fix: 管理入口改为「填链接」而非绑定特定隧道方案,并修掉配置接口的密钥泄露

用户反馈:「你不需要帮我处理 tunnel 这部分,也许我不是通过 tunnel 开放内网呢?
你只需要给我一个填写开放的管理端链接的地方。」

之前把「Cloudflare Tunnel」当成既定方案写进了配置与文档,这是替用户做了假设。
现在改为:项目只提供一个填地址的地方,怎么暴露完全由使用者决定。

- 删除 edge/cloudflare/tunnel.yml 与全部 tunnel 相关文档
- 新增 settings.adminUrl:管理界面里填一个地址,公开面板页脚出现「管理」按钮
  指向它;留空则完全不显示(默认,避免在公网面板暴露管理面位置)
- 只接受 http/https,javascript: 等协议被服务端拒绝(会被渲染成 <a href>)
- 设置落在 local.monitors.json(私有层),只有自己的面板会出现该按钮
- 面板启动时额外拉 /api/monitors 合并 settings:原先只读静态 monitors.json
  (公开层),导致私有层的设置面板看不到;纯静态部署无该接口时沿用公开配置

顺带修掉一个既存漏洞(与本轮改动无关,是引入私有层叠加机制时埋下的):
/api/monitors 无鉴权却回吐合并后的完整配置,包含私有层的 UptimeRobot API Key ——
只要配了 key,任何访客 curl /api/monitors 就能拿到。现在两侧(Node 与 Worker)
都对对外响应剥离 uptimeRobot.apiKey,保留 enabled 等非敏感字段供面板读取;
探针内部同步仍用完整配置,剥离只作用于 HTTP 出口。

测试:verify-worker 36→40 项(新增 [E] 配置接口密钥泄露 4 条)、
verify-security 20→25 项(新增 [D2] 密钥泄露 5 条)。全项目 8 套 314 项通过。
This commit is contained in:
tamakyi
2026-10-14 15:23:22 +08:00
parent d2aa0a1163
commit f345626840
16 changed files with 480 additions and 379 deletions
+282 -297
View File
@@ -1,8 +1,8 @@
{
"prober": "shiroko-monitor-node/0.12.0",
"prober": "shiroko-monitor-node/0.12.1",
"demo": false,
"generatedAt": "2026-10-14T06:50:04.642Z",
"dataUpdatedAt": "2026-10-14T06:50:02.233Z",
"generatedAt": "2026-10-14T07:22:36.648Z",
"dataUpdatedAt": "2026-10-14T07:22:28.178Z",
"updateIntervalSec": 300,
"dataFilter": "uptimerobot",
"probeScope": "all",
@@ -11,12 +11,12 @@
"up": 5,
"down": 1,
"pending": 0,
"avgLatency": 671,
"avgLatency": 805,
"avgUptime90": 83.3,
"memory": {
"rssMB": 82.8,
"heapUsedMB": 12.5,
"heapTotalMB": 16
"rssMB": 75.5,
"heapUsedMB": 13.7,
"heapTotalMB": 14.7
}
},
"sources": {
@@ -24,10 +24,10 @@
"enabled": true,
"ok": true,
"error": null,
"lastSyncAt": "2026-10-14T06:46:25.561Z",
"lastSyncAt": "2026-10-14T07:20:45.501Z",
"count": 6,
"syncing": false,
"lastSyncMs": 1791960384004
"lastSyncMs": 1791962444262
}
},
"notify": {
@@ -55,16 +55,11 @@
"monitors": {
"ur-792059439": {
"status": "up",
"latency": 262,
"latency": 433,
"code": null,
"detail": "UptimeRobot:运行正常",
"lastCheck": "2026-10-14T06:40:00.000Z",
"lastCheck": "2026-10-14T07:15:00.000Z",
"history": [
{
"t": "2026-10-13T07:55:00.000Z",
"ok": true,
"ms": 227
},
{
"t": "2026-10-13T08:35:00.000Z",
"ok": true,
@@ -226,23 +221,23 @@
"ms": 311
},
{
"t": "2026-10-14T06:04:00.000Z",
"t": "2026-10-14T06:34:00.000Z",
"ok": true,
"ms": 357
"ms": 177
},
{
"t": "2026-10-14T06:40:00.000Z",
"t": "2026-10-14T07:15:00.000Z",
"ok": true,
"ms": 262
"ms": 433
}
],
"daily": {
"2026-10-14": {
"total": 26,
"up": 26,
"latSum": 7486,
"latCount": 26,
"latMax": 454
"total": 4,
"up": 4,
"latSum": 1744,
"latCount": 4,
"latMax": 439
}
},
"meta": {
@@ -267,211 +262,211 @@
