{ "scope": "Captured Stake.us frontend source only; no execution, network, live session or attack/scanner activity.", "heading_zh": "源码中能确认的前端安全处理及边界", "items": [ { "id": "SEC01", "title": "认证头集中在请求层注入", "practice_zh": "GraphQL session interceptor按session添加x-access-token，按locale添加x-language；游戏HTTP工厂也统一构造Content-Type并按getSession添加访问头。业务组件通过共享client提交。", "effect_zh": "减少每个页面自行拼认证头的分散实现，为会话更换和请求策略提供统一入口。", "boundary_zh": "仅证明前端请求构造方式。不能证明token存储安全、后端会验证权限或服务端对象级授权；未读取真实token。", "evidence_type": "static-observation", "layer": "application-call", "sources": [ { "file": "outputs/stake-us-source/chunks/Cu3B9wdT.mjs", "offset_unit": "unicode-character", "character_offset_0based": 23291, "end_character_offset_0based_exclusive": 23601, "line": 30, "snippet": "function be({request:e,session:t}){let n={};t?.session&&(n[`x-access-token`]=t.session),t&&(n[`x-language`]=G(t.locale));let r=J(e,n);return{...e,headers:r}}var X=async({request:e,doc:t})=>{let n=t?.definitions?.[0],r=J(e,{\"x-operation-name\":(`name`in n?n.name?.value:void 0)||`unknown`,\"x-operation-type\":`que", "sha256": "50e62d1ac243b5f4a439288e29da91ab48a89ab79b661ead825c4b3130a11de6" }, { "file": "outputs/stake-us-source/chunks/DYosYWTC.mjs", "offset_unit": "unicode-character", "character_offset_0based": 3365, "end_character_offset_0based_exclusive": 3575, "line": 1, "snippet": "Z=e=>{let t={\"Content-Type\":`application/json`};return e&&(t[`x-access-token`]=e),Object.assign(t,X),t},Q=()=>a(_),ne=e=>r(_,e),$=new WeakMap,re=e=>$.get(e.xstate)??null,ie=n=>{let r=o({...n,isWidget:t(f,()=>p(", "sha256": "8552d3871852551f5b3015c881e9f8497036938202309e7f7f82b96c62e7d314" } ] }, { "id": "SEC02", "title": "显式认证查询缺token会中止", "practice_zh": "authenticatedQuery在既有请求拦截器后检查x-access-token；缺失时调用AbortController.abort，query再检查signal.aborted并返回aborted错误。", "effect_zh": "使用该入口的组件不会把缺认证的请求继续发到网络，页面能够区分需要登录的读取。", "boundary_zh": "只覆盖显式调用authenticatedQuery的路径，不是所有query自动要求登录；前端门控不能替代后端授权。", "evidence_type": "static-observation", "layer": "application-call", "sources": [ { "file": "outputs/stake-us-source/chunks/Cu3B9wdT.mjs", "offset_unit": "unicode-character", "character_offset_0based": 32639, "end_character_offset_0based_exclusive": 33049, "line": 30, "snippet": "function Ae(e){let t=async({request:e,controller:t})=>(new Headers(e.headers).has(`x-access-token`)===!1&&t.abort(`Request aborted: missing authentication token for authenticated query.`),e);return Q().query({...e,requestInterceptors:[...Q().getRequestInterceptors(),t]})}function je(e){return Q().fetchGraphQL(e)}function Me(e,t,n){return Q().mutation(e,t,n)}function Ne(e,t,n){return Q().mutate(e,t,n)}functi", "sha256": "50e62d1ac243b5f4a439288e29da91ab48a89ab79b661ead825c4b3130a11de6" }, { "file": "outputs/stake-us-source/chunks/Cu3B9wdT.mjs", "offset_unit": "unicode-character", "character_offset_0based": 25931, "end_character_offset_0based_exclusive": 26116, "line": 