🔧 refactor(console): enhance URL validation and restructure settings module

- Refactor api_info.go to console.go for broader console settings support - Update URL regex pattern to accept both domain names and IP addresses - Add support for IPv4 addresses with optional port numbers - Improve validation to handle formats like http://192.168.1.1:8080 - Add ValidateConsoleSettings function for extensible settings validation - Maintain backward compatibility with existing ValidateApiInfo function - Add comprehensive comments explaining supported URL formats Fixes issue where IP-based URLs were incorrectly rejected as invalid format. Prepares infrastructure for additional console settings validation.
2025-06-10 12:20:26 +08:00
parent 07b47fbf3a
commit d9461a477d
1 changed files with 18 additions and 3 deletions
--- a/setting/console.go
+++ b/setting/console.go
@@ -0,0 +1,141 @@
+package setting
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"one-api/common"
+	"regexp"
+	"strings"
+)
+
+// ValidateConsoleSettings 验证控制台设置信息格式
+func ValidateConsoleSettings(settingsStr string, settingType string) error {
+	if settingsStr == "" {
+		return nil // 空字符串是合法的
+	}
+	
+	switch settingType {
+	case "ApiInfo":
+		return validateApiInfo(settingsStr)
+	default:
+		return fmt.Errorf("未知的设置类型：%s", settingType)
+	}
+}
+
+// validateApiInfo 验证API信息格式
+func validateApiInfo(apiInfoStr string) error {
+	var apiInfoList []map[string]interface{}
+	if err := json.Unmarshal([]byte(apiInfoStr), &apiInfoList); err != nil {
+		return fmt.Errorf("API信息格式错误：%s", err.Error())
+	}
+	
+	// 验证数组长度
+	if len(apiInfoList) > 50 {
+		return fmt.Errorf("API信息数量不能超过50个")
+	}
+	
+	// 允许的颜色值
+	validColors := map[string]bool{
+		"blue": true, "green": true, "cyan": true, "purple": true, "pink": true,
+		"red": true, "orange": true, "amber": true, "yellow": true, "lime": true,
+		"light-green": true, "teal": true, "light-blue": true, "indigo": true,
+		"violet": true, "grey": true,
+	}
+	
+	// URL正则表达式，支持域名和IP地址格式
+	// 域名格式：https://example.com 或 https://sub.example.com:8080
+	// IP地址格式：https://192.168.1.1 或 https://192.168.1.1:8080
+	urlRegex := regexp.MustCompile(`^https?://(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)*[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?|(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))(?::[0-9]{1,5})?(?:/.*)?$`)
+	
+	for i, apiInfo := range apiInfoList {
+		// 检查必填字段
+		urlStr, ok := apiInfo["url"].(string)
+		if !ok || urlStr == "" {
+			return fmt.Errorf("第%d个API信息缺少URL字段", i+1)
+		}
+		
+		route, ok := apiInfo["route"].(string)
+		if !ok || route == "" {
+			return fmt.Errorf("第%d个API信息缺少线路描述字段", i+1)
+		}
+		
+		description, ok := apiInfo["description"].(string)
+		if !ok || description == "" {
+			return fmt.Errorf("第%d个API信息缺少说明字段", i+1)
+		}
+		
+		color, ok := apiInfo["color"].(string)
+		if !ok || color == "" {
+			return fmt.Errorf("第%d个API信息缺少颜色字段", i+1)
+		}
+		
+		// 验证URL格式
+		if !urlRegex.MatchString(urlStr) {
+			return fmt.Errorf("第%d个API信息的URL格式不正确", i+1)
+		}
+		
+		// 验证URL可解析性
+		if _, err := url.Parse(urlStr); err != nil {
+			return fmt.Errorf("第%d个API信息的URL无法解析：%s", i+1, err.Error())
+		}
+		
+		// 验证字段长度
+		if len(urlStr) > 500 {
+			return fmt.Errorf("第%d个API信息的URL长度不能超过500字符", i+1)
+		}
+		
+		if len(route) > 100 {
+			return fmt.Errorf("第%d个API信息的线路描述长度不能超过100字符", i+1)
+		}
+		
+		if len(description) > 200 {
+			return fmt.Errorf("第%d个API信息的说明长度不能超过200字符", i+1)
+		}
+		
+		// 验证颜色值
+		if !validColors[color] {
+			return fmt.Errorf("第%d个API信息的颜色值不合法", i+1)
+		}
+		
+		// 检查并过滤危险字符（防止XSS）
+		dangerousChars := []string{"<script", "<iframe", "javascript:", "onload=", "onerror=", "onclick="}
+		for _, dangerous := range dangerousChars {
+			if strings.Contains(strings.ToLower(description), dangerous) {
+				return fmt.Errorf("第%d个API信息的说明包含不允许的内容", i+1)
+			}
+			if strings.Contains(strings.ToLower(route), dangerous) {
+				return fmt.Errorf("第%d个API信息的线路描述包含不允许的内容", i+1)
+			}
+		}
+	}
+	
+	return nil
+}
+
+// ValidateApiInfo 保持向后兼容的函数
+func ValidateApiInfo(apiInfoStr string) error {
+	return validateApiInfo(apiInfoStr)
+}
+
+// GetApiInfo 获取API信息列表
+func GetApiInfo() []map[string]interface{} {
+	// 从OptionMap中获取API信息，如果不存在则返回空数组
+	common.OptionMapRWMutex.RLock()
+	apiInfoStr, exists := common.OptionMap["ApiInfo"]
+	common.OptionMapRWMutex.RUnlock()
+	
+	if !exists || apiInfoStr == "" {
+		// 如果没有配置，返回空数组
+		return []map[string]interface{}{}
+	}
+	
+	// 解析存储的API信息
+	var apiInfo []map[string]interface{}
+	if err := json.Unmarshal([]byte(apiInfoStr), &apiInfo); err != nil {
+		// 如果解析失败，返回空数组
+		return []map[string]interface{}{}
+	}
+	
+	return apiInfo
+}