Merge pull request #6 from VanceHud/main

修复了几个BUG

Author: VanceHud

.github/workflows/docker-image.yml

@@ -7,6 +7,9 @@ on:
     branches: [ "main" ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

server/app.js

@@ -112,14 +112,15 @@ app.get('/api/status', (req, res) => {
     });
 });
 
-// Setup Routes (Always available, but logic inside checks if already configured)
-app.use('/api/setup', setupRoutes);
-
 // Rate Limiter & User Identification
 // Apply soft authentication (identifyUser) and rate limiting (rateLimiter)
 // identifyUser must come before rateLimiter so we can check roles
 app.use('/api', identifyUser, rateLimiter);
 
+// Setup Routes (Always available, but logic inside checks if already configured)
+// Now protected by rate limiting to prevent DoS attacks
+app.use('/api/setup', setupRoutes);
+
 // App Routes (Only work if configured)
 const requireConfig = (req, res, next) => {
     if (!isConfigured()) {

server/routes/admin-notifications.js

@@ -64,8 +64,8 @@ router.post('/', authenticateToken, requireAdminRole, async (req, res) => {
         return res.status(400).json({ error: '邮箱地址不能为空' });
     }
 
-    // Email validation
-    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    // Email validation - using a safer regex pattern to prevent ReDoS
+    const emailRegex = /^[a-zA-Z0-9._%-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
     if (!emailRegex.test(email)) {
         return res.status(400).json({ error: '邮箱地址格式不正确' });
     }

server/routes/email-templates.js

@@ -62,7 +62,7 @@ router.put('/:key', authenticateToken, requireSuperAdmin, async (req, res) => {
 
         res.json({ success: true });
     } catch (err) {
-        console.error(`Error updating email template ${key}:`, err);
+        console.error('Error updating email template:', { key, error: err });
         res.status(500).json({ error: 'Failed to update template' });
     }
 });

server/routes/knowledge-base.js

@@ -11,8 +11,8 @@ const router = express.Router();
 const generateSlug = (title) => {
     return title
         .toLowerCase()
-        .replace(/[^\w\u4e00-\u9fa5]+/g, '-') // Keep Chinese characters
-        .replace(/^-+|-+$/g, '')
+        .replace(/[^\w\u4e00-\u9fa5]+/g, '-') // Keep Chinese characters - replace sequences of non-word/non-Chinese chars with single dash
+        .replace(/^-|-$/g, '') // Remove leading/trailing dashes
         .substring(0, 100);
 };