30, "snippet": "if(m.aborted)return h();let u=r?r.name+JSON.stringify(n):null;if(u&&this.cacheMap.has(u))return{data:this.cacheMap.get(u),errors:void 0,context:c};let p=await l.fetch(_.url,{..._});if(p", "sha256": "50e62d1ac243b5f4a439288e29da91ab48a89ab79b661ead825c4b3130a11de6" } ] }, { "id": "SEC03", "title": "GraphQL错误日志隐藏变量值", "practice_zh": "记录GraphQL错误时保留操作文本与错误位置，但将variables所有值映为[REDACTED]，只保留键名。", "effect_zh": "该类错误日志不会直接写入密码/代码/输入等variables的实际值，仍能定位操作名及字段错误。", "boundary_zh": "不是全站日志脱敏证明。服务器error.message/extensions/stack、其他SDK与其他日志通道可能包含信息，仍需分别核对。", "evidence_type": "static-observation", "layer": "application-call", "sources": [ { "file": "outputs/stake-us-source/chunks/Cu3B9wdT.mjs", "offset_unit": "unicode-character", "character_offset_0based": 26479, "end_character_offset_0based_exclusive": 26699, "line": 30, "snippet": "variables:Object.fromEntries(Object.keys(n??{}).map(e=>[e,`[REDACTED]`]))};i.error(JSON.stringify(e))}for(let e of o||[])typeof e==`function`&&(r=e({errors:r,doc:t,variables:n,load:l,context:c}))}else u&&this.cacheMap.se", "sha256": "50e62d1ac243b5f4a439288e29da91ab48a89ab79b661ead825c4b3130a11de6" } ] }, { "id": "SEC04", "title": "按需资源加载保留CSP nonce", "practice_zh": "Vite modulepreload/CSS helper读取meta[property=csp-nonce]的nonce，创建link时设置同样nonce；应用OAuth和页面动态import经该helper。", "effect_zh": "存在nonce时，后续按需加载的资源能够沿用页面的CSP信任标记，不必只为动态组件放宽策略。", "boundary_zh": "这是框架helper能力及应用调用，不等于已证明线上启用严格CSP。捕获资料没有可确认的CSP响应头、nonce存在/随机性或完整script-src；未对浏览器执行验证。", "evidence_type": "static-observation", "layer": "framework-capability-used-by-application", "sources": [ { "file": "outputs/stake-us-source/chunks/uBIymjUX.mjs", "offset_unit": "unicode-character", "character_offset_0based": 155, "end_character_offset_0based_exclusive": 325, "line": 1, "snippet": "o=document.querySelector(`meta[property=csp-nonce]`),s=o?.nonce||o?.getAttribute(`nonce`);function c(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:`f", "sha256": "e1a22f3f73566f21ff932e058d32243e4a118f3491b91e96893aa5ab7eb49a00" }, { "file": "outputs/stake-us-source/chunks/uBIymjUX.mjs", "offset_unit": "unicode-character", "character_offset_0based": 689, "end_character_offset_0based_exclusive": 919, "line": 1, "snippet": "o.rel=a?`stylesheet`:`modulepreload`,a||(o.as=`script`),o.crossOrigin=``,o.href=r,s&&o.setAttribute(`nonce`,s),document.head.appendChild(o),a)return new Promise((e,t)=>{o.addEventListener(`load`,e),o.addEventListener(`error`,()=>t", "sha256": "e1a22f3f73566f21ff932e058d32243e4a118f3491b91e96893aa5ab7eb49a00" }, { "file": "outputs/stake-us-source/chunks/Dh3-ySZv.mjs", "offset_unit": "unicode-character", "character_offset_0based": 42094, "end_character_offset_0based_exclusive": 42204, "line": 2, "snippet": "import{t as M}from\"./uBIymjUX.mjs\";import{I as N,u as ie,v as ae}from\"./D4G09-Ja.mjs\";import{d as P}from\"./B3x", "sha256": "59f75489b9cdb83705d8a34220d637522281bba92d3f1a7d7c9f265e2ae2de50" } ] }, { "id": "SEC05", "title": "OAuth redirect生成随机verifier和SHA-256挑战", "practice_zh": "CHukuwd3用crypto.getRandomValues生成32字节并转Base64url，无padding；challenge为SHA-256(verifier)再Base64url。