Files
SubsTracker/src/api/debug.js
wangwangit e2fc130f99 fix: XSS 风险修复
- showToast 改用 textContent 设置消息内容,防止 HTML 注入
- createHoverText 对所有用户输入进行 escapeHtml 转义
- 续订/支付历史/编辑支付模态框中的 subscription.name 和
  payment.note 使用 escapeHtml 转义
- debug 页面 adminUsername 转义
- 添加全局 escapeHtml 工具函数
2026-05-19 12:06:21 +08:00

64 lines
2.1 KiB
JavaScript
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import { getConfig } from '../data/config.js';
async function handleDebug(request, env) {
try {
const url = new URL(request.url);
const config = await getConfig(env);
const debugInfo = {
timestamp: new Date().toISOString(),
pathname: url.pathname,
kvBinding: !!env.SUBSCRIPTIONS_KV,
configExists: !!config,
adminUsername: config.ADMIN_USERNAME,
hasJwtSecret: !!config.JWT_SECRET,
jwtSecretLength: config.JWT_SECRET ? config.JWT_SECRET.length : 0
};
return new Response(`
<!DOCTYPE html>
<html>
<head>
<title>调试信息</title>
<style>
body { font-family: monospace; padding: 20px; background: #f5f5f5; }
.info { background: white; padding: 15px; margin: 10px 0; border-radius: 5px; }
.success { color: green; }
.error { color: red; }
</style>
</head>
<body>
<h1>系统调试信息</h1>
<div class="info">
<h3>基本信息</h3>
<p>时间: ${debugInfo.timestamp}</p>
<p>路径: ${debugInfo.pathname}</p>
<p class="${debugInfo.kvBinding ? 'success' : 'error'}">KV绑定: ${debugInfo.kvBinding ? '✓' : '✗'}</p>
</div>
<div class="info">
<h3>配置信息</h3>
<p class="${debugInfo.configExists ? 'success' : 'error'}">配置存在: ${debugInfo.configExists ? '✓' : '✗'}</p>
<p>管理员用户名: ${String(debugInfo.adminUsername || '').replace(/</g, '&lt;').replace(/>/g, '&gt;')}</p>
<p class="${debugInfo.hasJwtSecret ? 'success' : 'error'}">JWT密钥: ${debugInfo.hasJwtSecret ? '✓' : '✗'} (长度: ${debugInfo.jwtSecretLength})</p>
</div>
<div class="info">
<h3>解决方案</h3>
<p>1. 确保KV命名空间已正确绑定为 SUBSCRIPTIONS_KV</p>
<p>2. 尝试访问 <a href="/">/</a> 进行登录</p>
<p>3. 如果仍有问题请检查Cloudflare Workers日志</p>
</div>
</body>
</html>`, {
headers: { 'Content-Type': 'text/html; charset=utf-8' }
});
} catch (error) {
return new Response(`调试页面错误: ${error.message}`, {
status: 500,
headers: { 'Content-Type': 'text/plain; charset=utf-8' }
});
}
}
export { handleDebug };