Skip to content

Commit 2505c93

Browse files
committed
fix: 收紧规则匹配并补充识别兜底
1 parent 388a2f4 commit 2505c93

16 files changed

Lines changed: 174 additions & 40 deletions

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "stackprism",
33
"private": true,
4-
"version": "1.2.65",
4+
"version": "1.2.66",
55
"type": "module",
66
"description": "StackPrism 用于检测网页前端、后端、CDN、SaaS、广告营销、统计、登录、支付、网站程序和主题模板线索。",
77
"scripts": {

public/rules/headers/header-patterns.json

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,15 @@
5252
},
5353
{
5454
"name": "Django",
55-
"patterns": ["django|csrftoken"],
55+
"patterns": ["(?:^|\\n)(?:x-powered-by|server|x-framework|x-generator):[^\\n]*\\bdjango\\b"],
5656
"evidence": "响应头、Cookie 名称或 URL 包含后端框架线索"
5757
},
58+
{
59+
"name": "Django",
60+
"caseSensitive": true,
61+
"patterns": ["(?:^|\\n)set-cookie:[^\\n]*(?:^|[;,\\s])csrftoken(?:=|[,;\\s]|$)"],
62+
"evidence": "Set-Cookie 包含 Django csrftoken 特征"
63+
},
5864
{
5965
"name": "Flask",
6066
"patterns": ["flask"],
@@ -67,7 +73,11 @@
6773
},
6874
{
6975
"name": "Laravel",
70-
"patterns": ["laravel|laravel_session|xsrf-token"],
76+
"patterns": [
77+
"(?:^|\\n)(?:x-powered-by|x-framework|x-generator):[^\\n]*\\blaravel\\b",
78+
"(?:^|\\n)set-cookie:[^\\n]*(?:^|[;,\\s])laravel_session(?:=|[,;\\s]|$)",
79+
"(?:^|\\n)(?:set-cookie|cookie):[^\\n]*(?:^|[;,\\s])XSRF-TOKEN(?:=|[,;\\s]|$)"
80+
],
7181
"evidence": "响应头、Cookie 名称或 URL 包含后端框架线索"
7282
},
7383
{
@@ -98,7 +108,7 @@
98108
{
99109
"name": "Go",
100110
"patterns": [
101-
"gorilla\\.csrf|go-http-client|golang|(?:^|\\n)(?:server|x-powered-by):.*(?:gin|fiber|echo|beego|hertz|cloudwego|goframe|go\\s*frame|go-kratos|kratos|\\biris\\b|gobuffalo|\\bbuffalo\\b)"
111+
"gorilla\\.csrf|go-http-client|golang|(?:^|\\n)(?:server|x-powered-by):.*(?:\\bgin(?:/\\d+(?:\\.\\d+)*)?\\b|\\bfiber(?:/\\d+(?:\\.\\d+)*)?\\b|\\becho(?:/\\d+(?:\\.\\d+)*)?\\b|\\bbeego\\b|\\bhertz(?:/\\d+(?:\\.\\d+)*)?\\b|cloudwego|goframe|go\\s*frame|go-kratos|\\bkratos\\b|\\biris\\b|gobuffalo|\\bbuffalo\\b)"
102112
],
103113
"evidence": "响应头、Cookie 名称或 URL 包含后端框架线索"
104114
},
@@ -294,9 +304,14 @@
294304
},
295305
{
296306
"name": "Baidu Cloud CDN",
297-
"patterns": ["x-bce-|baidu|bcebos|yunjiasu"],
307+
"patterns": ["bdstatic|baidustatic|bdimg|yunjiasu|x-bce-cdn"],
298308
"evidence": "响应头、Via、Server 或 URL 包含 CDN 厂商特征"
299309
},
310+
{
311+
"name": "Baidu BCE Object Storage / 百度智能云 BOS",
312+
"patterns": ["bcebos\\.com|x-bce-request-id|x-bce-content-crc32"],
313+
"evidence": "响应头、Via、Server 或 URL 包含百度智能云 BOS 特征"
314+
},
300315
{
301316
"name": "Huawei Cloud CDN",
302317
"patterns": ["x-hwcdn-|huaweicloud|hwcdn|cdnhwc"],
@@ -334,7 +349,11 @@
334349
},
335350
{
336351
"name": "UCloud CDN",
337-
"patterns": ["ucloud|ufileos"],
352+
"patterns": [
353+
"ucloud\\.cn|ufileos\\.com|ucloudstack\\.com|ucache\\.io",
354+
"(?:^|\\n)(?:server|via):[^\\n]*\\bucache\\b",
355+
"(?:^|\\n)x-ucloud-"
356+
],
338357
"evidence": "响应头、Via、Server 或 URL 包含 CDN 厂商特征"
339358
},
340359
{
@@ -7978,7 +7997,10 @@
79787997
},
79797998
{
79807999
"name": "Laravel",
7981-
"patterns": ["set-cookie:.*(?:laravel_session|xsrf-token)"],
8000+
"patterns": [
8001+
"set-cookie:.*(?:^|[;,\\s])laravel_session(?:=|[,;\\s]|$)",
8002+
"(?:set-cookie|cookie):.*(?:^|[;,\\s])XSRF-TOKEN(?:=|[,;\\s]|$)"
8003+
],
79828004
"evidence": "Set-Cookie 包含 Laravel 会话特征"
79838005
},
79848006
{
@@ -7998,8 +8020,14 @@
79988020
},
79998021
{
80008022
"name": "Django",
8001-
"patterns": ["set-cookie:.*(?:django|csrftoken)"],
8023+
"patterns": ["set-cookie:.*(?:^|[;,\\s])django(?:=|[,;\\s]|$)"],
80028024
"evidence": "Set-Cookie 包含 Django/csrftoken 特征"
8025+
},
8026+
{
8027+
"name": "Django",
8028+
"caseSensitive": true,
8029+
"patterns": ["set-cookie:.*(?:^|[;,\\s])csrftoken(?:=|[,;\\s]|$)"],
8030+
"evidence": "Set-Cookie 包含 Django csrftoken 特征"
80038031
}
80048032
]
80058033
},

