安全加固：Web 登录防爆破(IP+用户名双维度限速 5次/分钟锁10分钟，未知用户名 dummy bcrypt 防枚举)，瓦片代理 SSRF 加固(DialContext 拒绝内网/链路本地/CGNAT/ULA 与重定向限制，Content-Type image 白名单+nosniff)，/api/discard-details 公开去敏(新增 admin 全字段端点)，公开地图源接口外部 URL/key 一律代理化，install.sh 随机管理员密码+非回环默认口令拒绝启动，后端 v1.4.0

2026-08-20 17:00:41 +08:00
parent fe0cf036cf
commit f21e8337af
13 changed files with 658 additions and 48 deletions
@@ -0,0 +1,173 @@
+// Package ratelimit 提供按 key(IP、用户名等)计数的失败限速器。
+//
+// 语义:key 在 Window 时间窗内连续失败 MaxFailures 次后,封锁 BlockFor 时长;
+// 成功调用 Reset 清空计数。并发安全,内部定期清理过期条目。
+package ratelimit
+
+import (
+	"fmt"
+	"sync"
+	"time"
+)
+
+const (
+	defaultMaxFailures = 5
+	defaultWindow      = time.Minute
+	defaultBlockFor    = 10 * time.Minute
+)
+
+// FailureLimiter 按 key 跟踪失败次数并执行临时封锁。
+type FailureLimiter struct {
+	mu        sync.Mutex
+	max       int
+	window    time.Duration
+	blockFor  time.Duration
+	fails     map[string]*failState
+	now       func() time.Time
+	stopped   chan struct{}
+	stopOnce  sync.Once
+	maxEntries int
+}
+
+type failState struct {
+	count        int
+	windowStart  time.Time
+	blockedUntil time.Time
+}
+
+// Options 自定义限速参数,零值使用默认(5 次/分钟,封锁 10 分钟)。
+type Options struct {
+	MaxFailures int
+	Window      time.Duration
+	BlockFor    time.Duration
+}
+
+// New 构造限速器并启动清理协程;服务退出时应调用 Stop。
+func New(opts Options) *FailureLimiter {
+	if opts.MaxFailures <= 0 {
+		opts.MaxFailures = defaultMaxFailures
+	}
+	if opts.Window <= 0 {
+		opts.Window = defaultWindow
+	}
+	if opts.BlockFor <= 0 {
+		opts.BlockFor = defaultBlockFor
+	}
+	l := &FailureLimiter{
+		max:       opts.MaxFailures,
+		window:    opts.Window,
+		blockFor:  opts.BlockFor,
+		fails:     make(map[string]*failState),
+		now:       time.Now,
+		stopped:   make(chan struct{}),
+		maxEntries: 8192,
+	}
+	go l.cleanupLoop()
+	return l
+}
+
+// Stop 结束清理协程。
+func (l *FailureLimiter) Stop() error {
+	l.stopOnce.Do(func() { close(l.stopped) })
+	return nil
+}
+
+func (l *FailureLimiter) cleanupLoop() {
+	ticker := time.NewTicker(time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-l.stopped:
+			return
+		case <-ticker.C:
+			l.purge()
+		}
+	}
+}
+
+func (l *FailureLimiter) purge() {
+	now := l.now()
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	for key, st := range l.fails {
+		if now.After(st.blockedUntil) && now.Sub(st.windowStart) > l.window {
+			delete(l.fails, key)
+		}
+	}
+}
+
+// Blocked 报告 key 当前是否被封锁;未封锁时返回剩余限制描述。
+func (l *FailureLimiter) Blocked(key string) bool {
+	if key == "" {
+		return false
+	}
+	now := l.now()
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	st, ok := l.fails[key]
+	return ok && now.Before(st.blockedUntil)
+}
+
+// BlockedRemaining 返回封锁剩余时长;未封锁返回 0。
+func (l *FailureLimiter) BlockedRemaining(key string) time.Duration {
+	if key == "" {
+		return 0
+	}
+	now := l.now()
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	st, ok := l.fails[key]
+	if !ok || now.After(st.blockedUntil) {
