Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

这两天发现gittalk,gitment 这 些第三方app存在很大的风险,就适配了一个安全隐患小一点的utterances #583

Open
wants to merge 5 commits into
base: develop
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 34 additions & 13 deletions _config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -268,20 +268,12 @@ myGallery:
# 设置在归档页面中是否显示'文章日历'控件
postCalendar: true

# 不建议使用gittalk,gitment这样权限过高的oauth app,因为它们能够 读写 授权者 所有的公共仓库 ,也就是说拿到你的授权 Token 的人,可以将你的 GitHub 公共仓库删空(这是github权限分的不够细的锅),如果恶意攻击者想获取使用者的 AccessToken,只需要在代码中加上一个 ajax 请求即可。原贴地址:https://www.v2ex.com/t/535608。建议大家看完。(我没有在用gittalk/gitment的网站上评论过,但根据v2ex网友的提示,如果网站自行修改了 gitalk.js 脚本 或者反代了 github api,就很容易拿到你的 Token
# (以下注释内容均为txmu编写)不建议使用gittalk,gitment这样权限过高的oauth app,因为它们能够读写授权者(评论者,如果博主回复过评论,那么博主也算) 所有的公共仓库 ,也就是说拿到你的授权 Token 的人,可以将你的 GitHub 公共仓库删空(这是github权限分的不够细的锅),如果恶意攻击者想获取使用者的 AccessToken,只需要在https://github.com/gitalk/gitalk/blob/master/src/gitalk.jsx#L156的代码中加上一个 ajax 请求即可。(我没有在用gittalk/gitment的网站上评论过,但如果网站自行修改了 gitalk.js 脚本 或者反代了 github api,就很容易拿到你的 Token,所以我专门把utterances适配了一下,本地博客实测正常。utterances教程:https://blog.njilc.com/post/self-hosted-utterances-tutorial

# https://github.com/utterance/utterances 是个 GitHub App,它的权限仅限于某个仓库。像 hugo hexo 这种静态页面类型的博客,clientID/clientSecret 泄露是不可避免的。我认为较好的解决方式是像 utteras 这种 GitHubApp,只有一个仓库的读写权限,将破坏降到最小。

# valine和minivaline都是使用的免费的leancloud开发版资源,即使数据丢了leancloud也不用负任何的责任。此外valine的src目录已在1.4.0后停止更新。。。薛定谔的开源。

# 当初多说国内最大都倒了,livere不一定靠谱。

# disqus被墙了。

# 畅言需要备案。
# 我(txmu)用过的部分评论系统速度排序:minivaline(最快)=utterances(最快)>Disqus(墙外)>livere>畅言

# the Gitalk config,default disabled
# Gitalk 评论模块的配置,默认为不激活
# Gitalk 评论模块的配置,默认为不激活。目前不建议使用。
gitalk:
enable: false
owner:
Expand All @@ -292,7 +284,7 @@ gitalk:
admin:

# the Gitment config,default disabled
# Gitment 评论模块的配置,默认为不激活
# Gitment 评论模块的配置,默认为不激活。目前不建议使用。
gitment:
enable: false
owner:
Expand All @@ -302,7 +294,7 @@ gitment:
clientSecret:

# disqus config, default disabled
# Disqus评论模块的配置,默认为不激活
# Disqus评论模块的配置,默认为不激活。被墙。可以看看DisqusJS。
disqus:
enable: false
shortname:
Expand Down Expand Up @@ -376,6 +368,35 @@ changyan:
enable: false
appId:
conf:

utterances:
enable: true
repo: txmu/utterances
theme: github-light
crossorigin: anonymous

# DisqusJS
# Alternative Disqus - Render comment component using Disqus API.
# Demo: https://suka.js.org/DisqusJS/
# For more information: https://github.com/SukkaW/DisqusJS
disqusjs:
enable: false
# API Endpoint of Disqus API (https://disqus.com/api/).
# Leave api empty if you are able to connect to Disqus API. Otherwise you need a reverse proxy for it.
# For example:
# api: https://disqus.skk.moe/disqus/
api:
apikey: # Register new application from https://disqus.com/api/applications/
shortname: # See: https://disqus.com/admin/settings/general/

