Merge pull request #14 from spcent/claude/wonderful-wozniak-0qp911

biglyan · web-flow · commit aa6a4dea43b9 · 2026-06-28T12:01:31.000+08:00
security: fix critical/high/medium vulnerabilities (authcode AES-256-GCM, CSRF timing, cookies, UUID, logging)
diff --git a/library/Plume/Engine/ActionInvoker.php b/library/Plume/Engine/ActionInvoker.php
@@ -44,7 +44,32 @@ public static function invoke(string $className, string $requestUri): mixed
      */
     public static function sanitizeForLog(array $request): array
     {
-        static $sensitive = ['password', 'passwd', 'pass', 'token', 'secret', 'card_no', 'cvv'];
-        return array_diff_key($request, array_flip($sensitive));
+        static $sensitive = [
+            // Credentials
+            'password', 'passwd', 'pass', 'pwd', 'new_password', 'old_password', 'confirm_password',
+            // Tokens & keys
+            'token', 'secret', 'api_key', 'apikey', 'access_token', 'refresh_token',
+            'auth_token', 'session_token', 'csrf_token', 'plume_csrf',
+            // Payment
+            'card_no', 'card_number', 'cvv', 'cvc', 'expiry', 'bank_account', 'bank_card',
+            // PII
+            'id_card', 'id_number', 'ssn', 'social_security', 'passport', 'license_number',
+            'phone', 'mobile', 'email', 'birthday', 'date_of_birth',
+            // Private keys
+            'private_key', 'encryption_key', 'signing_key',
+        ];
+        $result = array_diff_key($request, array_flip($sensitive));
+        // Also redact any key containing these substrings (case-insensitive)
+        $patterns = ['pass', 'secret', 'token', 'key', 'card', 'cvv', 'ssn', 'id_card'];
+        foreach ($result as $k => $v) {
+            $lower = strtolower((string) $k);
+            foreach ($patterns as $pattern) {
+                if (str_contains($lower, $pattern)) {
+                    $result[$k] = '***REDACTED***';
+                    break;
+                }
+            }
+        }
+        return $result;
     }
 }
diff --git a/library/Plume/Engine/Engine.php b/library/Plume/Engine/Engine.php
@@ -147,6 +147,14 @@ public function init(): void
             // session for every request after calling resetForWorker().
             if (!IS_CLI && true === C('USE_SESSION') && PHP_SESSION_NONE === session_status()
                 && !headers_sent()) {
+                $isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
+                    || (($_SERVER['SERVER_PORT'] ?? '') === '443');
+                ini_set('session.cookie_httponly', '1');
+                ini_set('session.use_strict_mode', '1');
+                ini_set('session.cookie_samesite', 'Lax');
+                if ($isHttps) {
+                    ini_set('session.cookie_secure', '1');
+                }
                 session_start();
             }
 
@@ -535,20 +543,16 @@ public function _error(\Throwable $e): void
         }
 
         if ('production' === $this->get('plumephp.env')) {
-            $msg = sprintf(
-                '<h1>500 Internal Server Error</h1>'.
-                '<h3>%s (%s)</h3>',
-                $e->getMessage(),
-                $e->getCode()
-            );
+            $msg = '<h1>500 Internal Server Error</h1>'
+                . '<p>An unexpected error occurred. Please try again later.</p>';
         } else {
             $msg = sprintf(
                 '<h1>500 Internal Server Error</h1>'.
                 '<h3>%s (%s)</h3>'.
                 '<pre>%s</pre>',
-                $e->getMessage(),
-                $e->getCode(),
-                $e->getTraceAsString()
+                htmlspecialchars($e->getMessage(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
+                htmlspecialchars((string) $e->getCode(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
+                htmlspecialchars($e->getTraceAsString(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
             );
         }
 
@@ -690,10 +694,17 @@ public function _biz(array $params = []): mixed
             throw new \Exception('Wrong parameter format, missing path');
         }
 
