security: disable remote script execution and harden runtime

.dockerignore

@@ -0,0 +1,21 @@
+.git
+.gitignore
+.github
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+*.pfx
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.venv/
+venv/
+node_modules/
+dist/
+build/
+coverage/
+author/
+README.md

.env.example

@@ -1,2 +1,3 @@
 # Copy to .env and fill locally. Do not commit real cookies.
 COOKIES=
+XHS_ALLOW_REMOTE_JS_EXECUTION=0

.github/workflows/security.yml

@@ -0,0 +1,45 @@
+name: Security CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.10'
+          cache: pip
+
+      - name: Validate Python sources
+        run: |
+          python -m pip install --disable-pip-version-check -r requirements.txt
+          python -m compileall -q spider xhs_utils
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Audit Node dependencies
+        run: |
+          npm ci --ignore-scripts
+          npm audit --audit-level=high
+
+      - name: Build and verify container
+        run: |
+          docker build -t spider-xhs-ci .
+          docker run --rm --entrypoint sh spider-xhs-ci -c 'test "$(id -u)" != 0 && test "${XHS_ALLOW_REMOTE_JS_EXECUTION:-0}" != 1'

Dockerfile

@@ -21,9 +21,16 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
 
+RUN groupadd --system app \
+    && useradd --system --gid app --home-dir /app --no-create-home app \
+    && chown -R app:app /app
+
 EXPOSE 5000
 
+ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 ENV NODE_ENV=production
 
+USER app
+
 CMD ["python", "-m", "spider.spider"] 

xhs_utils/common_util.py

@@ -82,7 +82,7 @@ def fetch_sec_cookies(cookies, headers):
         res = resp.json()
         sec_poison_id = res.get('data', {}).get('secPoisonId')
         jsvmp_code = res.get('data', {}).get('data', '')
-        if jsvmp_code:
+        if jsvmp_code and os.getenv('XHS_ALLOW_REMOTE_JS_EXECUTION', '').strip() == '1':
             env = _load_websectiga_env()
             if env:
                 try:
@@ -91,6 +91,8 @@ def fetch_sec_cookies(cookies, headers):
                     websectiga = ctx.eval('__result') or None
                 except Exception as e:
                     logger.debug(f'websectiga jsvmp execution failed: {e}')
+        elif jsvmp_code:
+            logger.warning('remote JavaScript execution is disabled; set XHS_ALLOW_REMOTE_JS_EXECUTION=1 only in an isolated environment')
     except Exception as e:
         logger.debug(f'fetch sec cookies failed: {e}')
     return sec_poison_id, websectiga