feat: 增加后端 CORS allowlist 配置并接入 App 模块参数

- Node 默认允许 `*`（兼容旧行为），可通过环境变量 `SUB_STORE_CORS_ALLOWED_ORIGINS` 配置
- 代理 App 模块默认 `https://sub-store.vercel.app`, 可通过模块参数 `cors` 配置

Author: xream

README.md

@@ -46,6 +46,14 @@ Example:
 sub.store = 127.0.0.1
 ```
 
+### CORS Allowlist
+
+Sub-Store also supports a configurable browser CORS allowlist for the backend API. This does not change the module rewrite domain, but it limits which browser origins can read API responses through CORS.
+
+- Node/server deployments use `SUB_STORE_CORS_ALLOWED_ORIGINS`; the default is `*` for compatibility.
+- Proxy App modules use the `cors` module argument; the default is `https://sub-store.vercel.app`.
+- Multiple origins can be separated by commas. Origins are matched exactly by scheme, host, and port. Set the value to `*` only when you accept the risk of any website reading the local backend through browser CORS.
+
 ## Core functionalities:
 
 1. Conversion among various formats.

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sub-store",
-  "version": "2.23.35",
+  "version": "2.24.0",
   "description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",
   "main": "src/main.js",
   "packageManager": "pnpm@11.0.9",

backend/src/test/config/cors-module-config.spec.js

@@ -0,0 +1,73 @@
+import fs from 'fs';
+import path from 'path';
+
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+
+import { load } from '@/utils/yaml';
+
+const DEFAULT_ORIGIN = 'https://sub-store.vercel.app';
+
+describe('module CORS allowlist config', function () {
+    it('adds the default CORS argument to Surge modules', function () {
+        for (const filename of ['Surge.sgmodule', 'Surge-Beta.sgmodule']) {
+            const content = readConfig(filename);
+
+            expect(content).to.include(`cors:"${DEFAULT_ORIGIN}"`);
+            expect(content).to.include('argument="cors={{{cors}}}"');
+            expect(content.match(/argument="cors=\{\{\{cors\}\}\}"/g)).to.have
+                .length(2);
+        }
+    });
+
+    it('adds the default CORS argument to the Egern module', function () {
+        const config = load(readConfig('Egern.yaml'));
+        const httpRequests = config.scriptings
+            .map((item) => item.http_request)
+            .filter(Boolean);
+
+        expect(config.compat_arguments.cors).to.equal(DEFAULT_ORIGIN);
+        expect(config.compat_arguments_desc).to.include('1️⃣1️⃣ cors');
+        expect(httpRequests).to.have.length(2);
+        for (const script of httpRequests) {
+            expect(script.arguments).to.deep.equal({
+                '_compat.$argument': 'cors={{{cors}}}',
+            });
+        }
+    });
+
+    it('adds the default CORS argument to the Loon module', function () {
+        const content = readConfig('Loon.plugin');
+
+        expect(content).to.include(
+            `cors=input, "${DEFAULT_ORIGIN}", tag=CORS允许来源`,
+        );
+        expect(content.match(/argument="cors=\{cors\}"/g)).to.have.length(2);
+    });
+
+    it('does not set legacy non-parameterized modules to wildcard CORS', function () {
+        for (const filename of [
+            'QX.snippet',
+            'Stash.stoverride',
+            'Surge-Noability.sgmodule',
+            'Surge-ability.sgmodule',
+        ]) {
+            const content = readConfig(filename);
+
+            expect(content).to.not.match(/cors\s*[:=]\s*"?\*/i);
+        }
+    });
+});
+
+function readConfig(filename) {
+    return fs.readFileSync(path.join(findRepoRoot(), 'config', filename), 'utf8');
+}
+
+function findRepoRoot() {
+    for (const dir of [process.cwd(), path.resolve(process.cwd(), '..')]) {
+        if (fs.existsSync(path.join(dir, 'config', 'Surge.sgmodule'))) {
+            return dir;
+        }
+    }
+    throw new Error('Unable to locate repository root');
+}

backend/src/test/utils/cors.spec.js

@@ -0,0 +1,169 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+
+import {
+    getCorsHeaders,
+    isOriginAllowed,
+    NON_NODE_CORS_DEFAULT,
+    NODE_CORS_ALLOWED_ORIGINS_ENV,
+    resolveCorsPolicy,
+} from '@/utils/cors';
+
+describe('CORS allowlist policy', function () {
+    it('defaults Node environments to wildcard origins', function () {
+        const policy = resolveCorsPolicy({ isNode: true });
+
+        expect(policy).to.deep.include({
+            wildcard: true,
+            value: '*',
+            source: 'default:node',
+        });
+        expect(isOriginAllowed(policy, 'https://evil.example')).to.equal(true);
+        expect(getCorsHeaders(policy, 'https://evil.example')).to.deep.equal({
+            'Access-Control-Allow-Origin': '*',
+        });
+    });
+
+    it('reads Node allowlist values from the environment setting', function () {