-        // Special character processing
-        $bizPath = str_replace('..', '', (string) $bizPathRaw);
-        $bizPath = str_replace('/', '', $bizPath);
-        $bizPath = str_replace('\\', '', $bizPath);
+        // Validate path using a whitelist: only alphanumerics, underscores, hyphens, and dots
+        $bizPath = (string) $bizPathRaw;
+        if (!preg_match('/^[a-zA-Z0-9_\-\.]+$/', $bizPath)) {
+            throw new \Exception('Wrong parameter format, invalid characters in path');
+        }
+        // Prevent path traversal segments
+        foreach (explode('.', $bizPath) as $segment) {
+            if ($segment === '' || $segment === '..') {
+                throw new \Exception('Wrong parameter format, invalid path segment');
+            }
+        }
         $names = explode('.', $bizPath, 20);
         $count = count($names);
         if ($count < 2) {
diff --git a/library/Plume/Http/Router.php b/library/Plume/Http/Router.php
@@ -154,7 +154,7 @@ private function saveCache(): void
         }
         $cacheDir = dirname($this->cacheFile);
         if (!is_dir($cacheDir)) {
-            mkdir($cacheDir, 0755, true);
+            mkdir($cacheDir, 0700, true);
         }
         $tmp = $this->cacheFile . '.' . getmypid() . '.tmp';
         file_put_contents(
diff --git a/library/Plume/Support/Logger.php b/library/Plume/Support/Logger.php
@@ -36,7 +36,7 @@ public function __construct(
             $this->logPath = C('PLUME_LOG_PATH') ?: LOG_PATH;
         }
         if (!is_dir($this->logPath)) {
-            mkdir($this->logPath, 0755, true);
+            mkdir($this->logPath, 0700, true);
         }
 
         // Flush buffered DEBUG/INFO/NOTICE logs on shutdown so fatal errors
diff --git a/library/Plume/Support/View.php b/library/Plume/Support/View.php
@@ -135,7 +135,7 @@ public function render(string $file, ?array $data = [], string|false $layout = '
             ? $this->getCompiledTemplate($this->content)
             : $this->content;
 
-        extract($this->vars);
+        extract($this->vars, EXTR_SKIP);
         if ('' === $layout || false === $layout) {
             include $includeFile;
         } else {
diff --git a/library/PlumeHelper.php b/library/PlumeHelper.php
@@ -128,22 +128,30 @@ public static function curlGetContents(
 
     public static function redirect(string $url, int $time = 0, string $msg = ''): never
     {
-        $url = str_replace(["\n", "\r"], '', $url);
+        $url = str_replace(["\n", "\r", "\0"], '', $url);
+
+        // Block javascript: and data: URIs which cannot be safe redirect targets
+        if (preg_match('/^\s*(?:javascript|data|vbscript):/i', $url)) {
+            $url = '/';
+        }
+
         if (empty($msg)) {
-            $msg = "系统将在{$time}秒之后自动跳转到{$url}！";
+            $escapedUrl = htmlspecialchars($url, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+            $msg        = "系统将在{$time}秒之后自动跳转到{$escapedUrl}！";
         }
         if (!headers_sent()) {
             if (0 === $time) {
                 header('Location: ' . $url);
             } else {
                 header("refresh:{$time};url={$url}");
-                echo $msg;
+                echo htmlspecialchars($msg, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
             }
             exit();
         } else {
-            $str = "<meta http-equiv='Refresh' content='{$time};URL={$url}'>";
+            $safeUrl = htmlspecialchars($url, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+            $str     = "<meta http-equiv='Refresh' content='{$time};URL={$safeUrl}'>";
             if ($time != 0) {
-                $str .= $msg;
+                $str .= htmlspecialchars($msg, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
             }
             exit($str);
         }
@@ -245,7 +253,7 @@ public static function signature(array $datas, string $key): string
                 $tmp[] = $k . '=' . $v;
             }
         }
-        return md5(implode('&', $tmp) . '&key=' . $key);
+        return hash_hmac('sha256', implode('&', $tmp), $key);
     }
 
     public static function htmlFilter(string $html): string
@@ -260,56 +268,56 @@ public static function htmlFilter(string $html): string
     }
 
