A serious security bug in leancloud visitor counter [solved] about hexo-theme-next

[ivan-nginx]

Where u want to discuss? Let's go in gitter at this weekend?

[sli1989]

you can add security DNS or host name in leancloud's Security settings？After setting up a Web security domain name, you can only call server resources through the JavaScript SDK under this domain name.

[ivan-nginx]

I don't know what's the trouble and where is bug, but yes, if this is security bug, it must be of course fixed.

[LEAFERx]

@sli1989 that's not the problem
there is another problem...

[LEAFERx]

Now i'm working on fixing it and have some progress
but the fix must be done in the leancloud's background controller manually
it can't be done in the next theme
i will write a blog about the solution after i fix it but .... how can we inform those who use this function
there's too many

[LEAFERx]

Fixes are done with a plugin.Chinese doc is on the way. English doc may be released in few days.

[ivan-nginx]

Implemented in #137 pull.

[LEAFERx]

bug fixed in #137 .

[sli1989]

Is there any problems? It's too much setting steps...

ERROR Plugin load failed: hexo-leancloud-counter-security
/builds/sli1989/sli1989.gitlab.io/node_modules/hexo-leancloud-counter-security/index.js:22
async function sync() {
      ^^^^^^^^
SyntaxError: Unexpected token function
    at createScript (vm.js:56:10)
    at Object.runInThisContext (vm.js:97:10)
    at /builds/sli1989/sli1989.gitlab.io/node_modules/hexo/lib/hexo/index.js:230:17
    at tryCatcher (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/util.js:16:23)
    at Promise._settlePromiseFromHandler (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:512:31)
    at Promise._settlePromise (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:569:18)
    at Promise._settlePromise0 (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:614:10)
    at Promise._settlePromises (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:693:18)
    at Promise._fulfill (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:638:18)
    at Promise._resolveCallback (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:432:57)
    at Promise._settlePromiseFromHandler (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:524:17)
    at Promise._settlePromise (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:569:18)
    at Promise._settlePromise0 (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:614:10)
    at Promise._settlePromises (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:693:18)
    at Promise._fulfill (/builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/promise.js:638:18)
    at /builds/sli1989/sli1989.gitlab.io/node_modules/bluebird/js/release/nodeback.js:42:21
    at /builds/sli1989/sli1989.gitlab.io/node_modules/graceful-fs/graceful-fs.js:78:16
    at tryToString (fs.js:456:3)
    at FSReqWrap.readFileAfterClose [as oncomplete] (fs.js:443:12)

[LEAFERx]

@sli1989 please tell me what's ur node version and hexo version
async is introduced in ES2017 so it may need a higher version node
If it is the problem i will update the doc

[sli1989]

image: node:6.10.2

`-- [email protected] 
  +-- [email protected] 
  +-- [email protected] 
  +-- [email protected] 
  | +-- [email protected] 
  | +-- [email protected] 
  | +-- [email protected] 
  | | `-- [email protected] 
  | +-- [email protected] 
  | `-- [email protected] 
  +-- [email protected] 
  +-- [email protected] 
  | +-- [email protected] 
  | | +-- [email protected] 
  | | | +-- [email protected] 
  | | | | +-- [email protected] 
  | | | | | `-- [email protected] 
  | | | | +-- [email protected] 
  | | | | +-- [email protected] 
  | | | | | +-- [email protected] 
  | | | | | | `-- [email protected] 
  | | | | | |   +-- [email protected] 
  | | | | | |   +-- [email protected] 
  | | | | | |   +-- [email protected] 
  | | | | | |   | +-- [email protected] 
  | | | | | |   | | `-- [email protected] 
  | | | | | |   | `-- [email protected] 
  | | | | | |   `-- [email protected] 
  | | | | | +-- [email protected] 
  | | | | | `-- [email protected] 
  | | | | +-- [email protected] 
  | | | | | `-- [email protected] 
  | | | | +-- [email protected] 
  | | | | +-- [email protected] 
  | | | | +-- [email protected] 
  | | | | | `-- [email protected] 
  | | | | +-- [email protected] 
  | | | | | +-- [email protected] 
  | | | | | | `-- [email protected] 
  | | | | | `-- [email protected] 
  | | | | +-- [email protected] 
  | | | | | +-- [email protected] 
  | | | | | `-- [email protected] 
  | | | | `-- [email protected] 
  | | | |   `-- [email protected] 
  | | | |     `-- [email protected] 
  | | | `-- [email protected] 
  | | |   `-- [email protected] 
  | | +-- [email protected] 
  | | +-- [email protected] 
  | | +-- [email protected] 
  | | +-- [email protected] 
  | | | `-- [email protected] 
  | | +-- [email protected] 
  | | | `-- [email protected] 
  | | +-- [email protected] 
  | | `-- [email protected] 
  | |   +-- [email protected] 
  | |   | `-- [email protected] 
  | |   |   +-- [email protected] 
  | |   |   `-- [email protected] 
  | |   +-- [email protected] 
  | |   | +-- [email protected] 
  | |   | +-- [email protected] 
  | |   | +-- [email protected] 
  | |   | +-- [email protected] 
  | |   | +-- [email protected] 
  | |   | `-- [email protected] 
  | |   `-- [email protected] 
  | `-- [email protected] 
  +-- [email protected] 
  | `-- [email protected] 
  |   +-- [email protected] 
  |   +-- [email protected] 
  |   | +-- [email protected] 
  |   | | `-- [email protected] 
  |   | +-- [email protected] 
  |   | `-- [email protected] 
  |   |   `-- [email protected] 
  |   |     +-- [email protected] 
  |   |     | `-- [email protected] 
  |   |     `-- [email protected] 
  |   `-- [email protected] 
  +-- [email protected] 
  | +-- [email protected] 
  | | +-- [email protected] 
  | | | `-- [email protected] 
  | | `-- [email protected] 
  | +-- [email protected] 
  | | +-- [email protected] 
  | | | +-- [email protected] 
  | | | `-- [email protected] 
  | | `-- [email protected] 
  | |   `-- [email protected] 
  | +-- [email protected] 
  | +-- [email protected] 
  | `-- [email protected] 
  +-- [email protected] 
  +-- [email protected] 
  +-- [email protected] 
  | `-- [email protected] 
  `-- [email protected] 
    `-- [email protected] 

[tyoungcn]

I meet the same problem as sli1989, and my node version is v6.10.0 .

[LEAFERx]

@sli1989 @tyoungcn
solved in [email protected]

[ivan-nginx]

There are some not actually maked to production things:

• 1. I don't understand what in CN docs and want at least see EN (if anybody can to translate this, welcome). Added in #174.
• 2. I don't see what node plugin supported. And as Hexo at least support node v6, this plugin must support this too.
  
• 3. I don't understand what mean option betterPerformance: false in NexT config and can't find any instructions in plugin readme how to use this option.

So, i suggest for now it's beta feature and i make some changes in this commit (by default security option for now disabled).

[ivan-nginx]

@LEAFERx u can change back 29e2e59 commit and close this issue, i think.

[LEAFERx]

could u do this？i have no access to computer now

[ivan-nginx]

Solved.

All future reports for this plugin can be posted here.