修复了一个由版本更新日志显示导致的潜在远程代码执行攻击漏洞

2021-01-27 19:20:29 +08:00
parent d6d6fae2ca
commit 269b14394d
4 changed files with 35 additions and 14 deletions
@@ -19,16 +19,31 @@ export default {
  },
  getVersionInfo2(state, retryNum = 0) {
    return new Promise((resolve, reject) => {
-      httpGet('https://cdn.stsky.cn/lx-music/desktop/version.json', {
+      httpGet('https://gitee.com/lyswhut/lx-music-desktop-versions/raw/master/version.json', {
        timeout: 20000,
      }, (err, resp, body) => {
+        if (!err && !body.version) err = new Error(JSON.stringify(body))
        if (err) {
          return ++retryNum > 3
-            ? reject(err)
+            ? this.dispatch('getVersionInfo3').then(resolve).catch(reject)
            : this.dispatch('getVersionInfo2', retryNum).then(resolve).catch(reject)
        }
        resolve(body)
      })
    })
  },
+  getVersionInfo3(state, retryNum = 0) {
+    return new Promise((resolve, reject) => {
+      httpGet('https://cdn.stsky.cn/lx-music/desktop/version.json', {
+        timeout: 20000,
+      }, (err, resp, body) => {
+        if (err) {
+          return ++retryNum > 3
+            ? reject(err)
+            : this.dispatch('getVersionInfo3', retryNum).then(resolve).catch(reject)
+        }
+        resolve(body)
+      })
+    })
+  },
 }