XMOJ-Script-dev/XMOJ-Script

[Feature Request] GetAnalytics的前端

Closed this issue · 21 comments

boomzero commented

检查项

  • 我已确认了XMOJ增强脚本已为最新版，且最新版未实现这一功能。
  • 我已在 Issues 页面 中搜索，确认了这一提案未被提交过。

描述

        GetAnalytics: async (Data: object): Promise<Result> => {
            ThrowErrorIfFailed(this.CheckParams(Data, {
                "Username": "string"
            }));
            if (Data["Username"] !== this.Username && !this.IsAdmin()) {
                return new Result(false, "没有权限获取此用户日志");
            }
            const query = "SELECT index1 AS username, blob1 AS ip, blob2 AS path, timestamp FROM logdb WHERE index1=\'" + Data["Username"] + "\' ORDER BY timestamp ASC"
            const API = `https://api.cloudflare.com/client/v4/accounts/${this.ACCOUNT_ID}/analytics_engine/sql`;
            const response = await fetch(API, {
                method: 'POST',
                headers: {
                    'Authorization': `Bearer ${this.API_TOKEN}`,
                },
                body: query,
            });
            const responseJSON = await response.json();
            return new Result(true, "获得分析数据成功", responseJSON);
        },
    };

原因

No response

PythonSmall-Q commented

approve

langningchen commented

@boomzero @PythonSmall-Q 这是谁写的后段代码？

langningchen commented

直接用字符串拼接查询SQL

langningchen commented

而且两个字符串过滤也没有

langningchen commented

你们好好想想安全性吧

PythonSmall-Q commented
boomzero commented
boomzero commented
boomzero commented
boomzero commented
langningchen commented

如果一个人是 Admin ，那他就能 Hack

langningchen commented

比如最简单的，' OR 1=1 ORDER BY timestamp ASC#

boomzero commented
boomzero commented
langningchen commented

@boomzero 我看了，很好！ 👍

PythonSmall-Q commented

我tm怎么又被close了

langningchen commented

@PythonSmall-Q 你们自己设置的 actions

boomzero commented
boomzero commented

没事, 没人用, 不写了