bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

∞+1 安全加固: 盐值持久化 + IP哈希完整 + IP获取日志 

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/e26c30a9-d5c9-4068-959b-bc4acf16ae4e

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-04-06 08:14:52 +00:00 committed by GitHub
parent f840915ba0
commit d1290ac5a8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
server/proxy/service/bandwidth-pool-agent.js
View File

@ -46,7 +46,20 @@ const THREAT_LOG_FILE = path.join(DATA_DIR, 'bandwidth-threat-log.json');
const CODE_EXPIRY_MS = 15 * 60 * 1000; // 验证码15分钟过期
const POOL_CHECK_INTERVAL = 60 * 1000; // 每分钟检查池状态
const CONTRIBUTOR_HEARTBEAT_MS = 5 * 60 * 1000; // 贡献者心跳5分钟
const SALT = process.env.ZY_BW_SALT || 'guanghu-bw-pool-2026';
const SALT = process.env.ZY_BW_SALT || (() => {
// 如果未设置环境变量，从密钥文件中读取或生成持久化盐值
const saltFile = path.join(DATA_DIR, '.bw-salt');
try {
return fs.readFileSync(saltFile, 'utf8').trim();
} catch {
const generated = crypto.randomBytes(32).toString('hex');
try {
fs.mkdirSync(DATA_DIR, { recursive: true });
fs.writeFileSync(saltFile, generated, { mode: 0o600 });
} catch { /* 无法持久化时使用内存值 */ }
return generated;
}
})();
// ═══════════════════════════════════════════════
// 🔑 验证码管理
@ -63,7 +76,7 @@ function generateAuthCode() {
* 加密IP地址 (SHA256 + 盐值)
*/
function encryptIP(ip) {
return crypto.createHash('sha256').update(`${SALT}:${ip}`).digest('hex').slice(0, 32);
return crypto.createHash('sha256').update(`${SALT}:${ip}`).digest('hex');
}
/**

4
server/proxy/service/subscription-server-v3.js
View File

@ -855,10 +855,14 @@ mode: direct
}
// 采集用户IP (加密存储)
// 注: X-Forwarded-For由Nginx反代设置，可信来源
const userIP = req.headers['x-forwarded-for']?.split(',')[0]?.trim()
|| req.headers['x-real-ip']
|| req.socket.remoteAddress
|| '0.0.0.0';
if (userIP === '0.0.0.0') {
console.warn('[带宽授权] 无法获取用户IP，使用0.0.0.0');
}
// 注册为带宽贡献者
const regResult = bwPool.registerContributor(user.email, userIP);