25w01c

.github/workflows/build-dev.yml

@@ -37,7 +37,7 @@ jobs:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
         run: |
-          CGO_ENABLED=0 go build -ldflags "-X main.version=${{ env.VERSION }}" -o ${{ env.OUTPUT_BINARY }}-${{matrix.goos}}-${{matrix.goarch}} ./main.go
+          CGO_ENABLED=0 go build -ldflags "-X main.version=${{ env.VERSION }} -X main.dev=true" -o ${{ env.OUTPUT_BINARY }}-${{matrix.goos}}-${{matrix.goarch}} ./main.go
       - name: 打包
         run: |
           mkdir ghproxyd

.gitignore

@@ -0,0 +1 @@
+demo.toml

CHANGELOG.md

@@ -1,5 +1,36 @@
 # 更新日志
 
+25w01c
+---
+- PRE-RELEASE: 此版本是v1.8.0的预发布版本,请勿在生产环境中使用
+- CHANGE: 改进token参数透传功能
+
+25w01b
+---
+- PRE-RELEASE: 此版本是v1.8.0的预发布版本,请勿在生产环境中使用
+- CHANGE: 将底包更新至`v2.9.0`
+
+25w01a
+---
+- PRE-RELEASE: 此版本是v1.8.0的预发布版本,请勿在生产环境中使用; 同时,这也是2025年的第一个pre-release版本,祝各位新年快乐! (同时,请注意版本号的变化)
+- ADD: 加入`dev`参数, 以便pre-release版本调试(实验性)
+- ADD: 加入基于`embed.FS`的内嵌前端, config.toml中的`[pages]`配置为false时自动使用内嵌前端
+- CHANGE: 完善24w29a版本新加入的`Auth`参数透传至`"Authorization: token {token}"`功能，对相关逻辑进行完善
+- FIX: 修正24w29a版本新加入的`Auth`参数透传至`"Authorization: token {token}"`功能的一些问题
+
+24w29a
+---
+- PRE-RELEASE: 此版本是一个实验性功能测试版本,请勿在生产环境中使用; 同时,这也是2024年的最后一个pre-release版本
+- ADD: `Auth` token参数透传至`"Authorization: token {token}"`, 为私有仓库拉取提供一定便利性(需要更多测试)
+- CHANGE: 更新相关依赖库
+
+v1.7.9
+---
+- RELEASE: 安全性及小型修复, 建议用户自行选择是否升级
+- CHANGE: 将`logger`库作为外部库引入, 使维护性更好, 同时修正了部分日志问题并提升部分性能
+- CHANGE: 更新相关依赖库, 更新`req`库以解决`net`标准库的`CVE-2021-38561`漏洞
+- FIX: 修复安装脚本内的错误
+
 24w28b
 ---
 - PRE-RELEASE: 此版本是v1.7.9的预发布版本,请勿在生产环境中使用

DEV-VERSION

@@ -1 +1 @@
-24w28b
+25w01c

VERSION

@@ -1 +1 @@
-1.7.8
+1.7.9

config/config.go

@@ -20,6 +20,7 @@ type ServerConfig struct {
 	Host      string `toml:"host"`
 	SizeLimit int    `toml:"sizeLimit"`
 	EnableH2C string `toml:"enableH2C"`
+	Debug     bool   `toml:"debug"`
 }
 
 type PagesConfig struct {
@@ -37,9 +38,10 @@ type CORSConfig struct {
 }
 
 type AuthConfig struct {
-	Enabled    bool   `toml:"enabled"`
-	AuthMethod string `toml:"authMethod"`
-	AuthToken  string `toml:"authToken"`
+	Enabled     bool   `toml:"enabled"`
+	AuthMethod  string `toml:"authMethod"`
+	AuthToken   string `toml:"authToken"`
+	PassThrough bool   `toml:"passThrough"`
 }
 
 type BlacklistConfig struct {

config/config.toml

@@ -3,6 +3,7 @@ host = "127.0.0.1"
 port = 8080 
 sizeLimit = 125 # MB
 enableH2C = "on" # "on" or "off"
+debug = false
 
 [pages]
 enabled = false
@@ -19,6 +20,7 @@ enabled = true
 authMethod = "parameters" # "header" or "parameters"
 authToken = "token"
 enabled = false
+passThrough = false
 