public/rules/headers/languages.json

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,14 @@
2121
"name": "Python",
2222
"patterns": [
2323
"x-powered-by:.*(?:django|flask|fastapi|starlette|sanic)",
24-
"server:.*(?:uvicorn|gunicorn|uwsgi|werkzeug|hypercorn|daphne|waitress|granian)",
25-
"set-cookie:.*csrftoken"
24+
"server:.*(?:uvicorn|gunicorn|uwsgi|werkzeug|hypercorn|daphne|waitress|granian)"
2625
]
2726
},
27+
{
28+
"name": "Python",
29+
"caseSensitive": true,
30+
"patterns": ["set-cookie:.*(?:^|[;,\\s])csrftoken(?:=|[,;\\s]|$)"]
31+
},
2832
{
2933
"name": "Ruby",
3034
"patterns": ["x-powered-by:.*(?:rails|phusion passenger|passenger)", "server:.*(?:puma|unicorn|passenger)", "x-runtime:"]
@@ -82,8 +86,8 @@
8286
{
8387
"name": "Go",
8488
"patterns": [
85-
"x-powered-by:.*(?:gin|fiber|echo|beego|hertz|cloudwego|goframe|go\\s*frame|go-kratos|kratos|\\biris\\b|gobuffalo|\\bbuffalo\\b|\\bgo\\b)",
86-
"server:.*(?:caddy|gin|fiber|echo|beego|hertz|cloudwego|goframe|go\\s*frame|go-kratos|kratos|\\biris\\b|gobuffalo|\\bbuffalo\\b)"
89+
"x-powered-by:.*(?:\\bgin(?:/\\d+(?:\\.\\d+)*)?\\b|\\bfiber(?:/\\d+(?:\\.\\d+)*)?\\b|\\becho(?:/\\d+(?:\\.\\d+)*)?\\b|\\bbeego\\b|\\bhertz(?:/\\d+(?:\\.\\d+)*)?\\b|cloudwego|goframe|go\\s*frame|go-kratos|\\bkratos\\b|\\biris\\b|gobuffalo|\\bbuffalo\\b|\\bgo\\b)",
90+
"server:.*(?:caddy|\\bgin(?:/\\d+(?:\\.\\d+)*)?\\b|\\bfiber(?:/\\d+(?:\\.\\d+)*)?\\b|\\becho(?:/\\d+(?:\\.\\d+)*)?\\b|\\bbeego\\b|\\bhertz(?:/\\d+(?:\\.\\d+)*)?\\b|cloudwego|goframe|go\\s*frame|go-kratos|\\bkratos\\b|\\biris\\b|gobuffalo|\\bbuffalo\\b)"
8791
]
8892
},
8993
{

