diff --git a/analytics/src/assets.js b/analytics/src/assets.js index 7f48fb2..47b577c 100644 --- a/analytics/src/assets.js +++ b/analytics/src/assets.js @@ -9,7 +9,10 @@ import crypto from 'node:crypto'; const DEFAULT_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'client', 'dist'); const FILES = { '/a/w.js': 'w.js', '/a/h.js': 'h.js' }; -export function createAssets({ distDir = DEFAULT_DIR, log = console } = {}) { +const RE_KEY = /^[a-z0-9]{16,40}$/; +const EMPTY = Buffer.from('/* WEBklar Analyse: aus */\n'); + +export function createAssets({ distDir = DEFAULT_DIR, log = console, isActive = () => true } = {}) { const assets = new Map(); for (const [path, file] of Object.entries(FILES)) { try { @@ -28,6 +31,25 @@ export function createAssets({ distDir = DEFAULT_DIR, log = console } = {}) { res.end(); return true; } + if (pathname === '/a/w.js') { + let key = ''; + try { key = new URL(req.url, 'http://x').searchParams.get('s') || ''; } catch { /* leer */ } + let on = false; + try { on = RE_KEY.test(key) && !!isActive(key); } catch (e) { log.error('Analytics: isActive:', e.message); } + if (!on) { + res.writeHead(200, { + 'Content-Type': 'text/javascript; charset=utf-8', + 'Cache-Control': 'public, max-age=60', + Vary: 'Accept-Encoding', + 'X-Content-Type-Options': 'nosniff', + 'Cross-Origin-Resource-Policy': 'cross-origin', + 'Access-Control-Allow-Origin': '*', + 'Content-Length': EMPTY.length, + }); + res.end(req.method === 'HEAD' ? undefined : EMPTY); + return true; + } + } const a = assets.get(pathname); if (!a) { res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); diff --git a/analytics/src/server.js b/analytics/src/server.js index db2d0e8..9de94e6 100644 --- a/analytics/src/server.js +++ b/analytics/src/server.js @@ -61,7 +61,7 @@ function validateSite(b) { function createHandlerServer({ config, db, role, geo, salt, now, onSitesChanged }) { const ingest = role === 'public' ? createIngest({ db, geo, salt: salt || createSalt({ now }), now }) : null; const heat = role === 'public' ? createHeat({ db, config, now }) : null; - const assets = role === 'public' ? createAssets({ distDir: config.distDir }) : null; + const assets = role === 'public' ? createAssets({ distDir: config.distDir, isActive: (k) => !!db.prepare('SELECT 1 FROM sites WHERE siteKey = ? AND active = 1').get(k) }) : null; const clock = now || Date.now; const server = http.createServer(async (req, res) => { try { diff --git a/analytics/test/assets.test.js b/analytics/test/assets.test.js index 5627b8d..c97ac78 100644 --- a/analytics/test/assets.test.js +++ b/analytics/test/assets.test.js @@ -11,8 +11,13 @@ import { createPublicServer, createAdminServer } from '../src/server.js'; const DIST = new URL('../client/dist/', import.meta.url); +const KEY = 'abcdef0123456789abcd'; +const OFFKEY = 'offoffoffoffoffoffoff'; async function start(config = {}) { - const server = createPublicServer({ config, db: openDb(':memory:') }); + const db = openDb(':memory:'); + db.prepare('INSERT INTO sites (siteKey, projectId, domains, active) VALUES (?,?,?,1)').run(KEY, 'p', '[]'); + db.prepare('INSERT INTO sites (siteKey, projectId, domains, active) VALUES (?,?,?,0)').run(OFFKEY, 'p', '[]'); + const server = createPublicServer({ config, db }); await new Promise((r) => server.listen(0, '127.0.0.1', r)); return { base: `http://127.0.0.1:${server.address().port}`, close: () => server.close() }; } @@ -35,7 +40,7 @@ for (const file of ['w.js', 'h.js']) { const s = await start(); const want = readFileSync(new URL(file, DIST)); const etag = `"${crypto.createHash('sha256').update(want).digest('hex')}"`; - const id = await raw(s.base, `/a/${file}`, { 'Accept-Encoding': 'identity' }); + const id = await raw(s.base, `/a/${file}${file === 'w.js' ? `?s=${KEY}` : ''}`, { 'Accept-Encoding': 'identity' }); assert.equal(id.status, 200); assert.deepEqual(id.body, want); assert.equal(id.headers['content-type'], 'text/javascript; charset=utf-8'); @@ -46,7 +51,7 @@ for (const file of ['w.js', 'h.js']) { assert.equal(id.headers['cross-origin-resource-policy'], 'cross-origin'); assert.equal(id.headers['access-control-allow-origin'], '*'); assert.equal(id.headers['content-encoding'], undefined); - const gz = await raw(s.base, `/a/${file}`, { 'Accept-Encoding': 'gzip, deflate' }); + const gz = await raw(s.base, `/a/${file}${file === 'w.js' ? `?s=${KEY}` : ''}`, { 'Accept-Encoding': 'gzip, deflate' }); assert.equal(gz.status, 200); assert.equal(gz.headers['content-encoding'], 