     /**
-     * @deprecated since PlumePHP 1.4.0 — uses MD5-based RC4 stream cipher (Discuz legacy).
-     *   Replace with sodium_crypto_secretbox() or openssl_encrypt('AES-256-GCM', ...).
-     *   This function will be removed in a future major version.
+     * Encrypt or decrypt a string using AES-256-GCM (authenticated encryption).
+     *
+     * Encoding: base64url(nonce[12] + tag[16] + ciphertext) for ENCODE,
+     * or the same layout for DECODE.
+     *
+     * The $expiry parameter is embedded as a 10-digit Unix timestamp prefix
+     * inside the plaintext (0 = no expiry), preserving backward-compatible
+     * semantics with the legacy RC4-based implementation this replaced.
+     *
+     * @param string $string    Plaintext (ENCODE) or ciphertext (DECODE)
+     * @param string $operation 'ENCODE' or 'DECODE'
+     * @param string $key       Secret key (min 16 chars); falls back to APP_SECRET
+     * @param int    $expiry    Seconds until the token expires (0 = forever)
+     * @return string Ciphertext on ENCODE, plaintext on DECODE, '' on failure
      */
     public static function authcode(string $string, string $operation = 'DECODE', string $key = '', int $expiry = 0): string
     {
-        $ckeyLength = 4;
-        $key        = md5($key ?: 'plumephp');
-        $keya       = md5(substr($key, 0, 16));
-        $keyb       = md5(substr($key, 16, 16));
-        // @phpstan-ignore-next-line ($ckeyLength is intentionally a constant 4 here)
-        $keyc       = $ckeyLength
-            ? ($operation == 'DECODE' ? substr($string, 0, $ckeyLength) : substr(md5(microtime()), -$ckeyLength))
-            : '';
-        $cryptkey   = $keya . md5($keya . $keyc);
-        $keyLength  = strlen($cryptkey);
-        $string     = $operation == 'DECODE'
-            ? base64_decode(substr($string, $ckeyLength))
-            : sprintf('%010d', $expiry ? $expiry + time() : 0) . substr(md5($string . $keyb), 0, 16) . $string;
-        $stringLength = strlen($string);
-        $result = '';
-        $box    = range(0, 255);
-        $rndkey = [];
-        for ($i = 0; $i <= 255; $i++) {
-            $rndkey[$i] = ord($cryptkey[$i % $keyLength]);
-        }
-        for ($j = $i = 0; $i < 256; $i++) {
-            $j       = ($j + $box[$i] + $rndkey[$i]) % 256;
-            $tmp     = $box[$i];
-            $box[$i] = $box[$j];
-            $box[$j] = $tmp;
-        }
-        for ($a = $j = $i = 0; $i < $stringLength; $i++) {
-            $a       = ($a + 1) % 256;
-            $j       = ($j + $box[$a]) % 256;
-            $tmp     = $box[$a];
-            $box[$a] = $box[$j];
-            $box[$j] = $tmp;
-            $result .= chr((int)(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256])));
-        }
-        if ($operation == 'DECODE') {
-            $expireTs = (int) substr($result, 0, 10);
-            if (($expireTs === 0 || $expireTs - time() > 0)
-                && substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16)
-            ) {
-                return substr($result, 26);
+        $rawKey = $key ?: (string) getenv('APP_SECRET') ?: 'plumephp-insecure-fallback-key!!';
+        // Derive a 256-bit key via SHA-256 so any key length is accepted safely
+        $derivedKey = hash('sha256', $rawKey, true);
+
+        if (strtoupper($operation) === 'ENCODE') {
+            $expireTs  = $expiry > 0 ? sprintf('%010d', time() + $expiry) : '0000000000';
+            $plaintext = $expireTs . $string;
+            $nonce     = random_bytes(12);
+            $tag       = '';
+            $cipher    = openssl_encrypt($plaintext, 'aes-256-gcm', $derivedKey, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
+            if ($cipher === false) {
+                return '';
             }
+            return rtrim(strtr(base64_encode($nonce . $tag . $cipher), '+/', '-_'), '=');
+        }
+
+        // DECODE
+        $raw = base64_decode(strtr($string, '-_', '+/') . str_repeat('=', (4 - strlen($string) % 4) % 4), true);
+        if ($raw === false || strlen($raw) < 29) { // 12 nonce + 16 tag + 1 min payload
             return '';
         }
-        return $keyc . str_replace('=', '', base64_encode($result));
+        $nonce  = substr($raw, 0, 12);
+        $tag    = substr($raw, 12, 16);
+        $cipher = substr($raw, 28);
+        $plain  = openssl_decrypt($cipher, 'aes-256-gcm', $derivedKey, OPENSSL_RAW_DATA, $nonce, $tag);
+        if ($plain === false) {
+            return '';
+        }
+        $expireTs = (int) substr($plain, 0, 10);
+        if ($expireTs !== 0 && $expireTs < time()) {
+            return '';
+        }
+        return substr($plain, 10);
     }
 