public/rules/page/analytics-providers.json

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,20 @@
3131
"patterns": ["hm\\.baidu\\.com/hm\\.js", "hm\\.baidu\\.com/hm\\.gif", "hm\\.src", "_hmt", "baidu\\.com/hm"],
3232
"globals": ["_hmt"]
3333
},
34+
{
35+
"category": "探针 / 监控",
36+
"name": "Baidu BadJS / 百度前端错误监控",
37+
"kind": "前端错误监控",
38+
"resourceOnly": true,
39+
"patterns": ["badjs-sdk(?:-min)?(?:\\.min)?\\.js", "staticiot\\.cdn\\.bcebos\\.com/union/badjs-sdk"]
40+
},
41+
{
42+
"category": "探针 / 监控",
43+
"name": "Baidu Spy Client / 百度性能监控",
44+
"kind": "前端性能监控",
45+
"resourceOnly": true,
46+
"patterns": ["(?:^|/)spy-client(?:\\.iife)?(?:\\.min)?\\.js(?:[?#]|$)"]
47+
},
3448
{
3549
"name": "CNZZ / Umeng Analytics",
3650
"kind": "商用 / 国内知名统计",

public/rules/page/bundle-license-libraries.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,16 @@
6060
"url": "https://jquery.com",
6161
"patterns": ["jQuery\\s+v?\\d+\\.\\d+|jquery(?:\\.min)?\\.js|jquery\\.org/license"]
6262
},
63+
{
64+
"name": "clipboard.js",
65+
"url": "https://clipboardjs.com",
66+
"patterns": ["clipboard\\.js|clipboard(?:\\.min)?\\.js|zenorocha/clipboard\\.js"]
67+
},
68+
{
69+
"name": "imagesLoaded",
70+
"url": "https://imagesloaded.desandro.com",
71+
"patterns": ["imagesLoaded|imagesloaded(?:\\.pkgd)?(?:\\.min)?\\.js|desandro/imagesloaded"]
72+
},
6373
{
6474
"name": "Lodash",
6575
"url": "https://lodash.com",

public/rules/page/cdn-providers-page.json

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,11 @@
212212
},
213213
{
214214
"name": "Baidu Cloud CDN",
215-
"patterns": ["bdstatic\\.com|baidustatic\\.com|bdimg\\.com|bcebos\\.com|yunjiasu-cdn\\.net"]
215+
"patterns": ["bdstatic\\.com|baidustatic\\.com|bdimg\\.com|yunjiasu-cdn\\.net"]
216+
},
217+
{
218+
"name": "Baidu BCE Object Storage / 百度智能云 BOS",
219+
"patterns": ["bcebos\\.com"]
216220
},
217221
{
218222
"name": "Huawei Cloud CDN",
@@ -244,7 +248,7 @@
244248
},
245249
{
246250
"name": "UCloud CDN",
247-
"patterns": ["ucloud\\.cn|ufileos\\.com|ucloudstack\\.com"]
251+
"patterns": ["ucloud\\.cn|ufileos\\.com|ucloudstack\\.com|ucache\\.io"]
248252
},
249253
{
250254
"name": "JD Cloud CDN",