"90": 0
},
"lat": {
"avg": 288,
"max": 454,
"avg": 436,
"max": 439,
"days": [
{
"key": "2026-10-14",
"avg": 288
"avg": 436
}
]
}
},
"ur-795497022": {
"status": "up",
"latency": 714,
"latency": 672,
"code": null,
"detail": "UptimeRobot:运行正常",
"lastCheck": "2026-10-14T06:46:00.000Z",
"lastCheck": "2026-10-14T07:18:00.000Z",
"history": [
{
"t": "2026-10-13T07:35:00.000Z",
"t": "2026-10-13T08:00:00.000Z",
"ok": true,
"ms": 696
"ms": 758
},
{
"t": "2026-10-13T08:15:00.000Z",
"t": "2026-10-13T08:40:00.000Z",
"ok": true,
"ms": 718
"ms": 826
},
{
"t": "2026-10-13T08:55:00.000Z",
"ok": true,
"ms": 939
},
{
"t": "2026-10-13T09:35:00.000Z",
"ok": true,
"ms": 663
},
{
"t": "2026-10-13T10:15:00.000Z",
"ok": true,
"ms": 837
},
{
"t": "2026-10-13T10:55:00.000Z",
"ok": true,
"ms": 723
},
{
"t": "2026-10-13T11:35:00.000Z",
"ok": true,
"ms": 688
},
{
"t": "2026-10-13T12:15:00.000Z",
"ok": true,
"ms": 824
},
{
"t": "2026-10-13T12:55:00.000Z",
"ok": true,
"ms": 799
},
{
"t": "2026-10-13T13:35:00.000Z",
"ok": true,
"ms": 943
},
{
"t": "2026-10-13T14:20:00.000Z",
"ok": true,
"ms": 808
},
{
"t": "2026-10-13T15:00:00.000Z",
"ok": true,
"ms": 842
},
{
"t": "2026-10-13T15:40:00.000Z",
"ok": true,
"ms": 918
},
{
"t": "2026-10-13T16:20:00.000Z",
"ok": true,
"ms": 646
},
{
"t": "2026-10-13T17:00:00.000Z",
"ok": true,
"ms": 722
},
{
"t": "2026-10-13T17:40:00.000Z",
"t": "2026-10-13T09:20:00.000Z",
"ok": true,
"ms": 749
},
{
"t": "2026-10-13T18:20:00.000Z",
"t": "2026-10-13T10:00:00.000Z",
"ok": true,
"ms": 750
"ms": 791
},
{
"t": "2026-10-13T19:00:00.000Z",
"t": "2026-10-13T10:40:00.000Z",
"ok": true,
"ms": 920
"ms": 678
},
{
"t": "2026-10-13T19:40:00.000Z",
"ok": true,
"ms": 715
},
{
"t": "2026-10-13T20:20:00.000Z",
"ok": true,
"ms": 835
},
{
"t": "2026-10-13T21:00:00.000Z",
"ok": true,
"ms": 1038
},
{
"t": "2026-10-13T21:40:00.000Z",
"ok": true,
"ms": 1235
},
{
"t": "2026-10-13T22:20:00.000Z",
"ok": true,
"ms": 731
},
{
"t": "2026-10-13T23:00:00.000Z",
"ok": true,
"ms": 685
},
{
"t": "2026-10-13T23:40:00.000Z",
"ok": true,
"ms": 597
},
{
"t": "2026-10-14T00:20:00.000Z",
"ok": true,
"ms": 676
},
{
"t": "2026-10-14T01:00:00.000Z",
"ok": true,
"ms": 755
},
{
"t": "2026-10-14T01:40:00.000Z",
"ok": true,
"ms": 658
},
{
"t": "2026-10-14T02:20:00.000Z",
"t": "2026-10-13T11:20:00.000Z",
"ok": true,
"ms": 740
},
{
"t": "2026-10-14T03:00:00.000Z",
"t": "2026-10-13T12:00:00.000Z",
"ok": true,
"ms": 718
"ms": 828
},
{
"t": "2026-10-14T03:40:00.000Z",
"t": "2026-10-13T12:40:00.000Z",
"ok": true,
"ms": 593
"ms": 722
},
{
"t": "2026-10-14T04:20:00.000Z",
"t": "2026-10-13T13:20:00.000Z",
"ok": true,
"ms": 627
"ms": 849
},
{
"t": "2026-10-14T05:00:00.000Z",
"t": "2026-10-13T14:00:00.000Z",
