feat: 评论长度限制 (#341 #342)

Author: imaegoo

docs/.vuepress/theme/layouts/Layout.vue

@@ -13,7 +13,7 @@
 
         <!-- Twikoo -->
         <div id="twikoo"></div>
-        <script src="https://cdn.jsdelivr.net/npm/twikoo@1.5.1/dist/twikoo.all.min.js" ref="twikooJs"></script>
+        <script src="https://cdn.jsdelivr.net/npm/twikoo@1.5.2/dist/twikoo.all.min.js" ref="twikooJs"></script>
       </div>
     </template>
   </ParentLayout>

docs/quick-start.md

@@ -44,7 +44,7 @@ exports.main = require('twikoo-func').main
 8. 创建完成后，点击“twikoo"进入云函数详情页，进入“函数代码”标签，点击“文件 - 新建文件”，输入 `package.json`，回车
 9. 复制以下代码、粘贴到代码框中，点击“保存并安装依赖”
 ``` json
-{ "dependencies": { "twikoo-func": "1.5.1" } }
+{ "dependencies": { "twikoo-func": "1.5.2" } }
 ```
 
 ### 命令行部署
@@ -174,7 +174,7 @@ twikoo:
 
 ``` html
 <div id="tcomment"></div>
-<script src="https://cdn.jsdelivr.net/npm/twikoo@1.5.1/dist/twikoo.all.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/twikoo@1.5.2/dist/twikoo.all.min.js"></script>
 <script>
 twikoo.init({
   envId: '您的环境id', // 腾讯云环境填 envId；Vercel 环境填地址（https://xxx.vercel.app）
@@ -192,7 +192,7 @@ twikoo.init({
 
 请参考爆米兔前端静态资源库 [https://cdn.baomitu.com/twikoo](https://cdn.baomitu.com/twikoo)
 
-引入的 CDN 链接替换为如下即可：`https://lib.baomitu.com/twikoo/1.5.1/twikoo.all.min.js`
+引入的 CDN 链接替换为如下即可：`https://lib.baomitu.com/twikoo/1.5.2/twikoo.all.min.js`
 
 ## 开启管理面板
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "A simple comment system based on Tencent CloudBase (tcb).",
   "keywords": ["twikoojs", "comment", "comment-system", "cloudbase", "vercel"],
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",

src/function/twikoo/index.js

@@ -50,20 +50,24 @@ const RES_CODE = {
   UPLOAD_FAILED: 1040
 }
 const ADMIN_USER_ID = 'admin'
+const MAX_REQUEST_TIMES = parseInt(process.env.TWIKOO_THROTTLE) || 250
 
 // 全局变量 / variables
 // 警告：全局定义的变量，会被云函数缓存，请慎重定义全局变量
 // 参考 https://docs.cloudbase.net/cloud-function/deep-principle.html 中的 “实例复用”
 let config
 let transporter
+const requestTimes = {}
 
 // 云函数入口点 / entry point
 exports.main = async (event, context) => {
+  console.log('请求ＩＰ：', auth.getClientIP())
   console.log('请求方法：', event.event)
   console.log('请求参数：', event)
   let res = {}
-  await readConfig()
   try {
+    protect()
+    await readConfig()
     switch (event.event) {
       case 'GET_FUNC_VERSION':
         res = getFuncVersion()
@@ -1168,6 +1172,12 @@ async function limitFilter () {
 
 // 预垃圾评论检测
 function preCheckSpam (comment) {
+  // 长度限制
+  let limitLength = parseInt(config.LIMIT_LENGTH)
+  if (Number.isNaN(limitLength)) limitLength = 500
+  if (limitLength && comment.length > limitLength) {
+    throw new Error('评论内容过长')
+  }
   if (config.AKISMET_KEY === 'MANUAL_REVIEW') {
     // 人工审核
     console.log('已使用人工审核模式，评论审核后才会发表~')
@@ -1497,7 +1507,8 @@ function getConfig () {
       REQUIRED_FIELDS: config.REQUIRED_FIELDS,
       HIDE_ADMIN_CRYPT: config.HIDE_ADMIN_CRYPT,
       HIGHLIGHT: config.HIGHLIGHT || 'true',
-      HIGHLIGHT_THEME: config.HIGHLIGHT_THEME
+      HIGHLIGHT_THEME: config.HIGHLIGHT_THEME,
+      LIMIT_LENGTH: config.LIMIT_LENGTH
     }
   }
 }
@@ -1534,6 +1545,18 @@ async function setConfig (event) {
   }
 }
 
+function protect () {
+  // 防御
+  const ip = auth.getClientIP()
+  requestTimes[ip] = (requestTimes[ip] || 0) + 1
+  if (requestTimes[ip] > MAX_REQUEST_TIMES) {
+    console.log(`${ip} 当前请求次数为 ${requestTimes[ip]}，已超过最大请求次数`)
+    throw new Error('Too Many Requests')
+  } else {
+    console.log(`${ip} 当前请求次数为 ${requestTimes[ip]}`)
+  }
+}
+
 // 读取配置
 async function readConfig () {
   try {

src/function/twikoo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-func",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "A simple comment system based on Tencent CloudBase (tcb).",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",

