From 7b4e62db752ff663e56df36990345d4c26be59dc Mon Sep 17 00:00:00 2001 From: sickle <2628797272@qq.com> Date: Mon, 17 Feb 2025 20:40:05 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E4=B8=80=E4=BA=9Bbug?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- content/config/scanner.config.js | 23 +++++++++++++++++----- content/content.js | 33 +++++++++++++++++++++++++++----- popup/popup.js | 4 ++-- 3 files changed, 48 insertions(+), 12 deletions(-) diff --git a/content/config/scanner.config.js b/content/config/scanner.config.js index 8a5383c..db29fce 100644 --- a/content/config/scanner.config.js +++ b/content/config/scanner.config.js @@ -123,7 +123,12 @@ const SCANNER_CONFIG = { URL: /(?:https?|wss?|ftp):\/\/(?:(?:[\w-]+\.)+[a-z]{2,}|(?:\d{1,3}\.){3}\d{1,3})(?::\d{2,5})?(?:\/[^\s\>\)\}\<'"]*)?/gi, JWT: /["'](?:ey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}|ey[A-Za-z0-9_\/+-]{10,}\.[A-Za-z0-9._\/+-]{10,})["']/g, COMPANY: /(?:[\u4e00-\u9fa5\（\）]{4,15}[^的](?:公司|中心)|[\u4e00-\u9fa5\（\）]{2,10}[^的](?:软件)|[\u4e00-\u9fa5]{2,15}(?:科技|集团))(?!法|点|与|查)/g, - CREDENTIALS: /(?:(['"])\b(?:\w*(?:pwd|pass|user|member|account|password|passwd|admin|root|system)[_-]?(?:id|name)?[0-9]*?)\1|\b(?:\w*(?:pwd|pass|user|account|password|passwd|admin|root|system)[_-]?(?:id|name)?[0-9]*?))\s*[:=]\s*(?:"(?!\+)[^\,\s\"\(]*"|'(?!\+)[^\,\s\'\(]*'|[\d\s]+)/gi, + get CREDENTIALS() { + return { + type: 'CREDENTIALS', + patterns: SCANNER_CONFIG.CREDENTIALS.PATTERNS + }; + }, COOKIE: /\b\w*(?:token|PHPSESSID|JSESSIONID)\s*[:=]\s*["']?(?!localStorage)(?:[a-zA-Z0-9-]{4,})["']?/ig, get ID_KEY() { return { @@ -148,7 +153,7 @@ const SCANNER_CONFIG = { 'ken','key','lea','log','low','met','mod','new','nor','not','num','red','obj', 'old','out','pic','pre','pro','pop','pun','put','rad','ran','ref','red','reg', 'ren','rig','row','sea','set','seq','shi','str','sub','sup','sun','tab','tan', - 'tip','top','uri','url','use','ver','via','rce' + 'tip','top','uri','url','use','ver','via','rce','sum','bit','kit' ]), MEDIUM_VALUES: new Set([ 'null','node','when','face','read','load','body','left','mark','down', @@ -164,7 +169,8 @@ const SCANNER_CONFIG = { 'jump','wave','land','wood','lize','room','chat','user','vice','ress', 'line','send','mess','calc','http','rame','rest','last','guar','iate', 'ment','task','stat','fill','coun','faul','rece','arse','exam','good', - 'gest','word','cast','lock' + 'gest','word','cast','lock','slot','fund','plus','thre','sign','pack', + 'reak','code','tent','math','lect','draw','lend' ]), LONG_VALUES: new Set([ 'about','alias','apply','array','basic','beare','begin','black','break', @@ -178,7 +184,7 @@ const SCANNER_CONFIG = { 'button','cancel','create','double','finger','global','insert','module', 'normal','object','popper','triple','search','select','simple','single', 'status','statis','switch','system','visual','verify','detail','screen', - 'member','change','buffer' + 'member','change','buffer','grade' ]), CHINESE_BLACKLIST: new Set([ '请','输入','前往','整个','常用','咨询','为中心','是否','以上','目前','任务', @@ -210,7 +216,7 @@ const SCANNER_CONFIG = { {name: 'GitHub Token2', pattern: /(?:ghp|gho|ghu|ghs|ghr|github_pat)_[a-zA-Z0-9_]{36,255}/g}, {name: 'Apple开发者密钥', pattern: /APID[a-zA-Z0-9]{32,42}/g}, {name: '企业微信密钥', pattern: /ww[a-z0-9]{15,18}/g}, - {name: 'key1', pattern: /(?:['"]?(?:\w*(?:key|secret|oss|bucket)\w*)|ak["']?)\s*[:=]\s*(?:"(?!\+)[^\,\s\"\(\>\<]*"|'(?!\+)[^\,\s\'\(\>\<]*'|[\d\s]+)/ig}, + {name: 'key1', pattern: /(?:['"]?