Skip to content

Commit 59e79fd

Browse files
livehighlivehigh
committed
Merge branch 'master' into feat/getObject-support-useAccelerate
2 parents 94057fa + e513768 commit 59e79fd

File tree

9 files changed

+52
-24
lines changed

9 files changed

+52
-24
lines changed

‎demo/demo.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ var getAuthorization = function (options, callback) {
7070
Pathname: options.Pathname,
7171
Query: options.Query,
7272
Headers: options.Headers,
73+
ForceSignHost: options.ForceSignHost,
7374
Expires: 900,
7475
});
7576
callback({

‎dist/cos-js-sdk-v5.js‎

Lines changed: 27 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,11 @@ var getAuth = function (opt) {
157157
pathname.indexOf('/') !== 0 && (pathname = '/' + pathname);
158158
}
159159

160-
// 如果有传入存储桶，那么签名默认加 Host 参与计算，避免跨桶访问
161-
if (!headers.Host && !headers.host && opt.Bucket && opt.Region) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
160+
// ForceSignHost明确传入false才不加入host签名
161+
var forceSignHost = opt.ForceSignHost === false ? false : true;
162+
163+
// 如果有传入存储桶且需要强制签名，那么签名默认加 Host 参与计算，避免跨桶访问
164+
if (!headers.Host && !headers.host && opt.Bucket && opt.Region && forceSignHost) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
162165

163166
if (!SecretId) throw new Error('missing param SecretId');
164167
if (!SecretKey) throw new Error('missing param SecretKey');
@@ -596,6 +599,7 @@ var apiWrapper = function (apiName, apiFn) {
596599
var formatResult = function (result) {
597600
if (result && result.headers) {
598601
result.headers['x-cos-request-id'] && (result.RequestId = result.headers['x-cos-request-id']);
602+
result.headers['x-ci-request-id'] && (result.RequestId = result.headers['x-ci-request-id']);
599603
result.headers['x-cos-version-id'] && (result.VersionId = result.headers['x-cos-version-id']);
600604
result.headers['x-cos-delete-marker'] && (result.DeleteMarker = result.headers['x-cos-delete-marker']);
601605
}
@@ -2442,7 +2446,8 @@ var defaultOptions = {
24422446
UploadQueueSize: 10000,
24432447
UploadAddMetaMd5: false,
24442448
UploadIdCacheLimit: 50,
2445-
UseAccelerate: false
2449+
UseAccelerate: false,
2450+
ForceSignHost: true // 默认将host加入签名计算，关闭后可能导致越权风险，建议保持为true
24462451
};
24472452

24482453
// 对外暴露的类
@@ -2485,7 +2490,7 @@ COS.util = {
24852490
json2xml: util.json2xml
24862491
};
24872492
COS.getAuthorization = util.getAuth;
2488-
COS.version = '2.0.0';
2493+
COS.version = '1.3.6';
24892494

24902495
module.exports = COS;
24912496

@@ -7866,12 +7871,13 @@ function getAuth(params) {
78667871
*/
78677872
function getObjectUrl(params, callback) {
78687873
var self = this;
7874+
var useAccelerate = params.UseAccelerate === undefined ? self.options.UseAccelerate : params.UseAccelerate;
78697875
var url = getUrl({
78707876
ForcePathStyle: self.options.ForcePathStyle,
78717877
protocol: params.Protocol || self.options.Protocol,
78727878
domain: params.Domain || self.options.Domain,
78737879
bucket: params.Bucket,
7874-
region: params.Region,
7880+
region: useAccelerate ? 'accelerate' : params.Region,
78757881
object: params.Key
78767882
});
78777883

@@ -7891,7 +7897,7 @@ function getObjectUrl(params, callback) {
78917897
}
78927898

