akiba/agento3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve 3 security audit issues

Browse Source 
#3: Stored XSS in stats dashboard - escape p[path] with html.escape()
#4: Caddy timeout race - increase read/write_timeout 30s -> 60s
#5: Missing CSP header - add Content-Security-Policy to Caddyfile
This commit is contained in:
akiba
2026-06-30 14:03:48 +00:00
parent 085cc7a140
commit 122c408fff
32 changed files with 9066 additions and 859 deletions
Download Patch File Download Diff File Expand all files Collapse all files

112
Caddyfile
View File

@@ -1,5 +1,5 @@
# AO3 Mirror - Caddy 配置
# 前端负载均衡 + TLS 终止 + Cloudflare CDN 集成
# AO3 Mirror v5 - Caddy 配置
# 前端负载均衡 + TLS 终止 + Cloudflare CDN 集成 + Service Worker
agento3.miscs.dev {
# 全局头
@@ -9,6 +9,7 @@ agento3.miscs.dev {
X-Frame-Options "SAMEORIGIN"
X-XSS-Protection "1; mode=block"
Referrer-Policy "strict-origin-when-cross-origin"
Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; object-src 'none'"
-Server
-X-Powered-By
}
@@ -26,6 +27,60 @@ agento3.miscs.dev {
# 压缩
encode gzip
# Service Worker routes — versioned + redirect
route /sw-* {
reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
health_uri /health
health_interval 10s
health_timeout 5s
transport http {
read_timeout 60s
write_timeout 60s
dial_timeout 5s
}
}
header {
Cache-Control "public, max-age=86400, immutable"
}
}
# SW redirect
route /sw.js {
reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
health_uri /health
health_interval 10s
health_timeout 5s
transport http {
read_timeout 60s
write_timeout 60s
dial_timeout 5s
}
}
header {
Cache-Control "no-store"
}
}
# Mirror domains JSON
route /mirror-domains.json {
reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
health_uri /health
health_interval 10s
health_timeout 5s
transport http {
read_timeout 60s
write_timeout 60s
dial_timeout 5s
}
}
header {
Cache-Control "public, max-age=3600"
}
}
# 后端负载均衡 (轮询) - 2 workers on 2-core machine
reverse_proxy 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
@@ -34,7 +89,7 @@ agento3.miscs.dev {
health_interval 10s
health_timeout 5s
# 超时配置
# 超时配置 — 代理可能需要更长时间
transport http {
read_timeout 30s
write_timeout 30s
@@ -55,6 +110,7 @@ stats.agento3.miscs.dev {
X-Content-Type-Options "nosniff"
X-Frame-Options "SAMEORIGIN"
Referrer-Policy "strict-origin-when-cross-origin"
Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; object-src 'none'"
-Server
-X-Powered-By
}
@@ -72,41 +128,67 @@ stats.agento3.miscs.dev {
# 压缩
encode gzip
# 路由规则 - 只暴露 /stats 和 /metrics
# 路由规则 - 只暴露 /stats, /metrics, /health, /sw
route {
# /stats 页面 - 代理到后端
# /stats 页面
reverse_proxy /stats* 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
health_uri /health
health_interval 10s
health_timeout 5s
transport http {
read_timeout 30s
write_timeout 30s
read_timeout 60s
write_timeout 60s
dial_timeout 5s
}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
}
# /metrics 指标 - 代理到后端
# /metrics 指标
reverse_proxy /metrics* 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
health_uri /health
health_interval 10s
health_timeout 5s
transport http {
read_timeout 30s
write_timeout 30s
read_timeout 60s
write_timeout 60s
dial_timeout 5s
}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
}
# Service Worker
reverse_proxy /sw* 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
health_uri /health
health_interval 10s
health_timeout 5s
transport http {
read_timeout 60s
write_timeout 60s
dial_timeout 5s
}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}
}
# Mirror domains
reverse_proxy /mirror-domains* 127.0.0.1:8081 127.0.0.1:8082 {
lb_policy round_robin
health_uri /health
health_interval 10s
health_timeout 5s
transport http {
read_timeout 60s
write_timeout 60s
dial_timeout 5s
}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
header_up X-Real-IP {remote_host}