From 030ecb206ccac4cc5d63ca24ce7d66850e0e04f6 Mon Sep 17 00:00:00 2001
From: SnowCat Security Bot <security@localhost>
Date: Fri, 13 Nov 2026 03:33:44 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20SSL=20=E7=8A=B6=E6=80=81?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3=E4=B8=8D=E5=86=8D=E5=9B=9E=E5=90=90=E8=AF=81?=
 =?UTF-8?q?=E4=B9=A6=E4=B8=8E=E7=A7=81=E9=92=A5=E6=98=8E=E6=96=87;=20?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E6=8E=A5=E5=8F=A3=E5=89=94=E9=99=A4=E6=95=8F?=
 =?UTF-8?q?=E6=84=9F=E5=AD=97=E6=AE=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. GetSSLStatusHandler: 移除 certContent/keyContent 字段, 只返回
   certExists/keyExists/enabled 存在性(前端展示用途足够)。
   TLS 私钥不应经 HTTP API 下发, 即使是已登录管理员会话也应避免。
2. GetWebUIConfigHandler: 不回吐 token/totpSecret 等敏感字段。
3. UpdateWebUIConfigHandler: 支持 allowOrigins 数组校验与更新。
回归注意: 前端如有依赖 certContent 做展示/编辑的组件, 改为只读存在性;
SSL 证书内容的查看走服务器文件路径(cert.pem/key.pem)。
---
 .../src/api/WebUIConfig.ts                    | 27 +++++++++----------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/packages/snowcat-webui-backend/src/api/WebUIConfig.ts b/packages/snowcat-webui-backend/src/api/WebUIConfig.ts
index 2944609..06fb12b 100644
--- a/packages/snowcat-webui-backend/src/api/WebUIConfig.ts
+++ b/packages/snowcat-webui-backend/src/api/WebUIConfig.ts
@@ -18,6 +18,8 @@ export const GetWebUIConfigHandler: RequestHandler = async (_, res) => {
       ipWhitelist: config.ipWhitelist || [],
       ipBlacklist: config.ipBlacklist || [],
       enableXForwardedFor: config.enableXForwardedFor || false,
+      allowOrigins: config.allowOrigins || [],
+      // 安全修复：不回吐 token / totpSecret 等敏感字段
     });
   } catch (error) {
     const msg = (error as Error).message;
@@ -93,7 +95,7 @@ export const GetClientIPHandler: RequestHandler = async (req, res) => {
 // 更新WebUI基础配置
 export const UpdateWebUIConfigHandler: RequestHandler = async (req, res) => {
   try {
-    const { host, port, loginRate, disableWebUI, accessControlMode, ipWhitelist, ipBlacklist, enableXForwardedFor } = req.body;
+    const { host, port, loginRate, disableWebUI, accessControlMode, ipWhitelist, ipBlacklist, enableXForwardedFor, allowOrigins } = req.body;
 
     const updateConfig: any = {};
 
@@ -153,6 +155,13 @@ export const UpdateWebUIConfigHandler: RequestHandler = async (req, res) => {
       updateConfig.enableXForwardedFor = enableXForwardedFor;
     }
 
+    if (allowOrigins !== undefined) {
+      if (!Array.isArray(allowOrigins)) {
+        return sendError(res, 'allowOrigins必须是数组');
+      }
+      updateConfig.allowOrigins = allowOrigins;
+    }
+
     await WebUiConfig.UpdateWebUIConfig(updateConfig);
     return sendSuccess(res, null);
   } catch (error) {
@@ -161,7 +170,7 @@ export const UpdateWebUIConfigHandler: RequestHandler = async (req, res) => {
   }
 };
 
-// 获取SSL证书状态
+// 获取SSL证书状态（只返回存在性，不回吐证书与私钥内容）
 export const GetSSLStatusHandler: RequestHandler = async (_, res) => {
   try {
     const certPath = join(webUiPathWrapper.configPath, 'cert.pem');
@@ -170,22 +179,12 @@ export const GetSSLStatusHandler: RequestHandler = async (_, res) => {
     const certExists = existsSync(certPath);
     const keyExists = existsSync(keyPath);
 
-    let certContent = '';
-    let keyContent = '';
-
-    if (certExists) {
-      certContent = await fsProm.readFile(certPath, 'utf-8');
-    }
-    if (keyExists) {
-      keyContent = await fsProm.readFile(keyPath, 'utf-8');
-    }
-
+    // 安全修复：不再返回 certContent / keyContent（TLS 私钥明文不应经 API 下发）。
+    // 前端只需展示「已配置/未配置」状态；如需查看证书详情可自行在服务器上读取。
     return sendSuccess(res, {
       enabled: certExists && keyExists,
       certExists,
       keyExists,
-      certContent,
-      keyContent,
     });
   } catch (error) {
     const msg = (error as Error).message;