     // -----------------------------------------------------------------------
@@ -335,10 +343,20 @@ public static function arrayMergeDeep(array &$arr1, array $arr2): void
 
     public static function uuid(string $prefix = ''): string
     {
-        $time  = md5(microtime());
-        $rand1 = md5(substr($time, rand(0, 10), rand(22, 32)));
-        $rand2 = md5(substr($rand1, rand(0, 10), rand(22, 32)));
-        return strtolower(md5($prefix . uniqid($prefix) . $time . $rand1 . $rand2));
+        $bytes = random_bytes(16);
+        // Set version 4 (random) and variant bits per RFC 4122
+        $bytes[6] = chr((ord($bytes[6]) & 0x0f) | 0x40);
+        $bytes[8] = chr((ord($bytes[8]) & 0x3f) | 0x80);
+        $hex = bin2hex($bytes);
+        $uuid = sprintf(
+            '%s-%s-%s-%s-%s',
+            substr($hex, 0, 8),
+            substr($hex, 8, 4),
+            substr($hex, 12, 4),
+            substr($hex, 16, 4),
+            substr($hex, 20, 12)
+        );
+        return $prefix ? $prefix . '-' . $uuid : $uuid;
     }
 
     public static function strcut(string $str, int $len, string $ext = '', int $zhLen = 0): string
diff --git a/library/core/Plume/Libs/Action.php b/library/core/Plume/Libs/Action.php
@@ -196,8 +196,8 @@ public function run(): mixed
 
         $this->csrfToken = $this->getCookie($this->csrfTokenKey);
         if ($this->csrfValidate && C('PLUME_PHP_ENV') !== 'testing' && !$this->validateCsrfToken()) {
-            header('HTTP/1.1 401 Unauthorized');
-            $this->error("Unauthorized");
+            header('HTTP/1.1 403 Forbidden');
+            $this->error("Forbidden");
         }
 
         $this->createCsrfToken();
@@ -485,15 +485,39 @@ public function getCookie(?string $key = null)
 