src/js/entites/config.js

@@ -24,6 +24,7 @@ class Config {
     this.QCLOUD_SECRET_KEY = model.QCLOUD_SECRET_KEY
     this.LIMIT_PER_MINUTE = model.LIMIT_PER_MINUTE
     this.LIMIT_PER_MINUTE_ALL = model.LIMIT_PER_MINUTE_ALL
+    this.LIMIT_LENGTH = model.LIMIT_LENGTH
     this.FORBIDDEN_WORDS = model.FORBIDDEN_WORDS
     this.NOTIFY_SPAM = model.NOTIFY_SPAM
     this.SC_MAIL_NOTIFY = model.SC_MAIL_NOTIFY

src/js/utils/i18n/i18n.js

@@ -341,13 +341,19 @@ export default {
     '单个 IP 发言频率限制（条/10分钟），0 为无限制，默认：10',
     '單個 IP 發言頻率限制（條/10分鐘），0 為無限制，預設：10',
     '單個 IP 發言頻率限制（條/10分鐘），0 為無限制，預設：10',
-    'How many comments can be posted by each IP every 10 minutes, default: 0 (unlimited).'
+    'How many comments can be posted by each IP every 10 minutes, 0 is unlimited, default: 10.'
   ],
   [S.ACI + '_LIMIT_PER_MINUTE_ALL']: [
     '全站发言频率限制（条/10分钟），0 为无限制，默认：10',
     '全站發言頻率限制（條/10分鐘），0 為無限制，預設：10',
     '全站發言頻率限制（條/10分鐘），0 為無限制，預設：10',
-    'How many comments can be posted by all IPs every 10 minutes, default: 0 (unlimited).'
+    'How many comments can be posted by all IPs every 10 minutes, 0 is unlimited, default: 10.'
+  ],
+  [S.ACI + '_LIMIT_LENGTH']: [
+    '评论长度限制，0 为无限制，默认：500',
+    '評論長度限制，0 為無限制，預設：500',
+    '評論長度限制，0 為無限制，預設：500',
+    'Comment length limitation, 0 is unlimited, default: 500.'
   ],
   [S.ACI + '_MAIL_SUBJECT']: [
     '自定义通知邮件主题，留空则使用默认主题。',

src/vercel-min/package.json

@@ -1 +1 @@
-{ "dependencies": { "twikoo-vercel": "1.5.1" } }
+{ "dependencies": { "twikoo-vercel": "1.5.2" } }

src/vercel/api/index.js

@@ -46,6 +46,7 @@ const RES_CODE = {
   AKISMET_ERROR: 1030,
   UPLOAD_FAILED: 1040
 }
+const MAX_REQUEST_TIMES = parseInt(process.env.TWIKOO_THROTTLE) || 250
 
 // 全局变量 / variables
 let db = null
@@ -54,15 +55,18 @@ let transporter
 let request
 let response
 let accessToken
+const requestTimes = {}
 
 module.exports = async (requestArg, responseArg) => {
   request = requestArg
   response = responseArg
   const event = request.body || {}
+  console.log('请求ＩＰ：', request.headers['x-real-ip'])
   console.log('请求方法：', event.event)
   console.log('请求参数：', event)
   let res = {}
   try {
+    protect()
     anonymousSignIn()
     await connectToDatabase(process.env.MONGODB_URI)
     await readConfig()
@@ -1174,6 +1178,12 @@ async function limitFilter () {
 
 // 预垃圾评论检测
 function preCheckSpam (comment) {
+  // 长度限制
+  let limitLength = parseInt(config.LIMIT_LENGTH)
+  if (Number.isNaN(limitLength)) limitLength = 500
+  if (limitLength && comment.length > limitLength) {
+    throw new Error('评论内容过长')
+  }
   if (config.AKISMET_KEY === 'MANUAL_REVIEW') {
     // 人工审核
     console.log('已使用人工审核模式，评论审核后才会发表~')
@@ -1504,7 +1514,8 @@ async function getConfig () {
       REQUIRED_FIELDS: config.REQUIRED_FIELDS,
       HIDE_ADMIN_CRYPT: config.HIDE_ADMIN_CRYPT,
       HIGHLIGHT: config.HIGHLIGHT || 'true',
-      HIGHLIGHT_THEME: config.HIGHLIGHT_THEME
+      HIGHLIGHT_THEME: config.HIGHLIGHT_THEME,
+      LIMIT_LENGTH: config.LIMIT_LENGTH
     }
   }
 }
@@ -1541,6 +1552,18 @@ async function setConfig (event) {
   }
 }
 
+function protect () {
+  // 防御
+  const ip = request.headers['x-real-ip']
+  requestTimes[ip] = (requestTimes[ip] || 0) + 1
+  if (requestTimes[ip] > MAX_REQUEST_TIMES) {
+    console.log(`${ip} 当前请求次数为 ${requestTimes[ip]}，已超过最大请求次数`)
+    throw new Error('Too Many Requests')
+  } else {
+    console.log(`${ip} 当前请求次数为 ${requestTimes[ip]}`)
+  }
+}
+
 // 读取配置
 async function readConfig () {
   try {

src/vercel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-vercel",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "A simple comment system based on Tencent CloudBase (tcb).",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",