Skip to content

Commit e513768

Browse files
carsonxucarsonxu
authored
Merge pull request #145 from livehigh/feat/1.3.6
feat：支持设置签名不计算host
2 parents ca4ed8c + 53e8f6f commit e513768

File tree

9 files changed

+46
-20
lines changed

9 files changed

+46
-20
lines changed

‎demo/demo.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ var getAuthorization = function (options, callback) {
7070
Pathname: options.Pathname,
7171
Query: options.Query,
7272
Headers: options.Headers,
73+
ForceSignHost: options.ForceSignHost,
7374
Expires: 900,
7475
});
7576
callback({

‎dist/cos-js-sdk-v5.js‎

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,11 @@ var getAuth = function (opt) {
157157
pathname.indexOf('/') !== 0 && (pathname = '/' + pathname);
158158
}
159159

160-
// 如果有传入存储桶，那么签名默认加 Host 参与计算，避免跨桶访问
161-
if (!headers.Host && !headers.host && opt.Bucket && opt.Region) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
160+
// ForceSignHost明确传入false才不加入host签名
161+
var forceSignHost = opt.ForceSignHost === false ? false : true;
162+
163+
// 如果有传入存储桶且需要强制签名，那么签名默认加 Host 参与计算，避免跨桶访问
164+
if (!headers.Host && !headers.host && opt.Bucket && opt.Region && forceSignHost) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
162165

163166
if (!SecretId) throw new Error('missing param SecretId');
164167
if (!SecretKey) throw new Error('missing param SecretKey');
@@ -596,6 +599,7 @@ var apiWrapper = function (apiName, apiFn) {
596599
var formatResult = function (result) {
597600
if (result && result.headers) {
598601
result.headers['x-cos-request-id'] && (result.RequestId = result.headers['x-cos-request-id']);
602+
result.headers['x-ci-request-id'] && (result.RequestId = result.headers['x-ci-request-id']);
599603
result.headers['x-cos-version-id'] && (result.VersionId = result.headers['x-cos-version-id']);
600604
result.headers['x-cos-delete-marker'] && (result.DeleteMarker = result.headers['x-cos-delete-marker']);
601605
}
@@ -2442,7 +2446,8 @@ var defaultOptions = {
24422446
UploadQueueSize: 10000,
24432447
UploadAddMetaMd5: false,
24442448
UploadIdCacheLimit: 50,
2445-
UseAccelerate: false
2449+
UseAccelerate: false,
2450+
ForceSignHost: true // 默认将host加入签名计算，关闭后可能导致越权风险，建议保持为true
24462451
};
24472452

24482453
// 对外暴露的类
@@ -2485,7 +2490,7 @@ COS.util = {
24852490
json2xml: util.json2xml
24862491
};
24872492
COS.getAuthorization = util.getAuth;
2488-
COS.version = '1.3.5';
2493+
COS.version = '1.3.6';
24892494

24902495
module.exports = COS;
24912496

@@ -7901,7 +7906,8 @@ function getObjectUrl(params, callback) {
79017906
Expires: params.Expires,
79027907
Headers: params.Headers,
79037908
Query: params.Query,
7904-
SignHost: SignHost
7909+
SignHost: SignHost,
7910+
ForceSignHost: params.ForceSignHost === false ? false : self.options.ForceSignHost // getObjectUrl支持传参ForceSignHost
79057911
}, function (err, AuthData) {
79067912
if (!callback) return;
79077913
if (err) {
@@ -8072,9 +8078,11 @@ function getAuthorizationAsync(params, callback) {
80728078
(v === '' || ['content-type', 'cache-control', 'expires'].indexOf(k.toLowerCase()) > -1) && delete headers[k];
80738079
if (k.toLowerCase() === 'host') headerHost = v;
80748080
});
8081+
// ForceSignHost明确传入false才不加入host签名
8082+
var forceSignHost = params.ForceSignHost === false ? false : true;
80758083

80768084
// Host 加入签名计算
8077-
if (!headerHost && params.SignHost) headers.Host = params.SignHost;
8085+
if (!headerHost && params.SignHost && forceSignHost) headers.Host = params.SignHost;
80788086

