You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
80 lines
2.9 KiB
80 lines
2.9 KiB
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
BASE_URL="${BASE_URL:-https://wx.sstbc.com}"
|
|
COURSE_ID="${COURSE_ID:-}"
|
|
TMP_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
|
|
|
request() {
|
|
local name="$1"
|
|
local url="$2"
|
|
local body="$TMP_DIR/$name.json"
|
|
local status
|
|
|
|
status="$(curl -sS --max-time 20 -o "$body" -w '%{http_code}' "$url")"
|
|
printf '%-28s HTTP %s\n' "$name" "$status"
|
|
printf '%s\n' "$body"
|
|
}
|
|
|
|
request course-list "$BASE_URL/api/mobile/course/course?page=1&page_size=1"
|
|
request course-list-page-size-51 "$BASE_URL/api/mobile/course/course?page=1&page_size=51"
|
|
request course-detail-invalid "$BASE_URL/api/mobile/course/course-detail?course_id=not-an-id"
|
|
request course-detail-missing "$BASE_URL/api/mobile/course/course-detail?course_id=2147483647"
|
|
|
|
scan_sensitive_keys() {
|
|
local name="$1"
|
|
local body="$TMP_DIR/$name.json"
|
|
local forbidden
|
|
|
|
forbidden="$(jq -r '.. | objects | keys[]' "$body" | sort -u | rg -i '^(mobile|idcard|id_card|identity_card|remark|admin_id|department_id|teacher_id|deleted_at|password|remember_token)$' || true)"
|
|
if [[ -n "$forbidden" ]]; then
|
|
printf '%s FORBIDDEN_KEYS\n%s\n' "$name" "$forbidden"
|
|
exit 1
|
|
fi
|
|
printf '%s SENSITIVE_SCAN PASS\n' "$name"
|
|
}
|
|
|
|
list_body="$TMP_DIR/course-list.json"
|
|
if jq -e '.data and (.data | type == "array")' "$list_body" >/dev/null; then
|
|
scan_sensitive_keys course-list
|
|
if [[ -z "$COURSE_ID" ]]; then
|
|
COURSE_ID="$(jq -r '.data[0].id // empty' "$list_body")"
|
|
fi
|
|
|
|
if [[ -n "$COURSE_ID" ]]; then
|
|
request course-detail-valid "$BASE_URL/api/mobile/course/course-detail?course_id=$COURSE_ID"
|
|
request course-detail-pc-valid "$BASE_URL/api/mobile/course/course-detail-pc?course_id=$COURSE_ID"
|
|
scan_sensitive_keys course-detail-valid
|
|
scan_sensitive_keys course-detail-pc-valid
|
|
jq -e '.id and .name' "$TMP_DIR/course-detail-valid.json" >/dev/null
|
|
jq -e '.id and .name' "$TMP_DIR/course-detail-pc-valid.json" >/dev/null
|
|
printf 'DETAIL_CORE_FIELDS PASS\n'
|
|
else
|
|
printf 'DETAIL_SCAN SKIP: course list is empty\n'
|
|
fi
|
|
else
|
|
printf 'SENSITIVE_SCAN SKIP: course list did not return a data array\n'
|
|
fi
|
|
|
|
if jq -e '.errcode == 10001' "$TMP_DIR/course-list-page-size-51.json" >/dev/null; then
|
|
printf 'PAGE_SIZE_VALIDATION PASS\n'
|
|
else
|
|
printf 'PAGE_SIZE_VALIDATION FAIL\n'
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$(jq -r 'type' "$TMP_DIR/course-detail-invalid.json")" == "object" ]] && jq -e '.errcode == 10001' "$TMP_DIR/course-detail-invalid.json" >/dev/null; then
|
|
printf 'COURSE_ID_VALIDATION PASS\n'
|
|
else
|
|
printf 'COURSE_ID_VALIDATION FAIL\n'
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$(jq -r 'type' "$TMP_DIR/course-detail-missing.json")" == "object" ]] && jq -e 'has("message") and .message == "课程不存在"' "$TMP_DIR/course-detail-missing.json" >/dev/null; then
|
|
printf 'MISSING_COURSE_VALIDATION PASS\n'
|
|
else
|
|
printf 'MISSING_COURSE_VALIDATION FAIL\n'
|
|
exit 1
|
|
fi
|