Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

支持腾讯内容安全的策略 #738

Merged
merged 1 commit into from
Aug 6, 2024
Merged

支持腾讯内容安全的策略 #738

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/client/utils/i18n/i18n.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -588,6 +588,14 @@ export default {
'Спамни аниқлаш учун Тенсент Слоуд махфий идентификатори. Тенсент Слоуд ва Акисмет бир вақтнинг ўзида ўрнатилганда, фақат Тенсент Слоуд кучга киради. Рўйхатдан ўтиш: https://twikoo.js.org/cms.html',
'Tencent CloudのシークレットID、スパムコメントの検出に使用されます。同時にTencent CloudとAkismetを設定した場合、Tencent Cloudのみが有効になります。登録：https://twikoo.js.org/cms.html'
],
[S.ACI + '_QCLOUD_CMS_BIZTYPE']: [
'腾讯云内容安全 Biztype 名称，用于垃圾评论策略。可以自定义垃圾拦截规则',
'騰訊雲內容安全 Biztype 名稱，用於垃圾評論策略。可以自定義垃圾攔截規則',
'騰訊雲內容安全 Biztype 名稱，用於垃圾評論策略。可以自定義垃圾攔截規則', // 「騰訊雲」是一家網路服務提供商，不改為「騰訊雲端」。
'Tencent Cloud Content Security Biztype name for spam comment policy. Spam blocking rules can be customized',
'Tencent Cloud Content Security Biztype име, използвано за спам политика. Може да персонализира правилата за блокиране на спам',
'Tencent Cloud Content Security Biztype name スパムコメントポリシー。スパムブロックルールはカスタマイズ可能'
],
[S.ACI + '_QCLOUD_SECRET_KEY']: [
'腾讯云 secret key',
'騰訊雲 secret key',
Expand Down
1 change: 1 addition & 0 deletions src/client/view/components/TkAdminConfig.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@ export default {
{ key: 'AKISMET_KEY', desc: t('ADMIN_CONFIG_ITEM_AKISMET_KEY'), ph: `${t('ADMIN_CONFIG_EXAMPLE')}8651783edxxx`, value: '' },
{ key: 'QCLOUD_SECRET_ID', desc: t('ADMIN_CONFIG_ITEM_QCLOUD_SECRET_ID'), ph: `${t('ADMIN_CONFIG_EXAMPLE')}AKIDBgZDdnbTw9D4ey9qPkrkwtb2Do9EwIHw`, value: '' },
{ key: 'QCLOUD_SECRET_KEY', desc: t('ADMIN_CONFIG_ITEM_QCLOUD_SECRET_KEY'), ph: `${t('ADMIN_CONFIG_EXAMPLE')}XrkOnvKWS7WeXbP1QZT76rPgtpWx73D7`, value: '', secret: true },
{ key: 'QCLOUD_CMS_BIZTYPE', desc: t('ADMIN_CONFIG_ITEM_QCLOUD_CMS_BIZTYPE'), ph: `${t('ADMIN_CONFIG_EXAMPLE')}1787728329856520192`, value: '', secret: true },
{ key: 'LIMIT_PER_MINUTE', desc: t('ADMIN_CONFIG_ITEM_LIMIT_PER_MINUTE'), ph: `${t('ADMIN_CONFIG_EXAMPLE')}5`, value: '' },
{ key: 'LIMIT_PER_MINUTE_ALL', desc: t('ADMIN_CONFIG_ITEM_LIMIT_PER_MINUTE_ALL'), ph: `${t('ADMIN_CONFIG_EXAMPLE')}5`, value: '' },
{ key: 'LIMIT_LENGTH', desc: t('ADMIN_CONFIG_ITEM_LIMIT_LENGTH'), ph: `${t('ADMIN_CONFIG_EXAMPLE')}100`, value: '' },
Expand Down
5 changes: 5 additions & 0 deletions src/server/function/twikoo/utils/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,6 +334,11 @@ const fn = {
throw new Error(`参数"${requiredParam}"不合法`)
}
}
},
// 移除表情内容，用于内容安全检测
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

不建议，如此以来攻击者可以通过 <img alt="不当的内容" src="不当的图片" class="tk-owo-emotion"> 来绕过安全检测

removeEmotionImages (content) {
const regex = /<img[^>]*class="tk-owo-emotion"[^>]*>/g
return content.replace(regex, '')
}
}

Expand Down
16 changes: 13 additions & 3 deletions src/server/function/twikoo/utils/spam.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ const {
getCryptoJS,
getTencentcloud
} = require('./lib')
const {
equalsMail,
removeEmotionImages
} = require('.')
const AkismetClient = getAkismetClient()
const CryptoJS = getCryptoJS()

Expand All @@ -29,17 +33,23 @@ const fn = {
if (comment.isSpam) {
// 预检测没过的，就不再检测了
isSpam = true
} else if (equalsMail(config.BLOGGER_EMAIL, comment.mail)) {
// 博主本人评论，不再检测了
isSpam = false
} else if (config.QCLOUD_SECRET_ID && config.QCLOUD_SECRET_KEY) {
// 腾讯云内容安全
const client = new (getTencentCloud().tms.v20200713.Client)({
const client = new (getTencentCloud().tms.v20201229.Client)({
credential: { secretId: config.QCLOUD_SECRET_ID, secretKey: config.QCLOUD_SECRET_KEY },
region: 'ap-shanghai',
profile: { httpProfile: { endpoint: 'tms.tencentcloudapi.com' } }
})
const cleanContent = removeEmotionImages(comment.comment)
const checkResult = await client.TextModeration({
Content: CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(comment.comment)),
Content: CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(cleanContent)),
Device: { IP: comment.ip },
User: { Nickname: comment.nick }
BizType: { BizType: config.QCLOUD_SECRET_ID },
User: { Nickname: comment.nick },
DataId: { DataId: comment.id }
})
logger.log('腾讯云返回结果：', checkResult)
isSpam = checkResult.EvilFlag !== 0
Expand Down
Loading