 [blacklist]
 blacklistFile = "/data/ghproxy/config/blacklist.json"

deploy/config.toml

@@ -3,6 +3,7 @@ host = "127.0.0.1"
 port = 8080 
 sizeLimit = 125 # MB
 enableH2C = false
+debug = false
 
 [pages]
 enabled = true
@@ -19,6 +20,7 @@ enabled = true
 authMethod = "parameters" # "header" or "parameters"
 authToken = "token"
 enabled = false
+passThrough = false
 
 [blacklist]
 blacklistFile = "/usr/local/ghproxy/config/blacklist.json"

docker/dockerfile/dev/Dockerfile

@@ -1,4 +1,4 @@
-FROM wjqserver/caddy:v24.12.20-alpine AS builder
+FROM wjqserver/caddy:2.9.0-alpine AS builder
 
 ARG USER=WJQSERVER-STUDIO
 ARG REPO=ghproxy
@@ -36,7 +36,7 @@ RUN wget -O /data/${APPLICATION}/whitelist.json https://raw.githubusercontent.co
 RUN chmod +x /data/${APPLICATION}/${APPLICATION}
 RUN chmod +x /usr/local/bin/init.sh
 
-FROM wjqserver/caddy:v24.12.20-alpine
+FROM wjqserver/caddy:2.9.0-alpine
 
 RUN apk add --no-cache curl
 

docker/dockerfile/nocache/config.toml

@@ -3,6 +3,7 @@ host = "0.0.0.0"
 port = 80 #修改此配置会导致容器异常
 sizeLimit = 125 # MB
 enableH2C = "off" # on / off
+debug = false
 
 [pages]
 enabled = true
@@ -19,6 +20,7 @@ enabled = true
 authMethod = "parameters" # "header" or "parameters"
 authToken = "token"
 enabled = false
+passThrough = false
 
 [blacklist]
 blacklistFile = "/data/ghproxy/config/blacklist.json"

docker/dockerfile/release/Dockerfile

@@ -1,4 +1,4 @@
-FROM wjqserver/caddy:v24.12.20-alpine AS builder
+FROM wjqserver/caddy:2.9.0-alpine AS builder
 
 ARG USER=WJQSERVER-STUDIO
 ARG REPO=ghproxy
@@ -36,7 +36,7 @@ RUN wget -O /data/${APPLICATION}/whitelist.json https://raw.githubusercontent.co
 RUN chmod +x /data/${APPLICATION}/${APPLICATION}
 RUN chmod +x /usr/local/bin/init.sh
 
-FROM wjqserver/caddy:v24.12.20-alpine
+FROM wjqserver/caddy:2.9.0-alpine
 
 RUN apk add --no-cache curl
 

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/cloudwego/base64x v0.1.4 // indirect
 	github.com/cloudwego/iasm v0.2.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.7 // indirect
-	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/gin-contrib/sse v1.0.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.23.0 // indirect
@@ -34,7 +34,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/onsi/ginkgo/v2 v2.22.1 // indirect
+	github.com/onsi/ginkgo/v2 v2.22.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.48.2 // indirect

go.sum

@@ -20,8 +20,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/gabriel-vasile/mimetype v1.4.7 h1:SKFKl7kD0RiPdbht0s7hFtjl489WcQ1VyPW8ZzUMYCA=
 github.com/gabriel-vasile/mimetype v1.4.7/go.mod h1:GDlAgAyIRT27BhFl53XNAFtfjzOkLaF35JdEG0P7LtU=
-github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
-github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-contrib/sse v1.0.0 h1:y3bT1mUWUxDpW4JLQg/HnTqV4rozuW4tC9eFKTxYI9E=
+github.com/gin-contrib/sse v1.0.0/go.mod h1:zNuFdwarAygJBht0NTKiSi3jRf6RbqeILZ9Sp6Slhe0=
 github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
 github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
@@ -67,10 +67,10 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/onsi/ginkgo/v2 v2.22.1 h1:QW7tbJAUDyVDVOM5dFa7qaybo+CRfR7bemlQUN6Z8aM=
-github.com/onsi/ginkgo/v2 v2.22.1/go.mod h1:S6aTpoRsSq2cZOd+pssHAlKW/Q/jZt6cPrPlnj4a1xM=
-github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
-github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU=
+github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk=
+github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
+github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
 github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -84,13 +84,15 @@ github.com/refraction-networking/utls v1.6.7/go.mod h1:BC3O4vQzye5hqpmDTWUqi4P5D
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=