调用Xe先生成、算challenge、sessionStorage存verifier，再请求StartOauthRedirect(provider,returnTo,codeChallenge)，成功跳转，失败删除verifier。", "effect_zh": "可证实前端做了PKCE式挑战准备，授权请求传challenge而不是把verifier直接作为请求变量；sessionStorage把临时状态限制在当前标签会话。", "boundary_zh": "这里未确认回调兑换是否发送verifier、后端是否执行S256校验、state绑定、过期规则或redirect URL allowlist。因此不称完整OAuth/PKCE安全验证。", "evidence_type": "static-observation", "layer": "application-call", "sources": [ { "file": "outputs/stake-us-source/chunks/CHukuwd3.mjs", "offset_unit": "unicode-character", "character_offset_0based": 160, "end_character_offset_0based_exclusive": 520, "line": 1, "snippet": "n=()=>{let e=new Uint8Array(32);return crypto.getRandomValues(e),t(e)},r=async e=>{let n=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return t(new Uint8Array(n))},i=t=>{window.sessionStorage.setItem(e,t)},a=()=>window.sessionStorage.getItem(e),o=()=>window.sessionStorage.removeItem(e),s=e=>window.location.assign(e);export{s as a,a as i,r", "sha256": "f2aeb7abcc68b043f93a2a641c823be16d1d58f93b7e357d2f797e6aa97b7fcb" }, { "file": "outputs/stake-us-source/chunks/DT98r2cN.mjs", "offset_unit": "unicode-character", "character_offset_0based": 17128, "end_character_offset_0based_exclusive": 17533, "line": 31, "snippet": "Xe=async e=>{J=!0,p(q,!0);try{let t=Ee(),n=await we(t);Te(t);let r=await le(Oe,{provider:e,returnTo:`${window.location.pathname}${window.location.search}${window.location.hash}`,codeChallenge:n}),i=r.data?.startOauthRedirect.url;if(r.errors||!i)throw r.errors??Error(`OAuth redirect unavailable`);return Ce(i),!0}catch{return De(),p(q,!1),Ue(),!1}},Ze=()=>{try{return fe.getBooleanFlagSync(`platformReleas", "sha256": "297518c032e4a61fe875ebc74399e095271b662a59bbf8fdda409bf68cf15a80" } ] }, { "id": "SEC06", "title": "OAuth关窗和组件销毁会释放流程", "practice_zh": "OAuth popup流程100ms检测窗口关闭；X清interval、调用订阅unsubscribe、清openOauthSubscriptions并复位loading；组件销毁也clear/close/X。结果来自GraphQL OauthSubscription next/error，popup只是打开服务返回URL。", "effect_zh": "用户取消、组件离开和结果完成有清理路径，降低遗留订阅/轮询以及重复登录状态持续存在的可能。", "boundary_zh": "这不是popup postMessage origin校验的证据：已检查OAuth组件、window.open helper与verifier helper，未见OAuth结果message监听；结果在此实现走WS订阅。没有证据可宣称跨窗口origin/source/allowlist已校验，也不能据局部没message监听就指控origin漏洞。", "evidence_type": "static-observation", "layer": "application-call", "sources": [ { "file": "outputs/stake-us-source/chunks/DT98r2cN.mjs", "offset_unit": "unicode-character", "character_offset_0based": 15642, "end_character_offset_0based_exclusive": 15942, "line": 31, "snippet": "X=({closePopup:e=!1}={})=>{clearInterval(Y),Y=void 0,e&&W?.close();let t=K;K?.(),K=void 0,D()?.type===`oauth`&&D().unsubscribe===t&&A.set(null),p(q,!1),Ue()},We=m(()=>R()?[x(Ve)]:x(U)),Ge=m(()=>x(U).length>1),Z=t(null),Ke=!0;i(()=>{let e=R();if(Ke){Ke=!1;return}let t=x(Z)?.parentElement;for(;t&&t!