From 628f6d6f931e8c9c66ed9117fc575d700c584778 Mon Sep 17 00:00:00 2001 From: sickle <2628797272@qq.com> Date: Wed, 5 Feb 2025 16:05:06 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AE=8C=E5=96=84=E4=B8=80=E4=BA=9B=E7=BB=86?= =?UTF-8?q?=E8=8A=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- content/config/scanner.config.js | 28 +++++++++++++++------------- content/filters/scanner.filter.js | 14 +++++++------- 2 files changed, 22 insertions(+), 20 deletions(-) diff --git a/content/config/scanner.config.js b/content/config/scanner.config.js index f85b44c..b24a2a9 100644 --- a/content/config/scanner.config.js +++ b/content/config/scanner.config.js @@ -143,24 +143,25 @@ const SCANNER_CONFIG = { BLACKLIST: { // 值黑名单 - 从 ID_KEY 配置中移出 VALUES: new Set([ - 'input', 'about', 'video', 'null', 'top', 'gener', 'charlendar', 'met', + 'input', 'about', 'video', 'null', 'top', 'gener', 'node', 'met', 'when', 'face', 'login', 'read', 'black', 'hand', 'next', 'nect', 'system', 'panel', 'body', 'load', 'red', 'green', 'shift', 'item', 'init', 'print','button','left', - 'finger', 'mark', 'down', 'up', 'ctrl', 'play', 'row', 'ntal', 'header', - 'has', 'range', 'new', 'json', 'url', 'uri', 'long', 'big','right', 'slider', - 'html', 'tion', 'default', 'set', 'serve','select', 'view', 'false', 'expect', - 'broad', 'status', 'dom', 'use', 'rect', 'guard', 'index', 'link', - 'opera', 'main', 'tech','insert', 'char', 'core', 'turn', 'number', 'atom', + 'finger', 'mark', 'down', 'up', 'ctrl', 'play', 'row', 'ntal', 'head', 'low', + 'has', 'range', 'new', 'json', 'url', 'uri', 'long', 'big','right', 'slid', + 'html', 'tion', 'default', 'set', 'serve','select', 'view', 'false', 'less', + 'broad', 'status', 'dom', 'use', 'rect', 'guard', 'index', 'link', 'close', + 'opera', 'main', 'tech','insert', 'char', 'core', 'turn', 'num', 'atom', 'visual','get', 'type','write','error','array','parse','inter', 'size', 'statis','card','extract','full','white','refer', 'wrap', 'emp', 'this', - 'crypt','normal','single','double','triple','more', 'message', 'profile', - 'tool','tance','popper', 'radio', 'area', 'tip', 'color', 'hid', + 'crypt','normal','single','double','triple','more', 'age', 'clude', 'pect', + 'tool','tance','popper', 'radio', 'area', 'tip', 'color', 'hid', 'trans', 'old', 'place', 'parm', 'axis', 'high', 'true', 'simple', 'bool', 'pick', 'date', 'cancel', 'croll', 'late', 'note', 'length', 'class', 'light', - 'param','tend', 'title', 'work','lang', 'func', 'variable', 'dark', - 'data', 'object', 'brac', 'beare', 'string', 'self', 'void', - 'opts', 'token', 'result', 'text', 'con', 'stor', 'sup', 'pun', - 'key', 'com', 'ent', 'case', 'pare', 'dent', 'reg', 'invalid' + 'param','tend', 'title', 'work','lang', 'func', 'able', 'dark', 'term', + 'data', 'object', 'brac', 'beare', 'str', 'self', 'void', 'apply', 'pace', + 'opts', 