feat: 规范化请求头 防止某些严格的风控拦截

Author: xream

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sub-store",
-  "version": "2.36.14",
+  "version": "2.36.15",
   "description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",
   "main": "src/main.js",
   "packageManager": "pnpm@11.0.9",

backend/src/test/vendor/open-api.spec.js

@@ -96,23 +96,23 @@ describe('open-api HTTP adapter', function () {
         expect(agentOptions[0].requestTls.allowH2).to.equal(false);
     });
 
-    it('adds a curl-like Accept header by default in Node.js', async function () {
+    it('normalizes Node.js request header names to lowercase', async function () {
         await HTTP({
             headers: {
                 'User-Agent': 'Surge',
             },
         }).get('https://example.com/subscription');
 
         expect(requestOptions.headers).to.include({
-            'User-Agent': 'Surge',
-            Accept: '*/*',
+            'user-agent': 'Surge',
+            accept: '*/*',
         });
     });
 
     it('keeps an explicit Accept header in Node.js', async function () {
         await HTTP({
             headers: {
-                accept: 'application/json',
+                Accept: 'application/json',
             },
         }).get('https://example.com/subscription');
 
@@ -121,6 +121,20 @@ describe('open-api HTTP adapter', function () {
         });
     });
 
+    it('preserves __proto__ headers when normalizing names', async function () {
+        await HTTP({
+            headers: Object.fromEntries([['__proto__', 'sent']]),
+        }).get('https://example.com/subscription');
+
+        expect(
+            Object.prototype.hasOwnProperty.call(
+                requestOptions.headers,
+                '__proto__',
+            ),
+        ).to.equal(true);
+        expect(requestOptions.headers.__proto__).to.equal('sent');
+    });
+
     it('omits Accept when callers set it to null in Node.js', async function () {
         await HTTP({
             headers: {
@@ -130,7 +144,7 @@ describe('open-api HTTP adapter', function () {
         }).get('https://example.com/subscription');
 
         expect(requestOptions.headers).to.deep.equal({
-            'User-Agent': 'Surge',
+            'user-agent': 'Surge',
         });
     });
 });

backend/src/vendor/open-api.js

@@ -44,20 +44,23 @@ function parseSocks5Uri(uri) {
 }
 
 function normalizeNodeRequestHeaders(headers) {
-    const normalized = { ...(headers || {}) };
+    const normalized = [];
     let hasAccept = false;
 
-    for (const key of Object.keys(normalized)) {
-        if (key.toLowerCase() !== 'accept') continue;
-        hasAccept = true;
-        if (normalized[key] == null) delete normalized[key];
+    for (const [key, value] of Object.entries(headers || {})) {
+        const normalizedKey = key.toLowerCase();
+        if (normalizedKey === 'accept') {
+            hasAccept = true;
+            if (value == null) continue;
+        }
+        normalized.push([normalizedKey, value]);
     }
 
     if (!hasAccept) {
-        normalized.Accept = '*/*';
+        normalized.push(['accept', '*/*']);
     }
 
-    return normalized;
+    return Object.fromEntries(normalized);
 }
 
 export class OpenAPI {