"ok": true,
"ms": 674
"ms": 1071
},
{
"t": "2026-10-14T05:41:00.000Z",
"t": "2026-10-13T14:40:00.000Z",
"ok": true,
"ms": 863
},
{
"t": "2026-10-13T15:20:00.000Z",
"ok": true,
"ms": 893
},
{
"t": "2026-10-13T16:00:00.000Z",
"ok": true,
"ms": 742
},
{
"t": "2026-10-13T16:40:00.000Z",
"ok": true,
"ms": 769
},
{
"t": "2026-10-13T17:20:00.000Z",
"ok": true,
"ms": 769
},
{
"t": "2026-10-13T18:00:00.000Z",
"ok": true,
"ms": 738
},
{
"t": "2026-10-13T18:40:00.000Z",
"ok": true,
"ms": 888
},
{
"t": "2026-10-13T19:20:00.000Z",
"ok": true,
"ms": 810
},
{
"t": "2026-10-13T20:00:00.000Z",
"ok": true,
"ms": 754
},
{
"t": "2026-10-13T20:40:00.000Z",
"ok": true,
"ms": 1721
},
{
"t": "2026-10-13T21:20:00.000Z",
"ok": true,
"ms": 749
},
{
"t": "2026-10-13T22:00:00.000Z",
"ok": true,
"ms": 1288
},
{
"t": "2026-10-13T22:40:00.000Z",
"ok": true,
"ms": 694
},
{
"t": "2026-10-13T23:20:00.000Z",
"ok": true,
"ms": 728
},
{
"t": "2026-10-14T06:13:00.000Z",
"t": "2026-10-14T00:00:00.000Z",
"ok": true,
"ms": 732
"ms": 611
},
{
"t": "2026-10-14T06:46:00.000Z",
"t": "2026-10-14T00:40:00.000Z",
"ok": true,
"ms": 714
"ms": 752
},
{
"t": "2026-10-14T01:20:00.000Z",
"ok": true,
"ms": 734
},
{
"t": "2026-10-14T02:00:00.000Z",
"ok": true,
"ms": 635
},
{
"t": "2026-10-14T02:40:00.000Z",
"ok": true,
"ms": 781
},
{
"t": "2026-10-14T03:20:00.000Z",
"ok": true,
"ms": 710
},
{
"t": "2026-10-14T04:00:00.000Z",
"ok": true,
"ms": 645
},
{
"t": "2026-10-14T04:40:00.000Z",
"ok": true,
"ms": 668
},
{
"t": "2026-10-14T05:20:00.000Z",
"ok": true,
"ms": 683
},
{
"t": "2026-10-14T06:13:00.000Z",
"ok": true,
"ms": 711
},
{
"t": "2026-10-14T06:45:00.000Z",
"ok": true,
"ms": 692
},
{
"t": "2026-10-14T07:18:00.000Z",
"ok": true,
"ms": 672
}
],
"daily": {
"2026-10-14": {
"total": 26,
"up": 26,
"latSum": 18278,
"latCount": 26,
"latMax": 778
"total": 4,
"up": 4,
"latSum": 2889,
"latCount": 4,
"latMax": 751
}
},
"meta": {
@@ -496,206 +491,201 @@
"90": 5432
},
"lat": {
"avg": 703,
"max": 778,
"avg": 722,
"max": 751,
"days": [
{
"key": "2026-10-14",
"avg": 703
"avg": 722
}
]
}
},
"ur-795556828": {
"status": "up",
"latency": 252,
"latency": 435,
"code": null,
"detail": "UptimeRobot:运行正常",
"lastCheck": "2026-10-14T06:40:00.000Z",
"lastCheck": "2026-10-14T07:15:00.000Z",
"history": [
{
"t": "2026-10-13T07:50:00.000Z",
"t": "2026-10-13T08:35:00.000Z",
"ok": true,
"ms": 512
"ms": 224
},
{
"t": "2026-10-13T08:30:00.000Z",
"t": "2026-10-13T09:15:00.000Z",
"ok": true,
"ms": 216
"ms": 247
},
{
"t": "2026-10-13T09:10:00.000Z",
"ok": true,
"ms": 256
},
{
"t": "2026-10-13T09:55:00.000Z",
"t": "2026-10-13T10:00:00.000Z",
"ok": true,
"ms": 455
},
{
"t": "2026-10-13T10:35:00.000Z",
"t": "2026-10-13T10:40:00.000Z",