(?:[\w-]*(?:secret|oss|bucket|key)[\w-]*)|ak["']?)\s*[:=]\s*(?:"(?!\+)[^\,\s\"\(\>\<]{6,}"|'(?!\+)[^\,\s\'\(\>\<]{6,}'|[0-9a-zA-Z_-]{16,})/ig}, {name: 'key2', pattern: /["'][a-zA-Z0-9]{32}["']/g} ], @@ -219,6 +225,13 @@ const SCANNER_CONFIG = { 'size', 'row', 'dict', 'up', 'highlight', 'cabin', 'cross','time' ]) }, + CREDENTIALS: { + PATTERNS: [ + {pattern: /['"]\w*(?:pwd|pass|user|member|account|password|passwd|admin|root|system)[_-]?(?:id|name)?[0-9]*["']\s*[:=]\s*(?:['"][^\,\s\"\(]*["'])/gi}, + {pattern: /\w*(?:pwd|pass|user|member|account|password|passwd|admin|root|system)[_-]?(?:id|name)?[0-9]*\s*[:=]\s*(?:['"][^\,\s\"\(]*["'])/gi}, + {pattern: /['"]\w*(?:pwd|pass|user|member|account|password|passwd|admin|root|system)[_-]?(?:id|name)?[0-9]*\s*[:=]\s*(?:[^\,\s\"\(]*)["']/gi}, + ] + }, // 添加构建工具配置 FINGER: { diff --git a/content/content.js b/content/content.js index ee3735c..81c432c 100644 --- a/content/content.js +++ b/content/content.js @@ -1,5 +1,5 @@ // 在文件开头添加动态扫描状态变量 -let dynamicScanEnabled = true; +let dynamicScanEnabled = false; let deepScanEnabled = false; // 在初始化时获取设置 @@ -160,7 +160,7 @@ async function scanSources(sources, isHtmlContent = false) { } // API模式特殊处理 - if (key === 'API' && pattern && typeof pattern === 'object') { + if (key === 'API') { const apiPattern = SCANNER_CONFIG.API.PATTERN; while ((match = apiPattern.exec(chunk)) !== null) { if (apiPattern.lastIndex <= lastIndex) { @@ -178,9 +178,32 @@ async function scanSources(sources, isHtmlContent = false) { } continue; } + if (key === 'CREDENTIALS') { + // 对每个模式进行匹配 + for (const {pattern: credentialsPattern} of pattern.patterns) { + let patternLastIndex = 0; // 每个模式独立的 lastIndex + while ((match = credentialsPattern.exec(chunk)) !== null) { + if (credentialsPattern.lastIndex <= patternLastIndex) { + window.logger.warn(`检测到可能的无限循环: CREDENTIALS Pattern`); + break; + } + patternLastIndex = credentialsPattern.lastIndex; + + if (--maxIterations <= 0) { + window.logger.warn(`达到最大迭代次数: CREDENTIALS`); + break; + } + + filter(match[0], latestResults); + } + // 重置正则表达式的 lastIndex + credentialsPattern.lastIndex = 0; + } + continue; + } // ID_KEY模式特殊处理 - if (pattern && pattern.type === 'ID_KEY') { + if (key === 'ID_KEY') { // 对每个模式进行匹配 for (const {pattern: idKeyPattern} of pattern.patterns) { let patternLastIndex = 0; // 每个模式独立的 lastIndex @@ -227,7 +250,7 @@ async function scanSources(sources, isHtmlContent = false) { }; // 处理单个源 - const processSource = (source) => { + const processSource = async (source) => { if (!source || seen.has(source)) return; seen.add(source); @@ -241,7 +264,7 @@ async function scanSources(sources, isHtmlContent = false) { sendUpdate(); lastUpdateTime = Date.now(); // 给主线程一个喘息的机会 - return new Promise(resolve => setTimeout(resolve, 0)); + await new Promise(resolve => setTimeout(resolve, 0)); } } } catch (e) { diff --git a/popup/popup.js b/popup/popup.js index b070619..2838988 100644 --- a/popup/popup.js +++ b/popup/popup.js @@ -268,8 +268,8 @@ document.addEventListener('DOMContentLoaded', () => { // 获取动态扫描开关状态 chrome.storage.local.get(['dynamicScan', 'deepScan'], (result) => { - document.getElementById('dynamicScan').checked = result.dynamicScan !== false; - document.getElementById('deepScan').checked = result.deepScan === true; + document.getElementById('dynamicScan').checked = result.dynamicScan == true; + document.getElementById('deepScan').checked = result.deepScan == true; }); // 监听动态扫描开关变化