==", "sha256": "297518c032e4a61fe875ebc74399e095271b662a59bbf8fdda409bf68cf15a80" }, { "file": "outputs/stake-us-source/chunks/DT98r2cN.mjs", "offset_unit": "unicode-character", "character_offset_0based": 16116, "end_character_offset_0based_exclusive": 16401, "line": 31, "snippet": "Je=e=>{clearInterval(Y),Y=setInterval(()=>{G&&!e?.closed&&e?.close(),e?.closed&&(clearInterval(Y),G||X())},100)};te(()=>{Y&&clearInterval(Y),W&&W.close(),X()});let Ye=async e=>{if(J)return;J=!0,p(q,!0);let t={provider:e,sessionName:pe(),...me(),offerDisabled:!!se.affiliate.offerDisabl", "sha256": "297518c032e4a61fe875ebc74399e095271b662a59bbf8fdda409bf68cf15a80" }, { "file": "outputs/stake-us-source/chunks/DT98r2cN.mjs", "offset_unit": "unicode-character", "character_offset_0based": 16941, "end_character_offset_0based_exclusive": 17311, "line": 31, "snippet": "if(K=ue(N,t,{next:({data:e,errors:t})=>n({data:e??void 0,errors:t}),error:e=>{let t=ce(e);n({errors:[t]})},complete:()=>{p(q,!1)}}),!J){K(),K=void 0;return}A.openSubscription(`oauth`,K)},Xe=async e=>{J=!0,p(q,!0);try{let t=Ee(),n=await we(t);Te(t);let r=await le(Oe,{provider:e,returnTo:`${window.location.pathname}${window.location.search}${window.location.hash}`,codeC", "sha256": "297518c032e4a61fe875ebc74399e095271b662a59bbf8fdda409bf68cf15a80" }, { "file": "outputs/stake-us-source/chunks/C07WLNJL.mjs", "offset_unit": "unicode-character", "character_offset_0based": 0, "end_character_offset_0based_exclusive": 205, "line": 1, "snippet": "var e=({windowName:e=`Connect With OAuth`,url:t})=>{let n=screen.width/2-300,r=`location=0, status=0, width=600, height=600, top=${screen.height/2-300}, left=${n}`;return window.open(t,e,r)};export{e as t}", "sha256": "60cf89057acb332853ece968220daac62fbb61671d4848aceec5f9599da5147f" } ] }, { "id": "SEC07", "title": "JSON-LD输出对小于号转义", "practice_zh": "SEO适配器将jsonLd解析/序列化后传a，a输出application/ld+json script时把所有<替换为\\u003c；1dM5wbsU接收sanitizedJsonLd用于SEO头部。", "effect_zh": "即使JSON文本包含结束script标签形状，也不会在此输出中保留<；降低JSON-LD文本突破script边界的风险。", "boundary_zh": "只证明这一JSON-LD sink，不是任意HTML清洗器，也未证明全站富文本/聊天内容均sanitize。sanitize命名和SDK中类似词汇不能被当作DOMPurify或全站XSS防护证据。", "evidence_type": "static-observation", "layer": "application-call", "sources": [ { "file": "outputs/stake-us-source/chunks/ysfTt0iE.mjs", "offset_unit": "unicode-character", "character_offset_0based": 362, "end_character_offset_0based_exclusive": 507, "line": 1, "snippet": "if(r?.jsonLd){let n;try{n=t(r.jsonLd),r.sanitizedJsonLd=a(e(n))}catch(e){console.error(e)}}return r}var i=()=>typeof window<`u`&&!!n(`session`);f", "sha256": "b5e00052e92e07104ffd4cb213f1dadc8fab6785552efe73c58807bde7e27eb9" }, { "file": "outputs/stake-us-source/chunks/ysfTt0iE.mjs", "offset_unit": "unicode-character", "character_offset_0based": 506, "end_character_offset_0based_exclusive": 639, "line": 1, "snippet": "function a(e){return`