"ok": true,
"ms": 372
"ms": 384
},
{
"t": "2026-10-13T11:15:00.000Z",
"t": "2026-10-13T11:20:00.000Z",
"ok": true,
"ms": 240
"ms": 334
},
{
"t": "2026-10-13T11:55:00.000Z",
"t": "2026-10-13T12:00:00.000Z",
"ok": true,
"ms": 261
"ms": 234
},
{
"t": "2026-10-13T12:35:00.000Z",
"t": "2026-10-13T12:40:00.000Z",
"ok": true,
"ms": 335
},
{
"t": "2026-10-13T13:15:00.000Z",
"t": "2026-10-13T13:20:00.000Z",
"ok": true,
"ms": 413
"ms": 379
},
{
"t": "2026-10-13T13:55:00.000Z",
"t": "2026-10-13T14:00:00.000Z",
"ok": true,
"ms": 283
"ms": 304
},
{
"t": "2026-10-13T14:35:00.000Z",
"t": "2026-10-13T14:40:00.000Z",
"ok": true,
"ms": 309
"ms": 341
},
{
"t": "2026-10-13T15:20:00.000Z",
"t": "2026-10-13T15:25:00.000Z",
"ok": true,
"ms": 451
"ms": 417
},
{
"t": "2026-10-13T16:00:00.000Z",
"t": "2026-10-13T16:05:00.000Z",
"ok": true,
"ms": 248
"ms": 241
},
{
"t": "2026-10-13T16:40:00.000Z",
"t": "2026-10-13T16:45:00.000Z",
"ok": true,
"ms": 366
},
{
"t": "2026-10-13T17:25:00.000Z",
"ok": true,
"ms": 244
},
{
"t": "2026-10-13T18:05:00.000Z",
"ok": true,
"ms": 378
},
{
"t": "2026-10-13T17:20:00.000Z",
"t": "2026-10-13T18:45:00.000Z",
"ok": true,
"ms": 293
"ms": 310
},
{
"t": "2026-10-13T18:00:00.000Z",
"t": "2026-10-13T19:25:00.000Z",
"ok": true,
"ms": 495
"ms": 335
},
{
"t": "2026-10-13T18:40:00.000Z",
"t": "2026-10-13T20:05:00.000Z",
"ok": true,
"ms": 391
"ms": 351
},
{
"t": "2026-10-13T19:20:00.000Z",
"t": "2026-10-13T20:45:00.000Z",
"ok": true,
"ms": 338
"ms": 523
},
{
"t": "2026-10-13T20:00:00.000Z",
"t": "2026-10-13T21:25:00.000Z",
"ok": true,
"ms": 363
"ms": 400
},
{
"t": "2026-10-13T20:40:00.000Z",
"t": "2026-10-13T22:05:00.000Z",
"ok": true,
"ms": 499
"ms": 222
},
{
"t": "2026-10-13T21:20:00.000Z",
"t": "2026-10-13T22:45:00.000Z",
"ok": true,
"ms": 372
"ms": 169
},
{
"t": "2026-10-13T22:00:00.000Z",
"ok": true,
"ms": 194
},
{
"t": "2026-10-13T22:40:00.000Z",
"t": "2026-10-13T23:25:00.000Z",
"ok": true,
"ms": 225
},
{
"t": "2026-10-13T23:20:00.000Z",
"t": "2026-10-14T00:05:00.000Z",
"ok": true,
"ms": 237
"ms": 209
},
{
"t": "2026-10-14T00:00:00.000Z",
"t": "2026-10-14T00:45:00.000Z",
"ok": true,
"ms": 215
"ms": 272
},
{
"t": "2026-10-14T00:40:00.000Z",
"t": "2026-10-14T01:25:00.000Z",
"ok": true,
"ms": 298
"ms": 431
},
{
"t": "2026-10-14T01:20:00.000Z",
"t": "2026-10-14T02:05:00.000Z",
"ok": true,
"ms": 450
"ms": 241
},
{
"t": "2026-10-14T02:00:00.000Z",
"t": "2026-10-14T02:45:00.000Z",
"ok": true,
"ms": 319
"ms": 444
},
{
"t": "2026-10-14T02:40:00.000Z",
"t": "2026-10-14T03:25:00.000Z",
"ok": true,
"ms": 398
"ms": 359
},
{
"t": "2026-10-14T03:20:00.000Z",
"t": "2026-10-14T04:05:00.000Z",
"ok": true,
"ms": 347
"ms": 400
},
{
"t": "2026-10-14T04:00:00.000Z",
