
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
@tswjs/open-platform-plugin
Advanced tools
yarn add @tswjs/open-platform-plugin
在项目的 TSW 配置文件中,进行如下引用:
const OpenPlatformPlugin = require("@tswjs/open-platform-plugin");
module.exports = {
plugins: [
new OpenPlatformPlugin({
envPath: 'platform.env'
reportStrategy: "always",
// 只支持同步写法
getUid: (request) => {
const cookie = request.headers.cookie;
if (!cookie) return;
const uid = /quid=([^;]*);?/g.exec(cookie);
return uid ? uid[2] : '';
},
// 同步或者异步函数
getProxyInfo: () => {
return {
"port": 80,
"name": "2.0demo",
"group": "TSW",
"groupName": "TSW团队",
"desc": "2.0demo测试环境",
"order": 30,
"owner": "demoUser",
"alphaList": ["demoUser"]
};
},
// 请求回调函数
hooks: {
// 请求开始前回调,返回 false 则提前返回
requestStart(payload) {
const { req, context } = payload
if (req.method === 'HEAD') return false
},
// 结束开始前回调,返回 false 则提前返回
responseFinish(payload) {
const { req, context } = payload
if (req.method === 'HEAD') return false
},
},
})
]
};
2.0版本以后,不再允许将开放平台申请的
废弃不合理特性,允许通过参数传入票据,无指定才会读取环境变量appid
和 appkey
通过参数的形式透传到插件中。业务可以选择用合适的方式将这两个参数挂载到环境变量当中,对应形式如下且环境变量的名称不可更改:
appid => process.env.APP_ID
appkey => process.env.APP_KEY
插件也支持传入环境变量(*.env
)配置文件,在插件初始化阶段会将值挂载到环境变量上。
envPath
String
process.cwd() + relativePath
).env
// platform.env
APP_KEY=your_app_key
APP_ID=your_app_id
reportStrategy
"always" | "never" | "proxied"
proxied
always
,表示在任何情况下都上报日志数据。
never
,表示在任何情况下都不上报日志数据。
proxied
,表示在被代理时上报数据。
getUid
() => string
同步函数() => {}
从每个请求中提取用户 uid
getProxyInfo
Function
同步或者异步函数() => {}
返回值如果为 undefined
,表示这台机器不被允许通过代理到达。
hooks.requestStart
Function
同步函数返回值如果为 false
,则不做 uid 提取和匹配检查。
hooks.responseFinish
Function
同步函数返回值如果为 false
,则跳过上报逻辑。
如果返回一个对象,那么根据对象参数不同有几种情况:
{
"port": 80,
"name": "2.0demo",
"group": "TSW",
"groupName": "TSW团队",
"desc": "2.0demo测试环境",
"order": 30,
"owner": "demoUser",
"alphaOnly": false,
"alphaList": ["demoUser"]
}
alphaOnly
false
false
,认为这台机器会被注册到开放平台上,可以通过在开放平台上配置代理到达。true
,认为这台机器只是负责染色号码以记录日志。不可从开放平台配置代理。一般生产环境开启此参数。alphaList
表示本机希望抓包的用户列表,值的比对对象是 getUid
方法返回值。
即 alphaList.includes(getUid())
。
fetchOpenPlatformTimeout
Number
3000
请求开放平台的超时时间,单位为 ms。
FAQs
TSW 开放平台插件
The npm package @tswjs/open-platform-plugin receives a total of 0 weekly downloads. As such, @tswjs/open-platform-plugin popularity was classified as not popular.
We found that @tswjs/open-platform-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.