68 lines
2.2 KiB
Bash
Executable File
68 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# 升级旧部署时补齐浏览器来源；显式配置始终保留并校验。
|
|
# 不 source .env，避免执行环境文件中的内容。
|
|
|
|
security_origin_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=scripts/init-public-api-base-url.sh
|
|
. "${security_origin_script_dir}/init-public-api-base-url.sh"
|
|
|
|
security_origin_valid() {
|
|
local value rest
|
|
value="$(public_url_normalize "$1")"
|
|
public_url_validate "$value" || return 1
|
|
rest="${value#*://}"
|
|
[[ "$rest" != */* ]]
|
|
}
|
|
|
|
init_security_origin() {
|
|
local file="${1:-.env}"
|
|
local api_url origin current item scheme rest authority
|
|
[ -f "$file" ] || {
|
|
echo "❌ 环境配置文件不存在: $file" >&2
|
|
return 1
|
|
}
|
|
|
|
api_url="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
|
|
public_url_validate "$api_url" || {
|
|
echo "❌ 请先配置有效的 CONFIG_PUBLIC_API_BASE_URL" >&2
|
|
return 1
|
|
}
|
|
scheme="${api_url%%://*}"
|
|
rest="${api_url#*://}"
|
|
authority="${rest%%/*}"
|
|
origin="${scheme}://${authority}"
|
|
security_origin_valid "$origin" || return 1
|
|
|
|
current="$(public_url_read_env_value "$file" "CONFIG_SECURITY_ORIGIN")"
|
|
if [ -z "$current" ] || {
|
|
[ "$current" = 'http://127.0.0.1,http://localhost' ] &&
|
|
[ "$origin" != 'http://127.0.0.1' ];
|
|
}; then
|
|
public_url_write_env_value "$file" "CONFIG_SECURITY_ORIGIN" "$origin"
|
|
echo " ✓ 已配置浏览器来源: $origin"
|
|
return 0
|
|
fi
|
|
|
|
local -a origins
|
|
case "$current" in
|
|
,*|*,|*,,*)
|
|
echo "❌ CONFIG_SECURITY_ORIGIN 包含空的来源地址" >&2
|
|
return 1
|
|
;;
|
|
esac
|
|
IFS=',' read -r -a origins <<< "$current"
|
|
[ "${#origins[@]}" -gt 0 ] || return 1
|
|
for item in "${origins[@]}"; do
|
|
item="$(printf '%s' "$item" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
|
|
if ! security_origin_valid "$item"; then
|
|
echo "❌ CONFIG_SECURITY_ORIGIN 包含无效或非浏览器来源，请填写 http(s) Origin，不能使用通配符或路径" >&2
|
|
return 1
|
|
fi
|
|
done
|
|
}
|
|
|
|
if [ "${BASH_SOURCE[0]}" = "$0" ]; then
|
|
init_security_origin "${1:-.env}"
|
|
fi
|