已發布的原始碼

CH-J Server Manager

瀏覽特定應用程式版本的目錄與檔案。

CH-J / Server Manager 193 個檔案

core-20261011T184039Z-4148710795d0 新增時間: 未記錄日期 · 建置時間: 2026年10月11日晚上8:40

urlPolicy.js 新增時間: 未記錄日期 1.5 KB · 40 行

程式碼下載檔案

1"use strict";

3function normalizeBaseUrl(value) {

4 const url = new URL(String(value || ""));

5 if (url.protocol !== "https:") throw new Error("Update URL must use HTTPS.");

6 if (url.username || url.password || url.hash || url.search) throw new Error("Invalid update base URL.");

7 url.pathname = `${url.pathname.replace(/\/+$/, "")}/`;

8 return url;

9}

11function assertAllowedUrl(candidate, allowedBaseUrls, options = {}) {

12 const raw = String(candidate || "").trim();

13 if (!raw) throw new Error("Missing URL.");

14 const bases = allowedBaseUrls.map(normalizeBaseUrl);

16 if (raw.startsWith("/")) {

17 if (!options.baseUrl) throw new Error("Relative URL requires a base URL.");

    return assertAllowedUrl(new URL(raw.replace(/^\/+/, ""), normalizeBaseUrl(options.baseUrl)).toString(), allowedBaseUrls, options);

19 }

21 const url = new URL(raw);

22 if (url.username || url.password || url.hash) throw new Error("URL credentials and fragments are not allowed.");

23 const matchedBase = bases.find((base) => (

24 url.protocol === base.protocol

25 && url.hostname === base.hostname

26 && url.port === base.port

27 && url.pathname.startsWith(base.pathname)

28 ));

29 if (!matchedBase) throw new Error("URL is outside the update allowlist.");

31 if (options.pathSegment && !url.pathname.startsWith(`${matchedBase.pathname}${options.pathSegment}`)) {

32 throw new Error("URL path is outside the allowed update area.");

33 }

34 return url;

35}

37module.exports = {

38 assertAllowedUrl,

39 normalizeBaseUrl

40};

SHA-256

db15c1e8b5a134391637a8de3efca895dcbf77095a5eaf58acba061b69775030

CH-J Proprietary Software License 1.14 · 原始碼依 CH-J Proprietary Software License 1.14 提供。公開原始碼不會改變授權條款，也不會授予額外的權利。

壓縮檔 SHA-256

5a8ea02d06a5643cf2330fe9f54b8767a06c1c59d36527705e536fa9dbca7614