main.go

@@ -1,8 +1,10 @@
 package main
 
 import (
+	"embed"
 	"flag"
 	"fmt"
+	"io/fs"
 	"log"
 	"net/http"
 	"time"
@@ -24,10 +26,17 @@ var (
 	configfile = "/data/ghproxy/config/config.toml"
 	cfgfile    string
 	version    string
+	dev        string
+	runMode    string
 	limiter    *rate.RateLimiter
 	iplimiter  *rate.IPRateLimiter
 )
 
+var (
+	//go:embed pages/*
+	pagesFS embed.FS
+)
+
 var (
 	logw       = logger.Logw
 	logInfo    = logger.LogInfo
@@ -89,7 +98,16 @@ func init() {
 	loadlist(cfg)
 	setupRateLimit(cfg)
 
-	gin.SetMode(gin.ReleaseMode)
+	if cfg.Server.Debug {
+		dev = "true"
+	}
+	if dev == "true" {
+		gin.SetMode(gin.DebugMode)
+		runMode = "dev"
+	} else {
+		gin.SetMode(gin.ReleaseMode)
+		runMode = "release"
+	}
 
 	router = gin.Default()
 	//H2C默认值为true，而后遵循cfg.Server.EnableH2C的设置
@@ -100,11 +118,6 @@ func init() {
 	} else {
 		router.UseH2C = false
 	}
-	/*if !cfg.Server.EnableH2C {
-		router.UseH2C = false
-	} else {
-		router.UseH2C = true
-	}*/
 
 	setupApi(cfg, router, version)
 
@@ -117,14 +130,16 @@ func init() {
 		})
 		router.StaticFile("/favicon.ico", faviconPath)
 	} else if !cfg.Pages.Enabled {
-		router.GET("/", func(c *gin.Context) {
-			c.String(http.StatusForbidden, "403 Forbidden Access")
-			logWarning("403 > Path:/ IP:%s UA:%s METHOD:%s HTTPv:%s", c.ClientIP(), c.Request.UserAgent(), c.Request.Method, c.Request.Proto)
-		})
+		pages, err := fs.Sub(pagesFS, "pages")
+		if err != nil {
+			log.Fatalf("Failed when processing pages: %s", err)
+		}
+		router.GET("/", gin.WrapH(http.FileServer(http.FS(pages))))
+		router.GET("/favicon.ico", gin.WrapH(http.FileServer(http.FS(pages))))
 	}
 
 	router.NoRoute(func(c *gin.Context) {
-		proxy.NoRouteHandler(cfg, limiter, iplimiter)(c)
+		proxy.NoRouteHandler(cfg, limiter, iplimiter, runMode)(c)
 	})
 }
 

proxy/proxy.go

@@ -34,7 +34,7 @@ var exps = []*regexp.Regexp{
 	regexp.MustCompile(`^(?:https?://)?api\.github\.com/repos/([^/]+)/([^/]+)/.*`),
 }
 
-func NoRouteHandler(cfg *config.Config, limiter *rate.RateLimiter, iplimiter *rate.IPRateLimiter) gin.HandlerFunc {
+func NoRouteHandler(cfg *config.Config, limiter *rate.RateLimiter, iplimiter *rate.IPRateLimiter, runMode string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		// 限制访问频率
 		if cfg.RateLimit.Enabled {
@@ -134,9 +134,9 @@ func NoRouteHandler(cfg *config.Config, limiter *rate.RateLimiter, iplimiter *ra
 
 		switch {
 		case exps[0].MatchString(rawPath), exps[1].MatchString(rawPath), exps[3].MatchString(rawPath), exps[4].MatchString(rawPath):
-			ProxyRequest(c, rawPath, cfg, "chrome")
+			ProxyRequest(c, rawPath, cfg, "chrome", runMode)
 		case exps[2].MatchString(rawPath):
-			ProxyRequest(c, rawPath, cfg, "git")
+			ProxyRequest(c, rawPath, cfg, "git", runMode)
 		default:
 			c.String(http.StatusForbidden, "Invalid input.")
 			fmt.Println("Invalid input.")
@@ -167,11 +167,14 @@ func MatchUserRepo(rawPath string, cfg *config.Config, c *gin.Context, matches [
 	return "", ""
 }
 
