From bdf89aa0ebac3275ccb97638d707a10662deadd9 Mon Sep 17 00:00:00 2001 From: sickle <2628797272@qq.com> Date: Mon, 13 Jan 2025 20:30:07 +0800 Subject: [PATCH] v0.2.1.9 --- README.md | 3 ++- content/config/scanner.config.js | 21 +++++++++++++++++++-- content/filters/scanner.filter.js | 20 ++++++++++++++++++++ 3 files changed, 41 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 3b752ec..e41cabf 100644 --- a/README.md +++ b/README.md @@ -77,4 +77,5 @@ - 修改了页面样式(信息搜集,配置页面) - 新增指纹嗅探页面(静态) - 新增完善静态文件匹配 -- 完善手机号的正则匹配 \ No newline at end of file +- 完善手机号的正则匹配 +- 完善API匹配,增加过滤器 \ No newline at end of file diff --git a/content/config/scanner.config.js b/content/config/scanner.config.js index df0e394..584da8d 100644 --- a/content/config/scanner.config.js +++ b/content/config/scanner.config.js @@ -20,9 +20,26 @@ const SCANNER_CONFIG = { // API 相关配置 API: { - PATTERN: /['"](?:\/|\.\.\/|\.\/)[^\/\&\>\< \)\(\{\}\,\'\"\\]([^\>\< \)\(\{\}\,\'\"\\])*?[\'"]/g, + PATTERN: /['"`](?:\/|\.\.\/|\.\/)[^\/\>\< \)\(\}\,\'\"\\](?:[^\^\>\< \)\(\{\}\,\'\"\\])*?['"`]|['"`][a-zA_Z0-9]+(?\< \)\(\{\}\,\'\"\\])*?["'`]/g, // 静态文件后缀 - 增强匹配规则 - STATIC_FILE_PATTERN: /\.(js|css|ico|png|webp|jpg|jpeg|gif|svg|woff|woff2|ttf|eot|map|json|jsonp)(?:\?[^'"]*)?$/i + STATIC_FILE_PATTERN: /\.(js|css|ico|png|webp|jpg|jpeg|gif|svg|woff|woff2|ttf|eot|map|json|jsonp)(?:\?[^'"]*)?$/i, + // 需要过滤的内容类型 + FILTERED_CONTENT_TYPES: [ + // 图片类型 + 'image/jpeg', + 'image/gif', + 'image/bmp', + 'image/png', + 'image/x-png', + 'image/webp', + 'image/svg+xml', + 'image/x-emf', + 'image/x-wmf', + 'image/x-icon', + 'image/tiff', + + 'multipart/form-data', + ] }, // 域名相关配置 diff --git a/content/filters/scanner.filter.js b/content/filters/scanner.filter.js index 0a79f0a..7eddaa4 100644 --- a/content/filters/scanner.filter.js +++ b/content/filters/scanner.filter.js @@ -9,9 +9,29 @@ const SCANNER_FILTER = { // 检查是否是静态文件 if (SCANNER_CONFIG.API.STATIC_FILE_PATTERN.test(match)) { resultsSet?.staticFiles?.add(match); + return true; + } + + // 尝试获取文件扩展名或内容类型标识 + let contentType = ''; + try { + // 从URL中提取可能的内容类型标识 + const lcMatch = match.toLowerCase(); + contentType = SCANNER_CONFIG.API.FILTERED_CONTENT_TYPES.find(type => + lcMatch.includes(type.toLowerCase()) || + lcMatch.includes(type.split('/')[1]) // 匹配类型的后缀部分 + ) || ''; + } catch (e) { + console.error('Error extracting content type:', e); + } + + // 如果URL暗示这是一个被过滤的内容类型,将其添加到静态文件中 + if (contentType) { + resultsSet?.staticFiles?.add(match); } else { resultsSet?.apis?.add(match); } + return true; }; })(),