80798087
// 获取凭证的回调，避免用户 callback 多次
80808088
var cbDone = false;
@@ -8145,7 +8153,8 @@ function getAuthorizationAsync(params, callback) {
81458153
Expires: params.Expires,
81468154
UseRawKey: self.options.UseRawKey,
81478155
SystemClockOffset: self.options.SystemClockOffset,
8148-
KeyTime: KeyTime
8156+
KeyTime: KeyTime,
8157+
ForceSignHost: self.options.ForceSignHost
81498158
});
81508159
var AuthData = {
81518160
Authorization: Authorization,
@@ -8202,7 +8211,8 @@ function getAuthorizationAsync(params, callback) {
82028211
Query: params.Query,
82038212
Headers: headers,
82048213
Scope: Scope,
8205-
SystemClockOffset: self.options.SystemClockOffset
8214+
SystemClockOffset: self.options.SystemClockOffset,
8215+
ForceSignHost: self.options.ForceSignHost
82068216
}, function (AuthData) {
82078217
if (typeof AuthData === 'string') AuthData = { Authorization: AuthData };
82088218
var AuthError = checkAuthError(AuthData);
@@ -8245,7 +8255,8 @@ function getAuthorizationAsync(params, callback) {
82458255
Headers: headers,
82468256
Expires: params.Expires,
82478257
UseRawKey: self.options.UseRawKey,
8248-
SystemClockOffset: self.options.SystemClockOffset
8258+
SystemClockOffset: self.options.SystemClockOffset,
8259+
ForceSignHost: self.options.ForceSignHost
82498260
});
82508261
var AuthData = {
82518262
Authorization: Authorization,
@@ -8318,7 +8329,8 @@ function submitRequest(params, callback) {
83188329
SignHost: SignHost,
83198330
Action: params.Action,
83208331
ResourceKey: params.ResourceKey,
8321-
Scope: params.Scope
8332+
Scope: params.Scope,
8333+
ForceSignHost: self.options.ForceSignHost
83228334
}, function (err, AuthData) {
83238335
if (err) {
83248336
callback(err);

‎dist/cos-js-sdk-v5.min.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎index.d.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,11 +145,11 @@ declare namespace COS {
145145
ProgressInterval?: number,
146146
/** 上传队列最长大小，超出的任务如果状态不是 waiting、checking、uploading 会被清理，默认10000 */
147147
UploadQueueSize?: number,
148-
/** 上传队列最长大小，超出的任务如果状态不是 waiting、checking、uploading 会被清理，默认10000 */
148+
/** 调用操作存储桶和对象的 API 时自定义请求域名。可以使用模板，如"{Bucket}.cos.{Region}.myqcloud.com"，即在调用 API 时会使用参数中传入的 Bucket 和 Region 进行替换。 */
149149
Domain?: string,
150-
/** 强制使用后缀式模式发请求。后缀式模式中 Bucket 会放在域名后的 pathname 里，并且 Bucket 会加入签名 pathname 计算，默认 false */
150+
/** getService方法可以使用的自定义域名 */
151151
ServiceDomain?: string,
152-
/** 强制使用后缀式模式发请求。后缀式模式中 Bucket 会放在域名后的 pathname 里，并且 Bucket 会加入签名 pathname 计算，默认 false */
152+
/** http协议，枚举值'http:','https:'冒号必须 */
153153
Protocol?: string,
154154
/** 开启兼容模式，默认 false 不开启，兼容模式下不校验 Region 是否格式有误，在用于私有化 COS 时使用 */
155155
CompatibilityMode?: boolean,

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "cos-js-sdk-v5",
3-
"version": "1.3.5",
3+
"version": "1.3.6",
44
"description": "JavaScript SDK for [腾讯云对象存储](https://cloud.tencent.com/product/cos)",
55
"main": "index.js",
66
"types": "index.d.ts",

‎src/base.js‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3027,6 +3027,7 @@ function getObjectUrl(params, callback) {
30273027
Headers: params.Headers,
30283028
Query: params.Query,
30293029
SignHost: SignHost,
3030+
ForceSignHost: params.ForceSignHost === false ? false : self.options.ForceSignHost, // getObjectUrl支持传参ForceSignHost
30303031
}, function (err, AuthData) {
30313032
if (!callback) return;
30323033
if (err) {
@@ -3207,9 +3208,11 @@ function getAuthorizationAsync(params, callback) {
32073208
(v === '' || ['content-type', 'cache-control', 'expires'].indexOf(k.toLowerCase()) > -1) && delete headers[k];
32083209
if (k.toLowerCase() === 'host') headerHost = v;
32093210
});
3211+
// ForceSignHost明确传入false才不加入host签名
3212+
var forceSignHost = params.ForceSignHost === false ? false : true;
32103213

32113214
// Host 加入签名计算
3212-
if (!headerHost && params.SignHost) headers.Host = params.SignHost;
3215+
if (!headerHost && params.SignHost && forceSignHost) headers.Host = params.SignHost;
32133216

