP: %s", req.Username, c.ClientIP())
response.AbortBadRequest(c, errUsernameOrPasswordWrong)
return
}
if !user.IsActive {
recordFailedLogin(ctx, c.ClientIP())
logger.WarnF(ctx, "[LoginAudit] banned user login attempt for username: %s, ID: %d, IP: %s", user.Username, user.ID, c.ClientIP())
response.AbortBadRequest(c, shared.BannedAccount)
response.AbortBadRequest(c, errUsernameOrPasswordWrong)
return
}
@@ -132,6 +101,7 @@ func Login(c *gin.Context) {
isPlaintext := !user.IsPasswordEncrypted()
if !user.CheckPassword(req.Password) {
recordFailedLogin(ctx, c.ClientIP())
logger.WarnF(ctx, "[LoginAudit] failed login attempt (incorrect password) for username: %s, ID: %d, IP: %s", user.Username, user.ID, c.ClientIP())
response.AbortBadRequest(c, errUsernameOrPasswordWrong)
return
@@ -149,21 +119,19 @@ func Login(c *gin.Context) {
}
}
session := sessions.Default(c)
needChangePassword := isPlaintext
if isPlaintext {
session.Set("need_change_password", true)
} else {
session.Delete("need_change_password")
}
user.LastLoginAt = time.Now()
if err := updateLastLogin(ctx, user); err != nil {
response.AbortBadRequest(c, "更新登录时间失败，请稍后再试")
return
}
if err := setLoginSession(ctx, c, user); err != nil {
extras := map[string]any{}
if isPlaintext {
extras["need_change_password"] = true
}
clearFailedLogins(ctx, c.ClientIP())
if err := oauth.SetLoginSession(ctx, c, user, extras); err != nil {
response.AbortBadRequest(c, errSaveSessionFailed)
return
}
@@ -253,7 +221,7 @@ func Register(c *gin.Context) {
return
}
if err := setLoginSession(ctx, c, &user); err != nil {
if err := oauth.SetLoginSession(ctx, c, &user); err != nil {
response.AbortBadRequest(c, errSaveSessionFailed)
return
}