← 返回扫描报告总表 · ← dshlib 图书馆

扫描报告 · wenbin-wb/dsh-bridge

自研扫描：⚠️ 待审 · GuardDog 复核：未扫描 · OSV 依赖：未扫描

1. 自研扫描（dshlib-scan）

verified

True

findings

{'data_exfiltration': [{'file': 'dsh-bridge-main/client/client.js', 'line': 5277, 'match': 'token = await fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/client/client.js', 'line': 5299, 'match': 'token = await fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/client/client.js', 'line': 6745, 'match': 'token = await fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/client/index.js', 'line': 3197, 'match': 'token = await fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/client/index.js', 'line': 3228, 'match': 'token = await fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/client/index.js', 'line': 4794, 'match': 'token = await fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/docs/custom-tunnel.md', 'line': 73, 'match': 'secret-token bash <(curl', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 16521, 'match': 'token.reason = new CanceledError(message, config, request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 119247, 'match': 'token request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 119355, 'match': 'token, expire } = yield this.request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 119464, 'match': 'token } = yield this.request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 119470, 'match': 'token, expire } = yield this.request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 119711, 'match': 'token request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-bridge-main/scripts/install-tunnel-server.sh', 'line': 9, 'match': 'token bash <(curl', 'label': '凭据字段进入网络请求'}], 'excessive_permissions': [{'file': 'dsh-bridge-main/client/client.js', 'line': 1779, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/client/resource-url-compat.js', 'line': 41, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/auth/dsh-native-cookie.js', 'line': 75, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/auth/dsh-native-cookie.js', 'line': 78, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/auth/dsh-native-cookie.js', 'line': 83, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/auth/manager.js', 'line': 568, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/cloudflared-manager.mjs', 'line': 11, 'match': 'execSync(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/cloudflared-manager.mjs', 'line': 63, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/cloudflared-manager.mjs', 'line': 66, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/cloudflared-manager.mjs', 'line': 95, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 8832, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 8860, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 9857, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 10318, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 12254, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 12516, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 12697, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 13333, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 13661, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 13673, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 18629, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/feishu/lark-bundled.mjs', 'line': 19472, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/platform/message-split.js', 'line': 207, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/telegram/node.js', 'line': 171, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/lib/tunnel-client.mjs', 'line': 379, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/scripts/create-github-release.mjs', 'line': 8, 'match': 'execSync(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-fixed-panel-offset.test.mjs', 'line': 63, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 58, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 72, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 85, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 148, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 155, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 159, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 247, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 249, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 337, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 338, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 357, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 385, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 386, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/mobile-settings-narrow-layout.test.mjs', 'line': 481, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/restart-helper.test.mjs', 'line': 87, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-bridge-main/test/workspace-picker-submitting-reset.test.mjs', 'line': 39, 'match': 'exec(', 'label': '命令执行'}], 'hardcoded_secrets': [{'file': 'dsh-bridge-main/lib/auth/dsh-native-cookie.js', 'line': 66, 'match': 'secret:"的旧行为。\n *\n * @param {string} content 凭据文件文本\n * @returns {string} base64ur', 'label': '明文凭据'}, {'file': 'dsh-bridge-main/scripts/create-github-release.mjs', 'line': 13, 'match': "password='));\n    if (match) return match.split('", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/bridge-service-fixes.test.mjs', 'line': 8, 'match': "token: 'real-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/bridge-service-fixes.test.mjs', 'line': 16, 'match': "token: 'new-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 183, 'match': "token = 'acvTOKENpayloadACVTOKENpayloa'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 204, 'match': "token: 'eTOKENxyz'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 213, 'match': "token: 'STALETOKEN'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 245, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 282, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 319, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 358, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 394, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 428, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-health-probe.test.mjs', 'line': 458, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-manager-fix.test.mjs', 'line': 74, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-manager-fix.test.mjs', 'line': 111, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-manager-fix.test.mjs', 'line': 148, 'match': "token: 'bad-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-manager-fix.test.mjs', 'line': 180, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-manager-fix.test.mjs', 'line': 208, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-manager-fix.test.mjs', 'line': 262, 'match': "token: 'cf-fixed-domain-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/cloudflared-manager-fix.test.mjs', 'line': 294, 'match': "token: 'fake-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/config-file-permissions.test.mjs', 'line': 61, 'match': "token: 'FAKE-TUNNEL-JWT'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/dsh-native-cookie.test.mjs', 'line': 100, 'match': "secret: ' + SECRET,\n    '", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/dsh-native-cookie.test.mjs', 'line': 115, 'match': "secret: ' + SECRET,\n    '", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/dsh-native-cookie.test.mjs', 'line': 122, 'match': "secret: ' + SECRET + '", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/dsh-native-cookie.test.mjs', 'line': 134, 'match': "secret: ' + SECRET + '", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/dsh-native-cookie.test.mjs', 'line': 166, 'match': "secret: ' + SECRET + '", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/proxy-auth.test.mjs', 'line': 114, 'match': "password: 'mypassword'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/security-vulnerabilities.test.mjs', 'line': 164, 'match': "password: 'admin_pass'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/security-vulnerabilities.test.mjs', 'line': 454, 'match': "password: 'my-new-pass'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/tunnel-autostart.test.mjs', 'line': 11, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/tunnel-autostart.test.mjs', 'line': 37, 'match': "token: 'new-token-123'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/tunnel-autostart.test.mjs', 'line': 56, 'match': "token: 'cf-secret-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/tunnel-autostart.test.mjs', 'line': 150, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/tunnel-autostart.test.mjs', 'line': 175, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-bridge-main/test/tunnel-autostart.test.mjs', 'line': 181, 'match': "token: 'test-token'", 'label': '明文凭据'}], 'dangerous_commands': [{'file': 'dsh-bridge-main/lib/index.js', 'line': 324, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-bridge-main/test/dsh-upgrade.test.mjs', 'line': 108, 'match': "rm -rf', '1.0.0 && whoami', '$(cat /etc/", 'label': 'rm -rf 危险删除'}]}

mode

git-refresh

branch

main

2. 第三方复核（GuardDog 3.2.0）

未复核。

3. 依赖漏洞（OSV.dev）

未查询。