# Vssue
# 教程:https://vssue.js.org/zh/,以下配置项必须按照官网的格式填写。有问题第一时间别直接发issue,而是先去自己解决。
vssue:
enable: false # 由于vssue本身的问题,所有页面所有的评论都可能会关联到以这个title为题目的issue,导致评论混乱。这个问题我(txmu)已经发过issue了,还没有收到回复。因此用不用这个见仁见智。
owner:
repo:
clientid:

# Whether to display fork me on github icon and link, default true, You can change it to your repo address
# 配置是否在 header 中显示 fork me on github 的图标,默认为true,你可以修改为你的仓库地址.
githubLink:
Expand Down
100 changes: 56 additions & 44 deletions layout/contact.ejs
Original file line number Diff line number Diff line change
@@ -1,44 +1,56 @@
<%- partial('_partial/bg-cover') %>

<main class="content">
<div id="contact" class="container chip-container">
<div class="card">
<div class="card-content">
<div class="tag-title center-align">
<i class="fas fa-comments"></i>&nbsp;&nbsp;<%= __('contact') %>
</div>
<%- page.content %>
</div>
</div>
<div class="card">
<% if (theme.gitalk && theme.gitalk.enable) { %>
<%- partial('_partial/gitalk') %>
<% } %>

<% if (theme.gitment.enable) { %>
<%- partial('_partial/gitment') %>
<% } %>

<% if (theme.disqus.enable) { %>
<%- partial('_partial/disqus') %>
<% } %>

<% if (theme.livere && theme.livere.enable) { %>
<%- partial('_partial/livere') %>
<% } %>

<% if (theme.valine && theme.valine.enable) { %>
<%- partial('_partial/valine') %>
<% } %>

<% if (theme.minivaline && theme.minivaline.enable) { %>
<%- partial('_partial/minivaline') %>
<% } %>

<% if (theme.changyan && theme.changyan.enable) { %>
<%- partial('_partial/changyan') %>
<% } %>

</div>
</div>
</main>
<%- partial('_partial/bg-cover') %>

<main class="content">
<div id="contact" class="container chip-container">
<div class="card">
<div class="card-content">
<div class="tag-title center-align">
<i class="fas fa-comments"></i>&nbsp;&nbsp;<%= __('contact') %>
</div>
<%- page.content %>
</div>
</div>
<div class="card">
<% if (theme.gitalk && theme.gitalk.enable) { %>
<%- partial('_partial/gitalk') %>
<% } %>

<% if (theme.gitment.enable) { %>
<%- partial('_partial/gitment') %>
<% } %>

<% if (theme.disqus.enable) { %>
<%- partial('_partial/disqus') %>
<% } %>

<% if (theme.livere && theme.livere.enable) { %>
<%- partial('_partial/livere') %>
<% } %>

<% if (theme.valine && theme.valine.enable) { %>
<%- partial('_partial/valine') %>
<% } %>

<% if (theme.minivaline && theme.minivaline.enable) { %>
<%- partial('_partial/minivaline') %>
<% } %>

<% if (theme.changyan && theme.changyan.enable) { %>
<%- partial('_partial/changyan') %>
<% } %>

<% if (theme.utterances && theme.utterances.enable) { %>
<%- partial('_partial/utterances.ejs') %>
<% } %>

<% if (theme.vssue && theme.vssue.enable) { %>
<%- partial('_partial/vssue.ejs') %>
<% } %>

<% if (theme.disqusjs && theme.disqusjs.enable) { %>
<%- partial('_partial/disqusjs/disqusjs.js') %>
<% } %>
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@txmu 我没看到你有提交 vssue.ejsdisqusjs.ejs, utterances.ejs 几个文件。

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

啊这,我看看


</div>
</div>
</main>