78937899
// 签名加上 Host，避免跨桶访问
7894-
var SignHost = getSignHost.call(this, { Bucket: params.Bucket, Region: params.Region, Url: url });
7900+
var SignHost = getSignHost.call(this, { Bucket: params.Bucket, Region: params.Region, UseAccelerate: params.UseAccelerate, Url: url });
78957901
var AuthData = getAuthorizationAsync.call(this, {
78967902
Action: (params.Method || '').toUpperCase() === 'PUT' ? 'name/cos:PutObject' : 'name/cos:GetObject',
78977903
Bucket: params.Bucket || '',
@@ -7901,7 +7907,8 @@ function getObjectUrl(params, callback) {
79017907
Expires: params.Expires,
79027908
Headers: params.Headers,
79037909
Query: params.Query,
7904-
SignHost: SignHost
7910+
SignHost: SignHost,
7911+
ForceSignHost: params.ForceSignHost === false ? false : self.options.ForceSignHost // getObjectUrl支持传参ForceSignHost
79057912
}, function (err, AuthData) {
79067913
if (!callback) return;
79077914
if (err) {
@@ -8051,12 +8058,13 @@ function getUrl(params) {
80518058

80528059
var getSignHost = function (opt) {
80538060
if (!opt.Bucket || !opt.Region) return '';
8061+
var useAccelerate = opt.UseAccelerate === undefined ? this.options.UseAccelerate : opt.UseAccelerate;
80548062
var url = opt.Url || getUrl({
80558063
ForcePathStyle: this.options.ForcePathStyle,
80568064
protocol: this.options.Protocol,
80578065
domain: this.options.Domain,
80588066
bucket: opt.Bucket,
8059-
region: this.options.UseAccelerate ? 'accelerate' : opt.Region
8067+
region: useAccelerate ? 'accelerate' : opt.Region
80608068
});
80618069
var urlHost = url.replace(/^https?:\/\/([^/]+)(\/.*)?$/, '$1');
80628070
var standardHostReg = new RegExp('^([a-z\\d-]+-\\d+\\.)?(cos|cosv6|ci|pic)\\.([a-z\\d-]+)\\.myqcloud\\.com$');
@@ -8072,9 +8080,11 @@ function getAuthorizationAsync(params, callback) {
80728080
(v === '' || ['content-type', 'cache-control', 'expires'].indexOf(k.toLowerCase()) > -1) && delete headers[k];
80738081
if (k.toLowerCase() === 'host') headerHost = v;
80748082
});
8083+
// ForceSignHost明确传入false才不加入host签名
8084+
var forceSignHost = params.ForceSignHost === false ? false : true;
80758085

80768086
// Host 加入签名计算
8077-
if (!headerHost && params.SignHost) headers.Host = params.SignHost;
8087+
if (!headerHost && params.SignHost && forceSignHost) headers.Host = params.SignHost;
80788088

80798089
// 获取凭证的回调，避免用户 callback 多次
80808090
var cbDone = false;
@@ -8145,7 +8155,8 @@ function getAuthorizationAsync(params, callback) {
81458155
Expires: params.Expires,
81468156
UseRawKey: self.options.UseRawKey,
81478157
SystemClockOffset: self.options.SystemClockOffset,
8148-
KeyTime: KeyTime
8158+
KeyTime: KeyTime,
8159+
ForceSignHost: self.options.ForceSignHost
81498160
});
81508161
var AuthData = {
81518162
Authorization: Authorization,
@@ -8202,7 +8213,8 @@ function getAuthorizationAsync(params, callback) {
82028213
Query: params.Query,
82038214
Headers: headers,
82048215
Scope: Scope,
8205-
SystemClockOffset: self.options.SystemClockOffset
8216+
SystemClockOffset: self.options.SystemClockOffset,
8217+
ForceSignHost: self.options.ForceSignHost
82068218
}, function (AuthData) {
82078219
if (typeof AuthData === 'string') AuthData = { Authorization: AuthData };
82088220
var AuthError = checkAuthError(AuthData);
@@ -8245,7 +8257,8 @@ function getAuthorizationAsync(params, callback) {
82458257
Headers: headers,
82468258
Expires: params.Expires,
82478259
UseRawKey: self.options.UseRawKey,
8248-
SystemClockOffset: self.options.SystemClockOffset
8260+
SystemClockOffset: self.options.SystemClockOffset,
8261+
ForceSignHost: self.options.ForceSignHost
82498262
});
82508263
var AuthData = {
82518264
Authorization: Authorization,
@@ -8318,7 +8331,8 @@ function submitRequest(params, callback) {
83188331
SignHost: SignHost,
83198332
Action: params.Action,
83208333
ResourceKey: params.ResourceKey,
8321-
Scope: params.Scope
8334+
Scope: params.Scope,
8335+
ForceSignHost: self.options.ForceSignHost
83228336
}, function (err, AuthData) {
83238337
if (err) {
83248338
callback(err);

