fix: vulnerability problems

apps/chat.js

@@ -6,7 +6,7 @@ import { v4 as uuid } from 'uuid'
 import delay from 'delay'
 import { ChatGPTAPI } from 'chatgpt'
 import { ChatGPTClient, BingAIClient } from '@waylaidwanderer/chatgpt-api'
-import { getMessageById, makeForwardMsg, tryTimes, upsertMessage } from '../utils/common.js'
+import {escapeHtml, getMessageById, makeForwardMsg, tryTimes, upsertMessage} from '../utils/common.js'
 import { ChatGPTPuppeteer } from '../utils/browser.js'
 import { KeyvFile } from 'keyv-file'
 import { OfficialChatGPTClient } from '../utils/message.js'
@@ -275,12 +275,12 @@ export class chatgpt extends plugin {
       }
     }
 
-    if (prompt.indexOf('<script>') != -1)
-    {
-      await this.reply('坏人，我要报告给主人', e.isGroup)
-      Bot.pickUser(cfg.masterQQ[0]).sendMsg(`主人,我在${this.e.group_id ? '群' + this.e.group_id : '私聊' }被${e.sender.nickname}使用代码攻击了，请警惕`)
-      return false
-    }
+//    if (prompt.indexOf('<script>') != -1)
+//    {
+//      await this.reply('坏人，我要报告给主人', e.isGroup)
+//      Bot.pickUser(cfg.masterQQ[0]).sendMsg(`主人,我在${this.e.group_id ? '群' + this.e.group_id : '私聊' }被${e.sender.nickname}使用代码攻击了，请警惕`)
+//      return false
+//    }
 
     const use = await redis.get('CHATGPT:USE')
     if (use !== 'bing') {
@@ -448,7 +448,6 @@ export class chatgpt extends plugin {
         // logger.info(response)
         // markdown转为html
         // todo部分数学公式可能还有问题
-        let converted = response // converter.makeHtml(response)
 
         /** 最后回复消息 */
         if (Config.showQRCode) {
@@ -459,7 +458,7 @@ export class chatgpt extends plugin {
             },
             body: JSON.stringify({
               content: {
-                content: converted,
+                content: response,
                 prompt,
                 senderName: e.sender.nickname
                 // quote: quotemessage
@@ -469,9 +468,9 @@ export class chatgpt extends plugin {
           }
           )
           let cache = await cacheres.json()
-          await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: converted, prompt, senderName: e.sender.nickname, cache: cache.file })
+          await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: escapeHtml(response), prompt: escapeHtml(prompt), senderName: e.sender.nickname, cache: cache.file })
         } else {
-          await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: converted, prompt, senderName: e.sender.nickname })
+          await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: escapeHtml(response), prompt: escapeHtml(prompt), senderName: e.sender.nickname })
         }
       } else {
         let quotemessage = []
@@ -502,9 +501,9 @@ export class chatgpt extends plugin {
             }
             )
             let cache = await cacheres.json()
-            await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: converted, prompt, senderName: e.sender.nickname, cache: cache.file })
+            await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: escapeHtml(response), prompt: escapeHtml(prompt), senderName: e.sender.nickname, cache: cache.file })
           } else {
-            await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: converted, prompt, senderName: e.sender.nickname })
+            await e.runtime.render('chatgpt-plugin', use !== 'bing' ? 'content/ChatGPT/index' : 'content/Bing/index', { content: escapeHtml(response), prompt: escapeHtml(prompt), senderName: e.sender.nickname })
           }
         } else {
           await this.reply(`${response}`, e.isGroup)

config/index.js

@@ -31,7 +31,8 @@ export const Config = {
   //                                                        以下为API3方式的配置                                                          *
   // ***********************************************************************************************************************************
   // from https://github.com/acheong08/ChatGPT
-  api: 'https://chatgpt.duti.tech/api/conversation',
+  api: 'https://chatgpt.roki.best/backend-api/conversation',
+  // api: 'https://chatgpt.duti.tech/api/conversation',
   apiBaseUrl: 'https://chatgpt.duti.tech',
   // ***********************************************************************************************************************************
   //                                                        以下为API2方式的配置                                                          *

resources/content/Bing/index.html

@@ -102,6 +102,7 @@
     <script src="{{pluResPath}}content/Bing/static/js/marked.min.js"></script>
     <script src="{{pluResPath}}content/Bing/static/js/tex-mml-chtml.js"></script>
     <script src="{{pluResPath}}content/Bing/static/js/main.js"></script>
+    <script src="{{pluResPath}}content/Bing/static/js/purify.min.js"></script>
 
     <script>
         marked.setOptions({
@@ -117,9 +118,11 @@
                 return hljs.highlightAuto(code,[lang]).value;
             }
         });
+        const markdown = $(".markdown").text();
+        const html = marked.parse(markdown);
+        const sanitizedHtml = DOMPurify.sanitize(html);
 
-        let text = marked.parse($(".markdown").text());
-        $(".markdown").html(text);
+        $(".markdown").html(sanitizedHtml);
         jQuery('#qrcode').qrcode({width: 128,height: 128,text: "http://content.alcedogroup.com/{{cache}}"});
     </script>
 </body>

resources/content/ChatGPT/index.html

@@ -21,7 +21,7 @@
                     <a href="#" class="site-logo">
                         <img src="{{pluResPath}}content/ChatGPT/static/picture/openai.png" alt="LOGO">
                     </a>
-                    
+
                 </div>
             </div>
         </div>
@@ -88,6 +88,7 @@
     <script src="{{pluResPath}}content/ChatGPT/static/js/marked.min.js"></script>
     <script src="{{pluResPath}}content/Bing/static/js/tex-mml-chtml.js"></script>
     <script src="{{pluResPath}}content/ChatGPT/static/js/main.js"></script>
+    <script src="{{pluResPath}}content/ChatGPT/static/js/purify.min.js"></script>
 
     <script>
         marked.setOptions({
@@ -103,9 +104,11 @@
                 return hljs.highlightAuto(code,[lang]).value;
             }
         });
+        const markdown = $(".markdown").text();
+        const html = marked.parse(markdown);
+        const sanitizedHtml = DOMPurify.sanitize(html);
 
-        let text = marked.parse($(".markdown").text());
-        $(".markdown").html(text);
+        $(".markdown").html(sanitizedHtml);
         jQuery('#qrcode').qrcode({width: 128,height: 128,text: "http://content.alcedogroup.com/{{cache}}"});
     </script>
 </body>

utils/common.js

@@ -6,6 +6,17 @@
 //    .processSync(markdown ?? '')
 //    .toString()
 // }
+export function escapeHtml (str) {
+  const htmlEntities = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '/': '&#x2F;'
+  }
+  return str.replace(/[&<>"'/]/g, (match) => htmlEntities[match])
+}
 
 export async function upsertMessage (message) {
   await redis.set(`CHATGPT:MESSAGE:${message.id}`, JSON.stringify(message))