From 527092f23bc3f8d8bbab0066adc0826c4bbfa74c Mon Sep 17 00:00:00 2001 From: Autumn-27 <53844290+Autumn-27@users.noreply.github.com> Date: Wed, 30 Sep 2026 04:12:57 -0400 Subject: [PATCH] =?UTF-8?q?feat(intercept):=20=E6=96=B0=E5=A2=9E=E5=86=85?= =?UTF-8?q?=E7=BD=AE=E6=8B=A6=E6=88=AA=E8=A7=84=E5=88=99=E3=80=8C=E5=88=A0?= =?UTF-8?q?=E9=99=A4=E7=B1=BB=E6=8E=A5=E5=8F=A3=E8=B7=AF=E5=BE=84=E3=80=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 内置的 HTTP 破坏性规则只认 DELETE 方法（curl -X DELETE、requests.delete(、 method:'DELETE'），路径类规则的词表又只有 /clear /wipe /flush /purge /truncate /drop /destroy /factory-reset /reset-all。而多数应用的删除接口用 GET/POST 就能 触发，于是 `curl 'http://t/api/user/delete?id=1'` 不命中任何内置规则，会真实删掉 目标数据。 补一条 deny 规则覆盖 /delete /del /remove /unlink /erase /destroy，允许 /deleteAll、/delete_user、/delete-user 这类后缀形式（destroy 是重复覆盖：v1 那条 不允许后缀，/destroyAll 是漏的）。动词后强制跟分隔符，/delivery、/details、 /delta、/delegate 不会被误拦。 种子走独立标记位 intercept_default_rules_v3，已有实例升级后也会拿到——改 v1 的 字面量对老库无效（标记位已是 done）。插入带 WHERE NOT EXISTS 兜底，标记位丢失也 不会插重复。正则提为包级常量，配纯正则单测（不依赖 DB）覆盖命中与误伤两侧。 --- CHANGELOG.md | 6 ++++- db/db.go | 37 +++++++++++++++++++++++++++++++ db/intercept_seed_test.go | 46 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 88 insertions(+), 1 deletion(-) create mode 100644 db/intercept_seed_test.go diff --git a/CHANGELOG.md b/CHANGELOG.md index ee007d5..55efead 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,11 @@ ## [Unreleased] -### 流量 +### 拦截 + +#### 新增的功能 + +- **新增内置拦截规则「删除类接口路径」**：此前内置的 HTTP 破坏性规则只认 DELETE **方法**（`curl -X DELETE`、`requests.delete(`、`method:'DELETE'`），路径类规则的词表又只有 `/clear /wipe /flush /purge /truncate /drop /destroy /factory-reset /reset-all`——而多数应用的删除接口用 GET/POST 就能触发，于是 `curl 'http://t/api/user/delete?id=1'` 这类调用不命中任何内置规则，会真实删掉目标数据。现补一条 `deny` 规则覆盖 `/delete /del /remove /unlink /erase /destroy`（允许 `/deleteAll`、`/delete_user`、`/delete-user` 这类后缀形式），动词后必须跟分隔符，`/delivery`、`/details`、`/delta`、`/delegate` 不会被误拦。规则走独立的种子标记位，**已有实例升级后也会拿到**；和其余内置规则一样可在「系统 → 命令拦截」里停用或删除。 #### 新增的功能 diff --git a/db/db.go b/db/db.go index 8985235..a56f0db 100644 --- a/db/db.go +++ b/db/db.go @@ -261,6 +261,9 @@ ON CONFLICT (name) DO NOTHING`, if err := d.seedDefaultInterceptRulesV2(); err != nil { return fmt.Errorf("seed intercept rules v2: %w", err) } + if err := d.seedDefaultInterceptRulesV3(); err != nil { + return fmt.Errorf("seed intercept rules v3: %w", err) + } if err := d.seedDefaultAssetInterceptRules(); err != nil { return fmt.Errorf("seed asset intercept rules: %w", err) } @@ -563,3 +566,37 @@ ON CONFLICT DO NOTHING`, } return d.SetSetting("intercept_default_rules_v2", "done") } + +// seedDefaultInterceptRulesV3 adds the delete-endpoint path rule. The v1 HTTP rules +// only catch the DELETE *method* (curl -X DELETE, requests.delete(, method:'DELETE'), +// and v1's path rule covers only /clear /wipe /flush /purge /truncate /drop /destroy +// /factory-reset /reset-all — so a plain `curl 'http://t/api/user/delete?id=1'` (a +// delete endpoint reached with GET/POST, which is how most web apps expose deletion) +// slipped through