Merge pull request #1442 from IceCola97/PR-Branch

修复test_game;修复函数体清洗对于异步函数体的支持
This commit is contained in:
Spmario233 2024-06-07 15:30:43 +08:00 committed by GitHub
commit 783266c6a2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 33 additions and 8 deletions

View File

@ -813,7 +813,8 @@ game.import("mode", function (lib, game, ui, get, ai, _status) {
}
}
if (typeof lib.config.test_game == "string" && player == game.me.next) {
player.init(lib.config.test_game);
if (lib.config.test_game != "_")
player.init(lib.config.test_game);
}
player.node.name.dataset.nature = get.groupnature(player.group);
};

View File

@ -1712,7 +1712,8 @@ game.import("mode", function (lib, game, ui, get, ai, _status) {
}
}
if (typeof lib.config.test_game == "string" && player == game.me.next) {
player.init(lib.config.test_game);
if (lib.config.test_game != "_")
player.init(lib.config.test_game);
}
if (get.is.double(player.name1)) {
player._groupChosen = true;

View File

@ -1,4 +1,4 @@
import { userAgent, GeneratorFunction, AsyncFunction } from "../util/index.js";
import { userAgent, GeneratorFunction, AsyncFunction, AsyncGeneratorFunction } from "../util/index.js";
import { game } from "../game/index.js";
import { lib } from "../library/index.js";
import { _status } from "../status/index.js";
@ -1508,12 +1508,33 @@ export class Get {
* 测试一段代码是否为函数体
* ```
*
* @typedef {"async"|"generator"|"agenerator"|"any"|null} FunctionType
*
* @param {string} code
* @param {FunctionType} type
* @returns {boolean}
*/
isFunctionBody(code) {
isFunctionBody(code, type = null) {
if (type == "any") {
return ["async", "generator", "agenerator", null]
// @ts-ignore // 突然发现ts-ignore也挺方便的喵
.some(t => get.isFunctionBody(code, t));
}
try {
new Function(code);
switch (type) {
default:
new Function(code);
break;
case "generator":
new GeneratorFunction(code);
break;
case "async":
new AsyncFunction(code);
break;
case "agenerator":
new AsyncGeneratorFunction(code);
break;
}
} catch (e) {
return false;
}
@ -1534,7 +1555,7 @@ export class Get {
let body = str.slice(arrowMatch[0].length).trim();
if (body.startsWith("{") && body.endsWith("}")) body = body.slice(1, -1);
else body = `return ${body}`;
if (!get.isFunctionBody(body)) {
if (!get.isFunctionBody(body, "any")) {
console.error("发现疑似恶意的远程代码:", str);
return `()=>console.error("尝试执行疑似恶意的远程代码")`;
}
@ -1546,7 +1567,7 @@ export class Get {
const head = fullMatch[1];
const args = fullMatch[2] || '';
const body = str.slice(fullMatch[0].length).slice(0, -1);
if (!get.isFunctionBody(body)) {
if (!get.isFunctionBody(body, "any")) {
console.error("发现疑似恶意的远程代码:", str);
return `()=>console.error("尝试执行疑似恶意的远程代码")`;
}

View File

@ -517,7 +517,7 @@ export class Player extends HTMLDivElement {
str += `'step ${i}'\n\t${str2}\n\t`;
}
// 防止注入喵
if (!get.isFunctionBody(str)) throw new Error("无效的content函数代码");
if (!get.isFunctionBody(str, "any")) throw new Error("无效的content函数代码");
let recompiledScope;
if (security.isSandboxRequired()) {
recompiledScope = scope ? security.eval(`return (${scope.toString()})`) : code => security.eval(`return (${code.toString()})`);

View File

@ -4133,6 +4133,7 @@ export class Click {
}
}
pause() {
if (lib.config.test_game) return;
if (_status.paused2 || _status.pausing || _status.nopause || !ui.pause) return;
if (!_status.video) {
if (ui.pause.classList.contains("hidden")) return;
@ -4165,6 +4166,7 @@ export class Click {
if (_status.pausing) return;
if (_status.dragged) return;
if (_status.clicked) return;
if (lib.config.test_game) return;
this.delete();
ui.system.show();
ui.time.show();