core&ui: cors (#498)

packages/hydrooj/src/model/domain.ts

@@ -297,7 +297,7 @@ bus.on('ready', () => Promise.all([
     ),
 ]));
 bus.on('domain/delete-cache', (domainId: string) => {
-    cache.del(`id::${domainId}`);
+    cache.delete(`id::${domainId}`);
 });
 export default DomainModel;
 global.Hydro.model.domain = DomainModel;

packages/hydrooj/src/model/setting.ts

@@ -203,6 +203,7 @@ SystemSetting(
     Setting('setting_server', 'server.xff', null, 'text', 'server.xff', 'IP Header'),
     Setting('setting_server', 'server.xhost', null, 'text', 'server.xhost', 'Hostname Header'),
     Setting('setting_server', 'server.xproxy', false, 'boolean', 'server.xproxy', 'Use reverse_proxy'),
+    Setting('setting_server', 'server.cors', '', 'text', 'server.cors', 'CORS domains'),
     Setting('setting_server', 'server.language', 'zh_CN', langRange, 'server.language', 'Default display language'),
     Setting('setting_server', 'server.login', true, 'boolean', 'server.login', 'Allow builtin-login', FLAG_PRO),
     Setting('setting_server', 'server.message', true, 'boolean', 'server.message', 'Allow users send messages'),

packages/hydrooj/src/service/layers/base.ts

@@ -19,10 +19,15 @@ export const UiContextBase: UiContextBase = {
 export default async (ctx: KoaContext, next: Next) => {
     // Base Layer
     const { domainId, domainInfo } = ctx;
+    const [xff, xhost] = system.getMany(['server.xff', 'server.xhost']);
     const request: HydroRequest = {
         method: ctx.request.method.toLowerCase(),
-        ...pick(ctx.request, ['host', 'hostname', 'ip', 'headers']),
-        ...pick(ctx, ['query', 'path', 'params', 'originalPath', 'querystring', 'cookies']),
+        host: ctx.request.headers[xhost?.toLowerCase() || ''] as string || ctx.request.host,
+        hostname: ctx.request.hostname,
+        ip: ctx.request.headers[xff?.toLowerCase() || ''] as string || ctx.request.ip,
+        headers: ctx.request.headers,
+        cookies: ctx.cookies,
+        ...pick(ctx, ['query', 'path', 'params', 'originalPath', 'querystring']),
         body: ctx.request.body,
         files: ctx.request.files as any,
         referer: ctx.request.headers.referer || '',

packages/hydrooj/src/service/layers/user.ts

@@ -21,7 +21,7 @@ export default async (ctx: KoaContext, next) => {
         ctx.pendingError = new NotFoundError(args.domainId);
         args.domainId = 'system';
     }
-    if (request.method === 'post' && request.headers.referer) {
+    if (request.method === 'post' && request.headers.referer && !ctx.cors) {
         const host = new URL(request.headers.referer).host;
         if (host !== request.host) ctx.pendingError = new CsrfTokenError(host);
     }

packages/hydrooj/src/service/server.ts

@@ -97,7 +97,6 @@ export const httpServer = http.createServer(app.callback());
 export const wsServer = new WebSocket.Server({ server: httpServer });
 export const captureAllRoutes = {};
 app.proxy = !!system.get('server.xproxy') || !!system.get('server.xff');
-app.proxyIpHeader = system.get('server.xff');
 app.on('error', (error) => {
     if (error.code !== 'EPIPE' && error.code !== 'ECONNRESET' && !error.message.includes('Parse Error')) {
         logger.error('Koa app-level error', { error });
@@ -461,7 +460,22 @@ export async function apply(pluginContext: Context) {
         changeOrigin: true,
         rewrite: (p) => p.replace('/fs', ''),
     });
+    const corsAllowHeaders = 'x-requested-with, accept, origin, content-type, upgrade-insecure-requests';
     app.use(async (ctx, next) => {
+        if (ctx.request.headers.origin) {
+            const host = new URL(ctx.request.headers.origin).host;
+            if (host !== ctx.request.headers.host && `,${system.get('server.cors')},`.includes(`,${host},`)) {
+                ctx.set('Access-Control-Allow-Credentials', 'true');
+                ctx.set('Access-Control-Allow-Origin', ctx.request.headers.origin);
+                ctx.set('Access-Control-Allow-Headers', corsAllowHeaders);
+                ctx.set('Vary', 'Origin');
+                ctx.cors = true;
+            }
+        }
+        if (ctx.request.method.toLowerCase() === 'options') {
+            ctx.body = 'ok';
+            return null;
+        }
         for (const key in captureAllRoutes) {
             if (ctx.path.startsWith(key)) return captureAllRoutes[key](ctx, next);
         }