+        const policy = resolveCorsPolicy({
+            isNode: true,
+            envValue:
+                'https://sub-store.vercel.app, http://127.0.0.1:8888',
+        });
+
+        expect(policy).to.deep.include({
+            wildcard: false,
+            source: `env:${NODE_CORS_ALLOWED_ORIGINS_ENV}`,
+            value: 'https://sub-store.vercel.app,http://127.0.0.1:8888',
+        });
+        expect(
+            isOriginAllowed(policy, 'https://sub-store.vercel.app'),
+        ).to.equal(true);
+        expect(isOriginAllowed(policy, 'http://127.0.0.1:8888')).to.equal(
+            true,
+        );
+        expect(isOriginAllowed(policy, 'https://evil.example')).to.equal(
+            false,
+        );
+    });
+
+    it('defaults non-Node environments to the official frontend origin', function () {
+        const policy = resolveCorsPolicy({ isNode: false });
+
+        expect(policy).to.deep.include({
+            wildcard: false,
+            source: 'default:non-node',
+            value: NON_NODE_CORS_DEFAULT,
+        });
+        expect(isOriginAllowed(policy, NON_NODE_CORS_DEFAULT)).to.equal(true);
+        expect(isOriginAllowed(policy, 'https://evil.example')).to.equal(
+            false,
+        );
+    });
+
+    it('reads non-Node allowlist values from script arguments', function () {
+        const policy = resolveCorsPolicy({
+            isNode: false,
+            argument:
+                'sync_success_notify=true&cors=https%3A%2F%2Fsub-store.vercel.app%2Chttp%3A%2F%2F127.0.0.1%3A8888',
+        });
+
+        expect(policy).to.deep.include({
+            wildcard: false,
+            source: 'argument:cors',
+            value: 'https://sub-store.vercel.app,http://127.0.0.1:8888',
+        });
+    });
+
+    it('tolerates quoted script argument strings', function () {
+        const policy = resolveCorsPolicy({
+            isNode: false,
+            argument:
+                '"cors=https://sub-store.vercel.app,http://127.0.0.1:8888"',
+        });
+
+        expect(policy).to.deep.include({
+            wildcard: false,
+            source: 'argument:cors',
+            value: 'https://sub-store.vercel.app,http://127.0.0.1:8888',
+        });
+    });
+
+    it('supports explicit wildcard from non-Node arguments', function () {
+        const policy = resolveCorsPolicy({
+            isNode: false,
+            argument: 'cors=*',
+        });
+
+        expect(policy).to.deep.include({
+            wildcard: true,
+            source: 'argument:cors',
+            value: '*',
+        });
+        expect(isOriginAllowed(policy, 'https://evil.example')).to.equal(true);
+    });
+
+    it('requires exact browser origins', function () {
+        const policy = resolveCorsPolicy({
+            isNode: false,
+            argument: {
+                cors: 'https://sub-store.vercel.app,http://127.0.0.1:8888',
+            },
+        });
+
+        expect(isOriginAllowed(policy, 'https://sub-store.vercel.app')).to.equal(
+            true,
+        );
+        expect(
+            isOriginAllowed(policy, 'https://evil.example.sub-store.vercel.app'),
+        ).to.equal(false);
+        expect(isOriginAllowed(policy, 'http://sub-store.vercel.app')).to.equal(
+            false,
+        );
+        expect(isOriginAllowed(policy, 'http://127.0.0.1')).to.equal(false);
+    });
+
+    it('does not treat empty configured values as wildcard', function () {
+        const nodePolicy = resolveCorsPolicy({
+            isNode: true,
+            envValue: '   ',
+        });
+        const nonNodePolicy = resolveCorsPolicy({
+            isNode: false,
+            argument: 'cors=,,,',
+        });
+
+        expect(nodePolicy).to.deep.include({
+            wildcard: true,
+            source: 'default:node',
+            value: '*',
+        });
+        expect(nonNodePolicy).to.deep.include({
+            wildcard: false,
+            source: 'default:non-node',
+            value: NON_NODE_CORS_DEFAULT,
+        });
+        expect(isOriginAllowed(nonNodePolicy, NON_NODE_CORS_DEFAULT)).to.equal(
+            true,
+        );
+    });
+
+    it('returns concrete CORS headers for allowed non-wildcard origins', function () {
+        const policy = resolveCorsPolicy({
+            isNode: false,
+            argument: {
+                cors: 'https://sub-store.vercel.app',
+            },
+        });
+
+        expect(
+            getCorsHeaders(policy, 'https://sub-store.vercel.app'),
+        ).to.deep.equal({
+            'Access-Control-Allow-Origin': 'https://sub-store.vercel.app',
+            Vary: 'Origin',
+        });
+        expect(getCorsHeaders(policy, 'https://evil.example')).to.deep.equal(
+            {},
+        );
+    });
+});