     /**
      * Set a cookie on the response.
-     * @param string $key    Cookie name
-     * @param string $value  Cookie value
-     * @param int    $expire Lifetime in seconds (default 86400)
-     * @param string $path   Cookie path
-     * @param string $domain Cookie domain
+     * @param string                            $key      Cookie name
+     * @param string                            $value    Cookie value
+     * @param int                               $expire   Lifetime in seconds (default 86400)
+     * @param string                            $path     Cookie path
+     * @param string                            $domain   Cookie domain
+     * @param bool                              $httpOnly Prevent JavaScript access (default true)
+     * @param bool                              $secure   Transmit over HTTPS only (default auto-detected)
+     * @param 'Lax'|'lax'|'Strict'|'strict'|'None'|'none' $sameSite SameSite policy (default 'Lax')
      */
-    public function setCookie(string $key, string $value, int $expire = 86400, string $path = '/', string $domain = ''): void
-    {
-        setcookie($key, $value, time() + $expire, $path, $domain);
+    public function setCookie(
+        string $key,
+        string $value,
+        int $expire = 86400,
+        string $path = '/',
+        string $domain = '',
+        bool $httpOnly = true,
+        bool $secure = false,
+        string $sameSite = 'Lax'
+    ): void {
+        $isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
+            || (($_SERVER['SERVER_PORT'] ?? '') === '443');
+        /** @var array{expires: int, path: string, domain: string, secure: bool, httponly: bool, samesite: 'Lax'|'lax'|'Strict'|'strict'|'None'|'none'} $options */
+        $options = [
+            'expires'  => time() + $expire,
+            'path'     => $path,
+            'domain'   => $domain,
+            'secure'   => $secure || $isHttps,
+            'httponly' => $httpOnly,
+            'samesite' => in_array($sameSite, ['Lax', 'lax', 'Strict', 'strict', 'None', 'none'], true)
+                ? $sameSite
+                : 'Lax',
+        ];
+        setcookie($key, $value, $options);
     }
 
     /**
@@ -629,7 +653,7 @@ public function validateCsrfToken()
             $mask = str_pad($mask, $n2, $n1 === 0 ? ' ' : $mask);
         }
         $token = $mask ^ $token;
-        return $token === $trueToken;
+        return hash_equals($trueToken, $token);
     }
 
     protected function beforeRun(): bool
diff --git a/tests/PlumeHelperTest.php b/tests/PlumeHelperTest.php
@@ -94,16 +94,25 @@ public function testHtmlFilter(): void
     // Data / String
     // -----------------------------------------------------------------------
 
-    public function testUuidIsLowerHex(): void
+    public function testUuidIsRfc4122(): void
     {
         $id = PlumeHelper::uuid();
-        $this->assertMatchesRegularExpression('/^[0-9a-f]+$/', $id);
+        // RFC 4122 v4 format: xxxxxxxx-xxxx-4xxx-[89ab]xxx-xxxxxxxxxxxx
+        $this->assertMatchesRegularExpression(
+            '/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/',
+            $id
+        );
     }
 
     public function testUuidWithPrefix(): void
     {
         $id = PlumeHelper::uuid('usr');
-        $this->assertMatchesRegularExpression('/^[0-9a-f]+$/', $id);
+        $this->assertStringStartsWith('usr-', $id);
+        $uuid = substr($id, 4);
+        $this->assertMatchesRegularExpression(
+            '/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/',
+            $uuid
+        );
     }
 
     public function testStrcut(): void

Original file line number	Diff line number	Diff line change
`@@ -154,7 +154,7 @@ private function saveCache(): void`
`154`	`154`	`}`
`155`	`155`	`$cacheDir = dirname($this->cacheFile);`
`156`	`156`	`if (!is_dir($cacheDir)) {`
`157`		`- mkdir($cacheDir, 0755, true);`
	`157`	`+ mkdir($cacheDir, 0700, true);`
`158`	`158`	`}`
`159`	`159`	`$tmp = $this->cacheFile . '.' . getmypid() . '.tmp';`
`160`	`160`	`file_put_contents(`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ public function __construct(`
`36`	`36`	`$this->logPath = C('PLUME_LOG_PATH') ?: LOG_PATH;`
`37`	`37`	`}`
`38`	`38`	`if (!is_dir($this->logPath)) {`
`39`		`- mkdir($this->logPath, 0755, true);`
	`39`	`+ mkdir($this->logPath, 0700, true);`
`40`	`40`	`}`
`41`	`41`
`42`	`42`	`// Flush buffered DEBUG/INFO/NOTICE logs on shutdown so fatal errors`