feat: v0.7.0 四阶段全量迭代 — 修复面收口 · 安全纵深 · 架构还债 · 能力演进

P1 修复面收口: v0.6.3 截断自愈推全量(Anthropic/Ollama/非流式/引擎兜底); SSE 上游错误帧检测进重试通道; clearMessages 摘要游标根治; truncateResult 内联图片白名单统一; 前端四 bug(确认弹窗锁死/MemoryViewer/ Virtuoso Footer/abort 尾部过滤) + reasoning 缓冲跨迭代污染; 托盘通知过滤与新建会话死链接线 P2 安全纵深: MCP 审批闭环(ConfirmationHook×PolicyEngine 联动+重名拒注册); SSRF 收敛 ssrf-guard 共享模块 (web_fetch 双通道校验+重定向终态复检); Electron 加固(preload CJS 化→sandbox:true/CSP/权限白名单/will-navigate); run_command cmd.exe 白名单通道元字符守门; diff_viewer 10MB 预检; Anthropic thinking 预算下限; Agnes 思考显式关闭 P3 架构还债: OpenAICompatibleAdapter 中间基类收敛四家样板; 错误分类单轨化(删 mapError/getFetchSignal, 超时显式 ETIMEDOUT); PRAGMA user_version 迁移版本化; 死代码清理专项(cn.ts/SHORTCUTS/ContextMenu 分支/ getWindowState/modifiedArgs/sandbox 空壳); i18next 引入; a11y 第一轮; SearXNG 页批量草稿模型统一 P4 能力演进: Ollama pull 可取消/capabilities 探测/num_ctx 实测缓存; UpdateService feed 比对式自动更新 (app:updateCheck IPC + StatusBar 入口); MiMo providerOptions(web_search 服务端工具/strict JSON); web_fetch extract_mode=markdown(turndown); network.proxyUrl 全局代理(Chromium sessions+undici dispatcher) 测试: 264 → 507 用例(Electron ABI 全绿零跳过), 覆盖引擎压缩管线/重试竞速/MEMORY.md 闸门/file_editor 五操作/ filesystem 七工具实体夹具/git 真实仓库/SSE 错误帧/全线截断自愈/Provider 请求形态矩阵/SSRF 表测/钩子分级矩阵/ OutputValidator 全量/SLO 指标/MCP 安全纯函数/task_manager 链路/渲染层纯域/i18n 桥契约
2026-08-27 17:06:58 +08:00
parent b6e2a8bd25
commit 3940716dc2
78 changed files with 6369 additions and 1341 deletions
@@ -0,0 +1,162 @@
+/**
+ * ssrf-guard 共享模块测试（v0.6.4 P2-2）
+ *
+ * 背景：SSRF 校验此前是 http_request 内部私有实现，web_fetch/浏览器回退完全无校验。
+ * 收敛到单一模块后，本文件以表格化用例锁定私有段判定与 DNS 解析行为；
+ * 另验证 WebFetchTool 对内网 URL 在发出任何网络请求前即被拒绝，
+ * 且不进入浏览器回退通道（否则等于借 Chromium 绕过）。
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('electron-log', () => ({
+  default: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+}));
+
+// DNS lookup 按域名返回表驱动结果（validateSSRF 内部使用 all: true）
+const dnsTable: Record<string, Array<{ address: string; family: number }>> = {
+  'public.example.com': [{ address: '93.184.216.34', family: 4 }],
+  'mixed.example.com': [
+    { address: '93.184.216.34', family: 4 },
+    { address: '192.168.1.10', family: 4 },
+    { address: '2606:2800:220:1:248:1893:25c8:1946', family: 6 },
+  ],
+  'v4mapped.example.com': [{ address: '::ffff:127.0.0.1', family: 6 }],
+  'localhost': [{ address: '127.0.0.1', family: 4 }],
+  'nx.example.com': [],
+};
+
+vi.mock('node:dns/promises', () => ({
+  lookup: vi.fn(async (hostname: string) => {
+    if (!(hostname in dnsTable)) {
+      throw Object.assign(new Error(`ENOTFOUND ${hostname}`), { code: 'ENOTFOUND' });
+    }
+    return dnsTable[hostname];
+  }),
+}));
+
+import { isPrivateIP, validateSSRF } from '../ssrf-guard';
+import { WebFetchTool } from '../web-fetch';
+import type { ToolExecutionContext } from '../../../types/metona-tool';
+
+describe('isPrivateIP 表格化判定', () => {
+  const privateCases = [
+    '127.0.0.1',
+    '127.9.9.9', // 整个 127/8 都是回环
+    '10.1.2.3',
+    '192.168.0.1',
+    '172.16.0.1',
+    '172.31.255.255',
+    '169.254.169.254', // 云元数据
+    '0.0.0.0',
+    '224.0.0.5', // 组播
+    '240.0.0.1', // 保留
+    '::1',
+    'fe80::a',
+    'fc00::a',
+    'fd12::a',
+    '::ffff:10.0.0.5', // v4 映射递归检测
+  ];
+  const publicCases = [