32143217
// 获取凭证的回调，避免用户 callback 多次
32153218
var cbDone = false;
@@ -3280,7 +3283,8 @@ function getAuthorizationAsync(params, callback) {
32803283
Expires: params.Expires,
32813284
UseRawKey: self.options.UseRawKey,
32823285
SystemClockOffset: self.options.SystemClockOffset,
3283-
KeyTime: KeyTime
3286+
KeyTime: KeyTime,
3287+
ForceSignHost: self.options.ForceSignHost,
32843288
});
32853289
var AuthData = {
32863290
Authorization: Authorization,
@@ -3344,6 +3348,7 @@ function getAuthorizationAsync(params, callback) {
33443348
Headers: headers,
33453349
Scope: Scope,
33463350
SystemClockOffset: self.options.SystemClockOffset,
3351+
ForceSignHost: self.options.ForceSignHost,
33473352
}, function (AuthData) {
33483353
if (typeof AuthData === 'string') AuthData = {Authorization: AuthData};
33493354
var AuthError = checkAuthError(AuthData);
@@ -3385,6 +3390,7 @@ function getAuthorizationAsync(params, callback) {
33853390
Expires: params.Expires,
33863391
UseRawKey: self.options.UseRawKey,
33873392
SystemClockOffset: self.options.SystemClockOffset,
3393+
ForceSignHost: self.options.ForceSignHost,
33883394
});
33893395
var AuthData = {
33903396
Authorization: Authorization,
@@ -3460,6 +3466,7 @@ function submitRequest(params, callback) {
34603466
Action: params.Action,
34613467
ResourceKey: params.ResourceKey,
34623468
Scope: params.Scope,
3469+
ForceSignHost: self.options.ForceSignHost,
34633470
}, function (err, AuthData) {
34643471
if (err) {
34653472
callback(err);

‎src/cos.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ var defaultOptions = {
3535
UploadAddMetaMd5: false,
3636
UploadIdCacheLimit: 50,
3737
UseAccelerate: false,
38+
ForceSignHost: true, // 默认将host加入签名计算，关闭后可能导致越权风险，建议保持为true
3839
};
3940

4041
// 对外暴露的类
@@ -77,6 +78,6 @@ COS.util = {
7778
json2xml: util.json2xml,
7879
};
7980
COS.getAuthorization = util.getAuth;
80-
COS.version = '1.3.5';
81+
COS.version = '1.3.6';
8182

8283
module.exports = COS;

‎src/util.js‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,11 @@ var getAuth = function (opt) {
8686
pathname.indexOf('/') !== 0 && (pathname = '/' + pathname);
8787
}
8888

89-
// 如果有传入存储桶，那么签名默认加 Host 参与计算，避免跨桶访问
90-
if (!headers.Host && !headers.host && opt.Bucket && opt.Region) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
89+
// ForceSignHost明确传入false才不加入host签名
90+
var forceSignHost = opt.ForceSignHost === false ? false : true;
91+
92+
// 如果有传入存储桶且需要强制签名，那么签名默认加 Host 参与计算，避免跨桶访问
93+
if (!headers.Host && !headers.host && opt.Bucket && opt.Region && forceSignHost) headers.Host = opt.Bucket + '.cos.' + opt.Region + '.myqcloud.com';
9194

9295
if (!SecretId) throw new Error('missing param SecretId');
9396
if (!SecretKey) throw new Error('missing param SecretKey');
@@ -534,6 +537,7 @@ var apiWrapper = function (apiName, apiFn) {
534537
var formatResult = function (result) {
535538
if (result && result.headers) {
536539
result.headers['x-cos-request-id'] && (result.RequestId = result.headers['x-cos-request-id']);
540+
result.headers['x-ci-request-id'] && (result.RequestId = result.headers['x-ci-request-id']);
537541
result.headers['x-cos-version-id'] && (result.VersionId = result.headers['x-cos-version-id']);
538542
result.headers['x-cos-delete-marker'] && (result.DeleteMarker = result.headers['x-cos-delete-marker']);
539543
}

‎test/test.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ var getAuthorization = function (options, callback) {
6666
TmpSecretKey: credentials.tmpSecretKey,
6767
SecurityToken: credentials.sessionToken,
6868
ExpiredTime: data.expiredTime, // SDK 在 ExpiredTime 时间前，不会再次调用 getAuthorization
69+
ForceSignHost: options.ForceSignHost,
6970
});
7071
};
7172
xhr.send();

0 commit comments

Comments
 (0)