Nodejs代码安全审计之YAPI

            /*
            *
   * 测试 单文件上传
   * @interface /test/single/upload
   * @method POST
   * @returns {Object}
   * @example
   
            */
            
  async testSingleUpload(ctx) {
    
            try
             {
      
            //
             let params = ctx.request.body;
      let req = ctx.req;

      let chunks = [],
        size = 0;
      req.on(‘data‘, function(chunk) {
        chunks.push(chunk);
        size += chunk.length;
      });

      req.on(‘finish‘, function() {
        console.log(34343);
      });

      req.on(‘end‘, function() {
        let data = new Buffer(size);
        for (let i = 0, pos = 0, l = chunks.length; i < l; i++) {
          let chunk = chunks[i];
          chunk.copy(data, pos);
          pos += chunk.length;
        }
        fs.writeFileSync(path.join(yapi.WEBROOT_RUNTIME, ‘test.text‘), data, function(err) {
          return (ctx.body = yapi.commons.resReturn(null, 402, ‘写入失败‘));
        });
      });

      ctx.body = yapi.commons.resReturn({ res: ‘上传成功‘ });
    } catch (e) {
      ctx.body = yapi.commons.resReturn(null, 402, e.message);
    }
  }

  /**
   * 测试 文件上传
   * @interface /test/files/upload
   * @method POST
   * @returns {Object}
   * @example
   */
  async testFilesUpload(ctx) {
    try {
      let file = ctx.request.body.files.file;
      let newPath = path.join(yapi.WEBROOT_RUNTIME, ‘test.text‘);
      fs.renameSync(file.path, newPath);
      ctx.body = yapi.commons.resReturn({ res: ‘上传成功‘ });
    } catch (e) {
      ctx.body = yapi.commons.resReturn(null, 402, e.message);
    }
  }

            /*
            *
 * 沙盒执行 js 代码
 * @sandbox Object context
 * @script String script
 * @return sandbox
 *
 * @example let a = sandbox({a: 1}, ‘a=2‘)
 * a = {a: 2}
 
            */
            
exports.sandbox = (sandbox, script) => {
  const vm = require(‘vm‘);
  sandbox = sandbox || {};
  script = new vm.Script(script);
  const context = new vm.createContext(sandbox);
  script.runInContext(context, {
    timeout: 3000
  });

  return sandbox;

exports.runCaseScript = async function runCaseScript(params, colId, interfaceId) {
  const colInst = yapi.getInst(interfaceColModel);
  let colData = await colInst.get(colId);
  const logs = [];
  const context = {
    assert: require(‘assert‘),
    status: params.response.status,
    body: params.response.body,
    header: params.response.header,
    records: params.records,
    params: params.params,
    log: msg => {
      logs.push(‘log: ‘ + convertString(msg));
    }
  };

  let result = {};
  try {

    if(colData.checkHttpCodeIs200){
      let status = +params.response.status;
      if(status !== 200){
        throw (‘Http status code 不是 200，请检查(该规则来源于于 [测试集->通用规则配置] )‘)
      }
    }
  
    if(colData.checkResponseField.enable){
      if(params.response.body[colData.checkResponseField.name] != colData.checkResponseField.value){
        throw (`返回json ${colData.checkResponseField.name} 值不是${colData.checkResponseField.value}，请检查(该规则来源于于 [测试集->通用规则配置] )`)
      }
    }

    if(colData.checkResponseSchema){
      const interfaceInst = yapi.getInst(interfaceModel);
      let interfaceData = await interfaceInst.get(interfaceId);
      if(interfaceData.res_body_is_json_schema && interfaceData.res_body){
        let schema = JSON.parse(interfaceData.res_body);
        let result = schemaValidator(schema, context.body)
        if(!result.valid){
          throw (`返回Json 不符合 response 定义的数据结构,原因: ${result.message}
数据结构如下：
${JSON.stringify(schema,null,2)}`)
        }
      }
    }

    if(colData.checkScript.enable){
      let globalScript = colData.checkScript.content;
      // script 是断言if (globalScript) {
        logs.push(‘执行脚本：‘ + globalScript)
        result = yapi.commons.sandbox(context, globalScript);
      }
    }


    let script = params.script;
    // script 是断言if (script) {
      logs.push(‘执行脚本:‘ + script)
      result = yapi.commons.sandbox(context, script);
    }
    result.logs = logs;
    return yapi.commons.resReturn(result);
  } catch (err) {
    logs.push(convertString(err));
    result.logs = logs;
    logs.push(err.name + ‘: ‘ + err.message)
    return yapi.commons.resReturn(result, 400, err.name + ‘: ‘ + err.message);
  }
};

              async runCaseScript(ctx) {
    let params = ctx.request.body;
    ctx.body = await yapi.commons.runCaseScript(params, params.col_id, params.interface_id, this.getUid());
  }

            ctx.header
ctx.headers
ctx.method
ctx.method=
ctx.url
ctx.url=
ctx.originalUrl
ctx.origin
ctx.href
ctx.path
ctx.path=
ctx.query
ctx.query=
ctx.querystring
ctx.querystring=
ctx.host
ctx.hostname
ctx.fresh
ctx.stale
ctx.socket
ctx.protocol
ctx.secure
ctx.ip
ctx.ips
ctx.subdomains
ctx.is()
ctx.accepts()
ctx.acceptsEncodings()
ctx.acceptsCharsets()
ctx.acceptsLanguages()
ctx.get()