-func ProxyRequest(c *gin.Context, u string, cfg *config.Config, mode string) {
+func ProxyRequest(c *gin.Context, u string, cfg *config.Config, mode string, runMode string) {
 	method := c.Request.Method
 	logInfo("%s %s %s %s %s", c.ClientIP(), method, u, c.Request.Header.Get("User-Agent"), c.Request.Proto)
 
 	client := createHTTPClient(mode)
+	if runMode == "dev" {
+		client.DevMode()
+	}
 
 	// 发送HEAD请求, 预获取Content-Length
 	headReq := client.R()
@@ -197,6 +200,7 @@ func ProxyRequest(c *gin.Context, u string, cfg *config.Config, mode string) {
 
 	req := client.R().SetBody(body)
 	setRequestHeaders(c, req)
+	authPassThrough(c, cfg, req)
 
 	resp, err := SendRequest(c, req, method, u)
 	if err != nil {
@@ -250,6 +254,55 @@ func setRequestHeaders(c *gin.Context, req *req.Request) {
 	}
 }
 
+/*
+	func authPassThrough(c *gin.Context, cfg *config.Config, req *req.Request) {
+		if cfg.Auth.PassThrough && cfg.Auth.AuthMethod == "parameters" && !cfg.Auth.Enabled {
+			// only mode
+			token := c.Query("token")
+			req.SetHeader("Authorization", "token "+token)
+		} else if cfg.Auth.PassThrough && cfg.Auth.AuthMethod == "header" && cfg.Auth.Enabled {
+			// mix mode
+			token := c.Query("token")
+			req.SetHeader("Authorization", "token "+token)
+		} else if cfg.Auth.PassThrough && cfg.Auth.AuthMethod == "parameters" && cfg.Auth.Enabled {
+			// conflict
+			logWarning("%s %s %s %s %s Auth-Error: Conflict Auth Method", c.ClientIP(), c.Request.Method, c.Request.URL.String(), c.Request.Header.Get("User-Agent"), c.Request.Proto)
+			c.JSON(http.StatusForbidden, gin.H{"error": "Conflict Auth Method"})
+			return
+		} else if cfg.Auth.PassThrough && cfg.Auth.AuthMethod == "header" && !cfg.Auth.Enabled {
+			// only mode
+			token := c.Query("token")
+			req.SetHeader("Authorization", "token "+token)
+		}
+	}
+*/
+
+func authPassThrough(c *gin.Context, cfg *config.Config, req *req.Request) {
+	if cfg.Auth.PassThrough {
+		token := c.Query("token")
+		switch cfg.Auth.AuthMethod {
+		case "parameters":
+			if !cfg.Auth.Enabled {
+				req.SetHeader("Authorization", "token "+token)
+			} else {
+				logWarning("%s %s %s %s %s Auth-Error: Conflict Auth Method", c.ClientIP(), c.Request.Method, c.Request.URL.String(), c.Request.Header.Get("User-Agent"), c.Request.Proto)
+				// 500 Internal Server Error
+				c.JSON(http.StatusInternalServerError, gin.H{"error": "Conflict Auth Method"})
+				return
+			}
+		case "header":
+			if cfg.Auth.Enabled {
+				req.SetHeader("Authorization", "token "+token)
+			}
+		default:
+			logWarning("%s %s %s %s %s Invalid Auth Method / Auth Method is not be set", c.ClientIP(), c.Request.Method, c.Request.URL.String(), c.Request.Header.Get("User-Agent"), c.Request.Proto)
+			// 500 Internal Server Error
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Invalid Auth Method / Auth Method is not be set"})
+			return
+		}
+	}
+}
+
 // 复制响应体
 func copyResponseBody(c *gin.Context, respBody io.Reader) error {
 	_, err := io.Copy(c.Writer, respBody)