"t": "2026-10-14T04:45:00.000Z",
"ok": true,
"ms": 407
"ms": 214
},
{
"t": "2026-10-14T04:40:00.000Z",
"t": "2026-10-14T05:25:00.000Z",
"ok": true,
"ms": 344
"ms": 404
},
{
"t": "2026-10-14T05:20:00.000Z",
"t": "2026-10-14T06:35:00.000Z",
"ok": true,
"ms": 337
"ms": 278
},
{
"t": "2026-10-14T06:04:00.000Z",
"t": "2026-10-14T07:15:00.000Z",
"ok": true,
"ms": 365
},
{
"t": "2026-10-14T06:40:00.000Z",
"ok": true,
"ms": 252
"ms": 435
}
],
"daily": {
"2026-10-14": {
"total": 26,
"up": 26,
"latSum": 8635,
"latCount": 26,
"latMax": 638
"total": 4,
"up": 4,
"latSum": 1749,
"latCount": 4,
"latMax": 438
}
},
"meta": {
@@ -720,28 +710,23 @@
"90": 0
},
"lat": {
"avg": 332,
"max": 638,
"avg": 437,
"max": 438,
"days": [
{
"key": "2026-10-14",
"avg": 332
"avg": 437
}
]
}
},
"ur-792059414": {
"status": "up",
"latency": 1494,
"latency": 2007,
"code": null,
"detail": "UptimeRobot:运行正常",
"lastCheck": "2026-10-14T06:42:00.000Z",
"lastCheck": "2026-10-14T07:16:00.000Z",
"history": [
{
"t": "2026-10-13T07:40:00.000Z",
"ok": true,
"ms": 1715
},
{
"t": "2026-10-13T08:25:00.000Z",
"ok": true,
@@ -888,28 +873,28 @@
"ms": 1955
},
{
"t": "2026-10-14T05:20:00.000Z",
"t": "2026-10-14T05:25:00.000Z",
"ok": true,
"ms": 3605
"ms": 3612
},
{
"t": "2026-10-14T06:03:00.000Z",
"t": "2026-10-14T06:36:00.000Z",
"ok": true,
"ms": 2050
"ms": 1548
},
{
"t": "2026-10-14T06:42:00.000Z",
"t": "2026-10-14T07:16:00.000Z",
"ok": true,
"ms": 1494
"ms": 2007
}
],
"daily": {
"2026-10-14": {
"total": 26,
"up": 26,
"latSum": 61398,
"latCount": 26,
"latMax": 4043
"total": 4,
"up": 4,
"latSum": 7923,
"latCount": 4,
"latMax": 2007
}
},
"meta": {
@@ -934,22 +919,22 @@
"90": 7593
},
"lat": {
"avg": 2361,
"max": 4043,
"avg": 1981,
"max": 2007,
"days": [
{
"key": "2026-10-14",
"avg": 2361
"avg": 1981
}
]
}
},
"ur-798788113": {
"status": "up",
"latency": 635,
"latency": 480,
"code": null,
"detail": "UptimeRobot:运行正常",
"lastCheck": "2026-10-14T06:46:00.000Z",
"lastCheck": "2026-10-14T07:16:00.000Z",
"history": [
{
"t": "2026-10-13T08:00:00.000Z",
@@ -1117,23 +1102,23 @@
"ms": 347
},
{
"t": "2026-10-14T06:10:00.000Z",
"t": "2026-10-14T06:36:00.000Z",
"ok": true,
"ms": 361
"ms": 484
},
{
"t": "2026-10-14T06:46:00.000Z",
"t": "2026-10-14T07:16:00.000Z",
"ok": true,
"ms": 635
"ms": 480
}
],
"daily": {
"2026-10-14": {
"total": 26,
"up": 26,
"latSum": 11895,
"latCount": 26,
"latMax": 675
"total": 4,
"up": 4,
"latSum": 1875,
"latCount": 4,
"latMax": 480
}
},
"meta": {
@@ -1158,12 +1143,12 @@
"90": 0
},
"lat": {
"avg": 458,
"max": 675,
"avg": 469,
"max": 480,
"days": [
{
"key": "2026-10-14",
"avg": 458
"avg": 469
}
]
}
@@ -1183,7 +1168,7 @@
],
"daily": {
"2026-10-14": {
"total": 26,
"total": 4,
"up": 0
}
},