+		return 0
+	}
+	return time.Until(st.blockedUntil)
+}
+
+// Fail 记录一次失败;达到阈值返回 true 表示本次触发封锁。
+func (l *FailureLimiter) Fail(key string) bool {
+	if key == "" {
+		return false
+	}
+	now := l.now()
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	st, ok := l.fails[key]
+	if !ok || now.Sub(st.windowStart) > l.window {
+		st = &failState{windowStart: now}
+		l.fails[key] = st
+		if len(l.fails) > l.maxEntries {
+			l.purgeLocked(now)
+		}
+	}
+	st.count++
+	if st.count >= l.max {
+		st.blockedUntil = now.Add(l.blockFor)
+		st.count = 0
+		st.windowStart = now
+		return true
+	}
+	return false
+}
+
+// Reset 清除 key 的失败计数。
+func (l *FailureLimiter) Reset(key string) {
+	if key == "" {
+		return
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.fails, key)
+}
+
+func (l *FailureLimiter) purgeLocked(now time.Time) {
+	for key, st := range l.fails {
+		if now.After(st.blockedUntil) && now.Sub(st.windowStart) > l.window {
+			delete(l.fails, key)
+		}
+	}
+}
+
+// BlockedError 构造统一的封锁提示文案。
+func (l *FailureLimiter) BlockedError(key string) error {
+	return fmt.Errorf("too many failed attempts, retry after %s", l.BlockedRemaining(key).Round(time.Second))
+}
@@ -0,0 +1,81 @@
+package ratelimit
+
+import (
+	"testing"
+	"time"
+)
+
+func newTestLimiter(t *testing.T, opts Options) *FailureLimiter {
+	t.Helper()
+	if opts.MaxFailures == 0 {
+		opts.MaxFailures = 3
+	}
+	l := New(opts)
+	t.Cleanup(func() { _ = l.Stop() })
+	return l
+}
+
+func TestFailBlocksAndExpires(t *testing.T) {
+	l := newTestLimiter(t, Options{})
+	now := time.Unix(1700000000, 0)
+	l.now = func() time.Time { return now }
+
+	for i := 0; i < 5; i++ {
+		l.Fail("1.2.3.4")
+	}
+	if !l.Blocked("1.2.3.4") {
+		t.Fatal("key should be blocked after 5 failures")
+	}
+	now = now.Add(11 * time.Minute)
+	if l.Blocked("1.2.3.4") {
+		t.Fatal("key should be unblocked after blockFor")
+	}
+}
+
+func TestFailWindowResets(t *testing.T) {
+	l := newTestLimiter(t, Options{})
+	now := time.Unix(1700000000, 0)
+	l.now = func() time.Time { return now }
+
+	for i := 0; i < 4; i++ {
+		l.Fail("ip")
+	}
+	now = now.Add(2 * time.Minute) // 超过 window,计数应清零
+	l.Fail("ip")
+	l.Fail("ip")
+	if l.Blocked("ip") {
+		t.Fatal("counts should reset after window passes")
+	}
+}
+
+func TestSuccessResets(t *testing.T) {
+	l := newTestLimiter(t, Options{})
+	l.Fail("ip")
+	l.Reset("ip")
+	if l.Blocked("ip") {
+		t.Fatal("reset must clear failures")
+	}
+}
+
+func TestDifferentKeysIndependent(t *testing.T) {
+	l := newTestLimiter(t, Options{})
+	for i := 0; i < 10; i++ {
+		l.Fail("a")
+	}
+	if !l.Blocked("a") {
+		t.Fatal("a should be blocked")
+	}
+	if l.Blocked("b") {
+		t.Fatal("b must not be affected by a")
+	}
+}
+
+func TestEmptyKeyIgnored(t *testing.T) {
+	l := newTestLimiter(t, Options{})
+	for i := 0; i < 100; i++ {
+		l.Fail("")
+	}
+	if l.Blocked("") {
+		t.Fatal("empty key must not be tracked")
+	}
+}