AlistGo / AlistGo/alist

路曲加密文件夹Cookie编码不足

Đang mở
#8,493 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
Go
Star
50.2k
Fork
7.9k
Merge trung bình
7 ngày 21 giờ
Pull request đã merge (30 ngày)
6

Mô tả

### Please make sure of the following things

- [x] I have read the [documentation](https://alist.nn.ci).
我已经阅读了[文档](https://alist.nn.ci)。

- [x] I'm sure there are no duplicate issues or discussions.
我确定没有重复的issue或讨论。

- [x] I'm sure it's due to `AList` and not something else(such as [Network](https://alist.nn.ci/faq/howto.html#tls-handshake-timeout-read-connection-reset-by-peer-dns-lookup-failed-connect-connection-refused-client-timeout-exceeded-while-awaiting-headers-no-such-host) ,`Dependencies` or `Operational`).
我确定是`AList`的问题,而不是其他原因(例如[网络](https://alist.nn.ci/zh/faq/howto.html#tls-handshake-timeout-read-connection-reset-by-peer-dns-lookup-failed-connect-connection-refused-client-timeout-exceeded-while-awaiting-headers-no-such-host),`依赖`或`操作`)。

- [x] I'm sure this issue is not fixed in the latest version.
我确定这个问题在最新版本中没有被修复。

### AList Version / AList 版本

最新!

### Driver used / 使用的存储驱动

本地存储(但不相关)

### Describe the bug / 问题描述

过程:(使用加密文件夹功能)为我的本地文件夹添加了路由密码,**密码混合了中文**,但我的朋友描述他们无法上传文件,经过排查(例如反向代理和防火墙安全、宝塔的配置文件等)确认这和外部环境不相关
问题:发现是由于文件夹密码明文的被存储Cookie且没有经过编码、所以当密码不为标准的数字字母时,仅支持数字字母的判断程序无法验证身份,故上传报错(甚至于到其他没有密码的文件夹仍会因检查无法上传文件,清除浏览器缓存Cookie即可)
可以:在管理端使用了输入验证和提示来防止用户输入不合法的密码,我在管理端(手机或电脑)键入提交不合法密码时没有收到明显的反馈 | 更好的方法是,若有时间,可添加编码解决密码编码的问题

### Reproduction / 复现链接

https://bugdemo.70868848.xyz
这个演示界面已经配置好并提供了复现环境

### Config / 配置

路由密码为非数字英文时

![Image](https://github.com/user-attachments/assets/28a7e732-56d1-4fe3-8671-fc52ea639e8c)

### Logs / 日志

在上述环境下上传任意文件
XMLHttpRequest.setRequestHeader: Cannot convert argument 2 to ByteString because the character at index 0 has value 30001 which is greater than 255.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.