'token', 'sult', 'text', 'con', 'stor', 'sup', 'pun', 'back', + 'key', 'com', 'ent', 'case', 'pare', 'dent', 'reg', 'valid', 'blot', + 'pro', 'port', 'begin', 'fine','reif','cord', 'module', 'else', 'alias' ]) }, @@ -179,8 +180,9 @@ const SCANNER_CONFIG = { {name: 'GitHub Token2', pattern: /(?:ghp|gho|ghu|ghs|ghr|github_pat)_[a-zA-Z0-9_]{36,255}/g}, {name: 'Apple开发者密钥', pattern: /APID[a-zA-Z0-9]{32,42}/g}, {name: '企业微信密钥', pattern: /ww[a-z0-9]{15,18}/g}, - {name: 'key', pattern: /(?:['"]?(?:\w*(?:key|secret|oss|bucket)\w*)["']?)\s*[:=]\s*(?:"(?!\+)[^\,\s\"\(]*"|'(?!\+)[^\,\s\'\(]*'|[\d\s]+)/ig} + {name: 'key', pattern: /(?:['"]?(?:\w*(?:key|secret|oss|bucket)\w*)["']?)\s*[:=]\s*(?:"(?!\+)[^\,\s\"\(\>\<]*"|'(?!\+)[^\,\s\'\(\>\<]*'|[\d\s]+)/ig} ], + // 关键词黑名单 KEY_BLACKLIST: new Set([ 'size', 'row', 'dict', 'up', 'highlight', 'cabin', 'cross' diff --git a/content/filters/scanner.filter.js b/content/filters/scanner.filter.js index 387f915..f26999e 100644 --- a/content/filters/scanner.filter.js +++ b/content/filters/scanner.filter.js @@ -6,7 +6,7 @@ const regexCache = { chinesePattern: /^[\u4e00-\u9fa5]+$/, keywordPattern: /^func|variable|input|true|false|newline|null|unexpected|error|data|object|brac|beare|str|self|void|num|atom|opts|token|params|result|con|text|stor|sup|pun|emp|this|key|com|ent|met|opera|return|case|pare|ident|reg|invalid/i, camelCasePattern: /\b[_a-z]+(?:[A-Z][a-z]+)+\b/, - filterPattern: /请|输入|前往|整个|常用|咨询|为中心|以上|目前|任务|推动|一家|项目|等|造价|判断|通过|为了|可以|掌握|传统/ + filterPattern: /请|输入|前往|整个|常用|咨询|为中心|以上|目前|任务|推动|识别|获取|用于|清除|遍历|一家|项目|等|造价|判断|通过|为了|可以|掌握|传统|杀毒|为了|允许|分析/ }; // 统一的扫描过滤器 @@ -254,7 +254,7 @@ const SCANNER_FILTER = { // 检查是否是空值 const valueMatch = match.replace(/\s+/g,'').split(/[:=]/); var key = valueMatch[0].replace(/['"]/g,'').toLowerCase(); - var value = valueMatch[1].replace(/['"\{\}\[\]\，\：\。\？]/g,'').toLowerCase(); + var value = valueMatch[1].replace(/['"\{\}\[\]\，\：\。\？\>\<]/g,'').toLowerCase(); if (!value.length) { return false; } @@ -271,8 +271,8 @@ const SCANNER_FILTER = { if (valueMatch[1].replace(/['"]/g,'').length<4) { return false; } - var key = valueMatch[0].replace(/['"]/g,'').toLowerCase(); - var value = valueMatch[1].replace(/['"]/g,'').toLowerCase(); + var key = valueMatch[0].replace(/['"<>]/g,'').toLowerCase(); + var value = valueMatch[1].replace(/['"<>]/g,'').toLowerCase(); if (!value.length||key==value) { return false; } @@ -289,9 +289,9 @@ const SCANNER_FILTER = { id_key: (match, resultsSet) => { if (match.match(/[:=]/)) { const valueMatch = match.replace(/\s+/g,'').split(/[:=]/); - var key = valueMatch[0].replace(/['"]/g,''); - var value = valueMatch[1].replace(/['"]/g,''); - + var key = valueMatch[0].replace(/['"<>]/g,''); + var value = valueMatch[1].replace(/['"><]/g,''); + console.log(key,value); const keyLower = key.toLowerCase(); const valueLower = value.toLowerCase();