‎dist/cos-js-sdk-v5.min.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎index.d.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -145,11 +145,11 @@ declare namespace COS {
145145
ProgressInterval?: number,
146146
/** 上传队列最长大小，超出的任务如果状态不是 waiting、checking、uploading 会被清理，默认10000 */
147147
UploadQueueSize?: number,
148-
/** 上传队列最长大小，超出的任务如果状态不是 waiting、checking、uploading 会被清理，默认10000 */
148+
/** 调用操作存储桶和对象的 API 时自定义请求域名。可以使用模板，如"{Bucket}.cos.{Region}.myqcloud.com"，即在调用 API 时会使用参数中传入的 Bucket 和 Region 进行替换。 */
149149
Domain?: string,
150-
/** 强制使用后缀式模式发请求。后缀式模式中 Bucket 会放在域名后的 pathname 里，并且 Bucket 会加入签名 pathname 计算，默认 false */
150+
/** getService方法可以使用的自定义域名 */
151151
ServiceDomain?: string,
152-
/** 强制使用后缀式模式发请求。后缀式模式中 Bucket 会放在域名后的 pathname 里，并且 Bucket 会加入签名 pathname 计算，默认 false */
152+
/** http协议，枚举值'http:','https:'冒号必须 */
153153
Protocol?: string,
154154
/** 开启兼容模式，默认 false 不开启，兼容模式下不校验 Region 是否格式有误，在用于私有化 COS 时使用 */
155155
CompatibilityMode?: boolean,
@@ -1137,7 +1137,7 @@ declare namespace COS {
11371137
// getObject
11381138
/** getObject 接口参数 */
11391139
interface GetObjectParams extends ObjectParams {
1140-
BodyType?: 'text' | 'blob' | 'arraybuffer',
1140+
DataType?: 'text' | 'blob' | 'arraybuffer',
11411141
/** 请求里的 Url Query 参数，传入该值中的 key/value 将会被 URLEncode */
11421142
Query?: Query,
11431143
/** 请求里的 Url Query 参数。传入该值将直接拼接在 Url 上，不会对其进行 URLEncode */

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "cos-js-sdk-v5",
3-
"version": "2.0.0",
3+
"version": "1.3.6",
44
"description": "JavaScript SDK for [腾讯云对象存储](https://cloud.tencent.com/product/cos)",
55
"main": "index.js",
66
"types": "index.d.ts",

‎src/base.js‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3028,6 +3028,7 @@ function getObjectUrl(params, callback) {
30283028
Headers: params.Headers,
30293029
Query: params.Query,
30303030
SignHost: SignHost,
3031+
ForceSignHost: params.ForceSignHost === false ? false : self.options.ForceSignHost, // getObjectUrl支持传参ForceSignHost
30313032
}, function (err, AuthData) {
30323033
if (!callback) return;
30333034
if (err) {
@@ -3209,9 +3210,11 @@ function getAuthorizationAsync(params, callback) {
32093210
(v === '' || ['content-type', 'cache-control', 'expires'].indexOf(k.toLowerCase()) > -1) && delete headers[k];
32103211
if (k.toLowerCase() === 'host') headerHost = v;
32113212
});
3213+
// ForceSignHost明确传入false才不加入host签名
3214+
var forceSignHost = params.ForceSignHost === false ? false : true;
32123215

32133216
// Host 加入签名计算
3214-
if (!headerHost && params.SignHost) headers.Host = params.SignHost;
3217+
if (!headerHost && params.SignHost && forceSignHost) headers.Host = params.SignHost;
32153218