public/rules/page/dynamic-technologies.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@
1919
"name": "Vue",
2020
"patterns": ["vue(?:\\.runtime)?(?:\\.global)?(?:\\.prod)?(?:\\.min)?\\.js", "vue-router", "pinia", "data-v-app"]
2121
},
22+
{
23+
"name": "San",
24+
"patterns": ["(?:^|/)san(?:\\.dev)?(?:\\.min)?\\.js(?:[?#]|$)", "#_san_\\d+"]
25+
},
2226
{
2327
"name": "Angular / AngularJS",
2428
"patterns": ["angular(?:\\.min)?\\.js", "@angular", "ng-version", "ng-app"]

public/rules/page/frontend-frameworks.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@
2121
"globals": ["Vue", "__VUE_DEVTOOLS_GLOBAL_HOOK__"],
2222
"selectors": ["[data-v-app]", "#app.__vue__"]
2323
},
24+
{
25+
"name": "San",
26+
"patterns": ["(?:^|/)san(?:\\.dev)?(?:\\.min)?\\.js(?:[?#]|$)", "#_san_\\d+"],
27+
"selectors": ["[id^=\"_san_\"]"]
28+
},
2429
{
2530
"name": "Angular / AngularJS",
2631
"patterns": ["angular(?:\\.min)?\\.js", "@angular"],

public/rules/page/saas-services-page.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3881,6 +3881,16 @@
38813881
"passport\\.baidu\\.com/[^\\s\"'<>]*(?:captcha|vcode)|wappass\\.baidu\\.com/[^\\s\"'<>]*captcha|baidu\\.com/[^\\s\"'<>]*(?:captcha|vcode)"
38823882
]
38833883
},
3884+
{
3885+
"category": "安全与协议",
3886+
"name": "Baidu Risk Control / 百度风控指纹",
3887+
"kind": "反爬 / 设备指纹",
3888+
"resourceOnly": true,
3889+
"patterns": [
3890+
"wappass\\.baidu\\.com/[^\\s\"'<>]*(?:moonshad|mkd|fingerprint)\\.js",
3891+
"passport\\.baidu\\.com/[^\\s\"'<>]*(?:moonshad|mkd|fingerprint)\\.js"
3892+
]
3893+
},
38843894
{
38853895
"name": "GeeTest",
38863896
"patterns": ["static\\.geetest\\.com|api\\.geetest\\.com|get\\.geetest\\.com|geetest\\.com/[^\\s\"'<>]*(?:gt|captcha|static)"]

public/rules/page/third-party-logins.json

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,16 @@
33
"thirdPartyLogins": [
44
{
55
"defaults": {
6-
"kind": "国内社交登录"
6+
"kind": "国内社交登录",
7+
"confidence": ""
78
},
89
"rules": [
910
{
1011
"name": "QQ 登录",
11-
"confidence": "",
1212
"patterns": ["graph\\.qq\\.com/oauth2\\.0/authorize", "connect\\.qq\\.com", "QC\\.Login", "QQ登录", "qqlogin", "qqConnect"]
1313
},
1414
{
1515
"name": "微信登录",
16-
"confidence": "",
1716
"patterns": [
1817
"open\\.weixin\\.qq\\.com/connect/qrconnect",
1918
"snsapi_login",
@@ -164,7 +163,13 @@
164163
},
165164
{
166165
"name": "百度帐号登录",
167-
"patterns": ["openapi\\.baidu\\.com/oauth/2\\.0/authorize", "passport\\.baidu\\.com", "百度登录"]
166+
"patterns": [
167+
"openapi\\.baidu\\.com/oauth/2\\.0/authorize",
168+
"passport\\.baidu\\.com",
169+
"passport\\.baidu\\.com/static/phoenix/scripts/jssdk/all\\.js",
170+
"hercules\\.cdn\\.bcebos\\.com/pass/bundle\\.js",
171+
"百度登录"
172+
]
168173
}
169174
]
170175
},

0 commit comments

Comments
 (0)