every built-in rule. Own flag so it also lands on DBs that already +// ran v1/v2, where editing the v1 seed would have no effect. +// +// The pattern deliberately requires a separator after the verb so /delivery, +// /details, /delta and /delegate do not match, while /deleteAll, /delete_user and +// /delete-user do. destroy is re-covered here because v1's rule does not allow a +// suffix (/destroyAll was missed). +// +// Exported as a package const only so the seeded regex is unit-testable without a DB. +const deleteEndpointPathPattern = `(?i)/(?:(?:delete|remove|unlink|erase|destroy)[-\w]*|del)(?:[/?#"'\s]|$)` + +func (d *DB) seedDefaultInterceptRulesV3() error { + if v, _, _ := d.GetSetting("intercept_default_rules_v3"); v == "done" { + return nil + } + const name = "[内置] 删除类接口路径" + if _, err := d.Exec(` +INSERT INTO intercept_rules(name, enabled, priority, match_target, match_type, pattern, action, message, timeout_enabled, timeout_seconds, timeout_action) +SELECT $1, true, 80, 'tool_input', 'regex', $2, 'deny', $3, false, 60, 'deny' +WHERE NOT EXISTS (SELECT 1 FROM intercept_rules WHERE name = $1)`, + name, + deleteEndpointPathPattern, + "禁止调用删除类接口（/delete /remove /unlink /erase 等），不论使用哪种 HTTP 方法——多数应用的删除接口用 GET/POST 就能触发，同样会真实删除目标数据", + ); err != nil { + return fmt.Errorf("rule %q: %w", name, err) + } + return d.SetSetting("intercept_default_rules_v3", "done") +} diff --git a/db/intercept_seed_test.go b/db/intercept_seed_test.go new file mode 100644 index 0000000..595c1b8 --- /dev/null +++ b/db/intercept_seed_test.go @@ -0,0 +1,46 @@ +package db + +import ( + "regexp" + "testing" +) + +// 内置「删除类接口路径」规则匹配的是整个 tool_input JSON 串，因此用例直接以 +// JSON 形态给出，与 Interceptor 实际拿到的 subject 一致。 +func TestDeleteEndpointPathPattern(t *testing.T) { + re := regexp.MustCompile(deleteEndpointPathPattern) + + hit := []string{ + `{"command":"curl -s 'http://t.com/api/user/delete?id=1'"}`, // GET 打删除接口 + `{"command":"curl -X POST http://t.com/admin/delete -d id=1"}`, // POST 打删除接口 + `{"command":"curl 'http://t.com/api/deleteAll'"}`, + `{"command":"curl 'http://t.com/api/delete_user?id=1'"}`, + `{"command":"curl 'http://t.com/api/delete-user?id=1'"}`, + `{"url":"http://t.com/api/remove?id=1"}`, + `{"command":"curl http://t.com/files/unlink/3"}`, + `{"command":"curl http://t.com/api/del?id=2"}`, + `{"command":"curl -X POST http://t/v1/erase"}`, + `{"command":"curl http://t/admin/destroyAll"}`, // v1 的路径规则不允许后缀，这里补上 + } + for _, s := range hit { + if !re.MatchString(s) { + t.Errorf("应命中却放行: %s", s) + } + } + + // 动词后必须跟分隔符，避免 /delivery、/details 这类只读路径被误拦。 + miss := []string{ + `{"command":"curl 'http://t.com/api/delivery?id=1'"}`, + `{"command":"curl 'http://t.com/order/details'"}`, + `{"command":"curl 'http://t.com/api/delta/sync'"}`, + `{"command":"curl 'http://t.com/user/delegate'"}`, + `{"command":"curl 'http://delete.example.com/'"}`, // 删除动词出现在域名而非路径 + `{"command":"curl 'http://t.com/remote/status'"}`, + `{"command":"nmap -p80 10.0.0.1"}`, + } + for _, s := range miss { + if re.MatchString(s) { + t.Errorf("误拦: %s", s) + } + } +}