32163219
// 获取凭证的回调，避免用户 callback 多次
32173220
var cbDone = false;
@@ -3282,7 +3285,8 @@ function getAuthorizationAsync(params, callback) {
32823285
Expires: params.Expires,
32833286
UseRawKey: self.options.UseRawKey,
32843287
SystemClockOffset: self.options.SystemClockOffset,
3285-
KeyTime: KeyTime
3288+
KeyTime: KeyTime,
3289+
ForceSignHost: self.options.ForceSignHost,
32863290
});
32873291
var AuthData = {
32883292
Authorization: Authorization,
@@ -3346,6 +3350,7 @@ function getAuthorizationAsync(params, callback) {
33463350
Headers: headers,
33473351
Scope: Scope,
33483352
SystemClockOffset: self.options.SystemClockOffset,
3353+
ForceSignHost: self.options.ForceSignHost,
33493354
}, function (AuthData) {
33503355
if (typeof AuthData === 'string') AuthData = {Authorization: AuthData};
33513356
var AuthError = checkAuthError(AuthData);
@@ -3387,6 +3392,7 @@ function getAuthorizationAsync(params, callback) {
33873392
Expires: params.Expires,
33883393
UseRawKey: self.options.UseRawKey,
33893394
SystemClockOffset: self.options.SystemClockOffset,
3395+
ForceSignHost: self.options.ForceSignHost,
33903396
});
33913397
var AuthData = {
33923398
Authorization: Authorization,
@@ -3462,6 +3468,7 @@ function submitRequest(params, callback) {
34623468
Action: params.Action,
34633469
ResourceKey: params.ResourceKey,
34643470
Scope: params.Scope,
3471+
ForceSignHost: self.options.ForceSignHost,
34653472
}, function (err, AuthData) {
34663473
if (err) {
34673474
callback(err);

‎src/cos.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ var defaultOptions = {
3535
UploadAddMetaMd5: false,
3636
UploadIdCacheLimit: 50,
3737
UseAccelerate: false,
38+
ForceSignHost: true, // 默认将host加入签名计算，关闭后可能导致越权风险，建议保持为true
3839
};
3940

4041
// 对外暴露的类
@@ -77,6 +78,6 @@ COS.util = {
7778
json2xml: util.json2xml,
7879
};
7980
COS.getAuthorization = util.getAuth;
80-
COS.version = '2.0.0';
81+
COS.version = '1.3.6';
8182

8283
module.exports = COS;

‎src/util.js‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,11 @@ var getAuth = function (opt) {
8686
pathname.indexOf('/') !== 0 && (pathname = '/' + pathname);
8787
}
8888

89-
// 如果有传入存储桶，那么签名默认加 Host 参与计算，避免跨桶访问
90-
if (!headers.Host && !headers.host && opt.Bucket && opt.Region) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
89+
// ForceSignHost明确传入false才不加入host签名
90+
var forceSignHost = opt.ForceSignHost === false ? false : true;
91+
92+
// 如果有传入存储桶且需要强制签名，那么签名默认加 Host 参与计算，避免跨桶访问
93+
if (!headers.Host && !headers.host && opt.Bucket && opt.Region && forceSignHost) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
9194

9295
if (!SecretId) throw new Error('missing param SecretId');
9396
if (!SecretKey) throw new Error('missing param SecretKey');
@@ -534,6 +537,7 @@ var apiWrapper = function (apiName, apiFn) {
534537
var formatResult = function (result) {
535538
if (result && result.headers) {
536539
result.headers['x-cos-request-id'] && (result.RequestId = result.headers['x-cos-request-id']);
540+
result.headers['x-ci-request-id'] && (result.RequestId = result.headers['x-ci-request-id']);
537541
result.headers['x-cos-version-id'] && (result.VersionId = result.headers['x-cos-version-id']);
538542
result.headers['x-cos-delete-marker'] && (result.DeleteMarker = result.headers['x-cos-delete-marker']);
539543
}

‎test/test.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ var getAuthorization = function (options, callback) {
6666
TmpSecretKey: credentials.tmpSecretKey,
6767
SecurityToken: credentials.sessionToken,
6868
ExpiredTime: data.expiredTime, // SDK 在 ExpiredTime 时间前，不会再次调用 getAuthorization
69+
ForceSignHost: options.ForceSignHost,
6970
});
7071
};
7172
xhr.send();

0 commit comments

Comments
 (0)