+    '8.8.8.8',
+    '93.184.216.34',
+    '172.32.0.1', // 刚好超出 172.16-31
+    '::ffff:8.8.8.8',
+    '2606:2800:220:1:248:1893:25c8:1946',
+  ];
+
+  it.each(privateCases)('%s → 私有（拒绝）', (ip) => {
+    expect(isPrivateIP(ip)).toBe(true);
+  });
+  it.each(publicCases)('%s → 公网（放行）', (ip) => {
+    expect(isPrivateIP(ip)).toBe(false);
+  });
+});
+
+describe('validateSSRF', () => {
+  it('协议白名单：非 http(s) 直接拒绝', async () => {
+    await expect(validateSSRF('ftp://example.com')).rejects.toThrow('Blocked SSRF');
+    await expect(validateSSRF('file:///etc/passwd')).rejects.toThrow('Blocked SSRF');
+  });
+
+  it('hostname 为 IP 时直接判定，不做 DNS', async () => {
+    await expect(validateSSRF('http://127.0.0.1:8080/admin')).rejects.toThrow(
+      'private/loopback address',
+    );
+    await expect(validateSSRF('http://169.254.169.254/latest/meta-data')).rejects.toThrow(
+      'private/loopback address',
+    );
+  });
+
+  it('域名解析出任一私有 IP 即拒绝（防 rebinding 只查首个 IP）', async () => {
+    await expect(validateSSRF('http://mixed.example.com/')).rejects.toThrow(
+      /resolves to private IP/,
+    );
+  });
+
+  it('::ffff: 映射的回环地址同样拒绝', async () => {
+    await expect(validateSSRF('http://v4mapped.example.com/')).rejects.toThrow(
+      /resolves to private IP/,
+    );
+  });
+
+  it('纯公网域名正常通过', async () => {
+    await expect(validateSSRF('http://public.example.com/page')).resolves.toBeUndefined();
+  });
+
+  it('DNS 解析为空（无记录）即拒绝（fail-closed）', async () => {
+    await expect(validateSSRF('http://nx.example.com/')).rejects.toThrow('no DNS records');
+  });
+
+  it('DNS 查询异常（ENOTFOUND 等）同样拒绝', async () => {
+    await expect(validateSSRF('http://not-in-table.invalid/')).rejects.toThrow(
+      'DNS resolution failed',
+    );
+  });
+});
+
+describe('WebFetchTool — SSRF 入口拦截（v0.6.4 安全不对称根治）', () => {
+  const context: ToolExecutionContext = {
+    sessionId: 't',
+    workspacePath: process.cwd(),
+    iteration: 1,
+    requestId: 'r',
+  };
+
+  it('拒绝回环地址且不发起任何网络请求、不进入浏览器回退', async () => {
+    const fetchSpy = vi.fn();
+    vi.stubGlobal('fetch', fetchSpy);
+
+    const tool = new WebFetchTool();
+    const result = (await tool.execute({ url: 'http://127.0.0.1:4567/internal' }, context)) as {
+      success?: boolean;
+      error?: string;
+    };
+
+    expect(result.success).toBe(false);
+    expect(result.error ?? '').toContain('Blocked SSRF');
+    // 关键契约：零网络请求（HTTP 与浏览器两个通道都不允许触达内网）
+    expect(fetchSpy).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+
+  it('拒绝云元数据地址', async () => {
+    const tool = new WebFetchTool();
+    const result = (await tool.execute({ url: 'http://169.254.169.254/latest/meta-data/' }, context)) as {
+      success?: boolean;
+      error?: string;
+    };
+    expect(result.success).toBe(false);
+    expect(result.error ?? '').toContain('Blocked SSRF');
+  });
+
+  it('拒绝解析为内网的域名（如 localhost）', async () => {
+    const tool = new WebFetchTool();
+    const result = (await tool.execute({ url: 'http://localhost/api' }, context)) as {
+      success?: boolean;
+      error?: string;
+    };
+    expect(result.success).toBe(false);
+    expect(result.error ?? '').toContain('Blocked SSRF');
+  });
+});