'gzip'); assert.equal(gz.headers.etag, etag); @@ -58,13 +63,13 @@ for (const file of ['w.js', 'h.js']) { test('ETag: 304 bei If-None-Match, 200 bei anderem Wert', async () => { const s = await start(); - const first = await raw(s.base, '/a/w.js'); - const hit = await raw(s.base, '/a/w.js', { 'If-None-Match': first.headers.etag }); + const first = await raw(s.base, `/a/w.js?s=${KEY}`); + const hit = await raw(s.base, `/a/w.js?s=${KEY}`, { 'If-None-Match': first.headers.etag }); assert.equal(hit.status, 304); assert.equal(hit.body.length, 0); assert.equal(hit.headers.etag, first.headers.etag); assert.equal(hit.headers['cache-control'], 'public, max-age=3600'); - assert.equal((await raw(s.base, '/a/w.js', { 'If-None-Match': '"anders"' })).status, 200); + assert.equal((await raw(s.base, `/a/w.js?s=${KEY}`, { 'If-None-Match': '"anders"' })).status, 200); s.close(); }); @@ -102,3 +107,42 @@ test('fehlende dist-Datei: 503 nur für diesen Pfad, deutscher Fehler im Log', a assert.equal((await fetch(`${s.base}/a/h.js`)).status, 503); s.close(); }); + +const EMPTY = '/* WEBklar Analyse: aus */\n'; +for (const [name, q] of [['unbekannter Schlüssel', '?s=unbekannt0123456789ab'], ['ungültiger Schlüssel', '?s=ABC'], ['ohne s', ''], ['ausgeschaltete Website', `?s=${OFFKEY}`]]) { + test(`w.js ${name}: leeres Skript`, async () => { + const s = await start(); + const r = await raw(s.base, `/a/w.js${q}`, { 'Accept-Encoding': 'gzip' }); + assert.equal(r.status, 200); + assert.equal(r.body.toString(), EMPTY); + assert.equal(r.headers['content-type'], 'text/javascript; charset=utf-8'); + assert.equal(r.headers['cache-control'], 'public, max-age=60'); + assert.equal(r.headers['x-content-type-options'], 'nosniff'); + assert.equal(r.headers['cross-origin-resource-policy'], 'cross-origin'); + assert.equal(r.headers['access-control-allow-origin'], '*'); + assert.equal(r.headers.vary, 'Accept-Encoding'); + assert.equal(r.headers['content-encoding'], undefined); + assert.equal(r.headers.etag, undefined); + s.close(); + }); +} + +test('Ende-zu-Ende: Ausschalten wirkt sofort, Einschalten ebenfalls', async () => { + const db = openDb(':memory:'); + const pub = createPublicServer({ config: {}, db }); + const adm = createAdminServer({ config: { adminToken: 't' }, db }); + await Promise.all([pub, adm].map((x) => new Promise((r) => x.listen(0, '127.0.0.1', r)))); + const pb = `http://127.0.0.1:${pub.address().port}`; + const ab = `http://127.0.0.1:${adm.address().port}`; + const put = (active) => fetch(`${ab}/a/admin/sites/${KEY}`, { method: 'PUT', headers: { Authorization: 'Bearer t', 'Content-Type': 'application/json' }, + body: JSON.stringify({ projectId: 'p', domains: ['abc.project.webklar.com'], active }) }); + const get = async () => (await raw(pb, `/a/w.js?s=${KEY}`)).body.toString(); + assert.equal(await get(), EMPTY); + assert.equal((await put(true)).status, 200); + assert.notEqual(await get(), EMPTY); + assert.equal((await put(false)).status, 200); + assert.equal(await get(), EMPTY); + assert.equal((await put(true)).status, 200); + assert.notEqual(await get(), EMPTY); + pub.close(); adm.close(); +}); diff --git a/runner/src/analytics-inject.js b/runner/src/analytics-inject.js index 7413199..66e2a27 100644 --- a/runner/src/analytics-inject.js +++ b/runner/src/analytics-inject.js @@ -17,7 +17,7 @@ export const isValidBase = (b) => typeof b === 'string' && /^https:\/\/[^\s"'<>] export function scriptTag(analytics, baseUrl) { // Attributwerte nur aus geprüften Eingaben (Regex), daher ohne Maskierung sicher. - return ``; + return ``; } // Spannen, in denen Marker nichts zu suchen haben: Kommentare, script, style, textarea, template (ohne Verschachtelungs-Logik). diff --git a/runner/test/analytics-inject.test.js b/runner/test/analytics-inject.test.js index f982f30..7865d19 100644 --- a/runner/test/analytics-inject.test.js +++ b/runner/test/analytics-inject.test.js @@ -11,7 +11,7 @@ import { createJobs } from '../src/jobs.js'; const BASE = 'https://project.webklar.com/a/'; const KEY = 'abcdef0123456789abcd'; const A = (o = {}) => ({ siteKey: KEY, color: '#2b6cb0', privacy: { company: 'Muster GmbH', address: 'Weg 1, 12345 Ort', email: 'info@muster.de' }, ...o }); -const TAG = ``; +const TAG = ``; const dir = () => mkdtempSync(join(tmpdir(), 'inj-')); const put = (d, f, c) => { mkdirSync(join(d, f, '..'), { recursive: true }); writeFileSync(join(d, f), c); }; const get = (d, f) => readFileSync(join(d, f), 'utf8');