{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"xbzbing-dsh-auth-gateway","slug":"xbzbing-dsh-auth-gateway","rank":547,"url":"https://github.com/xbzbing/dsh-auth-gateway","name":"xbzbing/dsh-auth-gateway","category":"security","description":{"zh":"为 dsh web 提供密码与 TOTP 双因素认证网关：登录前拦截全部 HTTP/WebSocket 请求，含按来源锁定、全局限流与一次性备份代码。","en":"Password + TOTP two-factor authentication gateway for the dsh web UI: every HTTP request and WebSocket upgrade is refused until login, with per-source lockout, global rate limits and one-time backup codes."},"stars":5,"starsCheckedAt":"2026-08-21","repository":{"owner":"xbzbing","repo":"dsh-auth-gateway","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:xbzbing/dsh-auth-gateway","tarball":null,"added":"2026-08-17","page":"https://awesome-dsh-plugin.com/p/xbzbing/dsh-auth-gateway/","screenshots":["https://raw.githubusercontent.com/xbzbing/dsh-auth-gateway/main/docs/assets/onboarding.png","https://raw.githubusercontent.com/xbzbing/dsh-auth-gateway/main/docs/assets/login.png","https://raw.githubusercontent.com/xbzbing/dsh-auth-gateway/main/docs/assets/login-success.png","https://raw.githubusercontent.com/xbzbing/dsh-auth-gateway/main/docs/assets/otp-setup.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"xbzbing-dsh-auth-gateway","slug":"xbzbing-dsh-auth-gateway","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:26:02.145Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"c406fd4868d03cd0565d60e6d4ff71bc90f7b999","commitDate":"2026-08-22T02:40:33+08:00","artifactDigest":"sha256:7a6da1bac3c1f458c6653b28917097391389ac6e20ecd6e543f72be89c212610","downloadUrl":"https://github.com/xbzbing/dsh-auth-gateway/archive/c406fd4868d03cd0565d60e6d4ff71bc90f7b999.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:xbzbing/dsh-auth-gateway","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-auth-gateway","packageVersion":"0.5.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-client-ui-settings"]},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-auth-gateway","nameMatch":null,"npm":{"name":"dsh-auth-gateway","latestVersion":"0.4.2","publishedAt":"2026-08-20T10:08:45.601Z","createdAt":"2026-08-17T08:27:09.368Z","versionCount":6,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-auth-gateway","name":"dsh-auth-gateway","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"webserver","tier":"normal","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["host","port"],"path":"cordis.patch.yml"},{"id":"web-runtime","tier":"normal","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["printUrl","surfaceContext","trustedHosts"],"path":"cordis.patch.yml"}],"jsExpressions":4,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"low","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":22,"evidence":"!!js (ctx.webStartup.port ?? 3080) + 1","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","hash":"003d921473b1bde59d494cce"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"low","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":33,"evidence":"!!js ctx.webStartup.trustedHosts","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","hash":"0e864ae6db4e19676c02baa9"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"lib/login-page.js","pathClass":"source","line":203,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"5254bca487ddd6f3db95b2fa"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/client-contract.test.mjs","pathClass":"test-example-docs","line":45,"evidence":"vm.runInContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"05e4572c2fb86813bae3807f"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/patch-ports.test.mjs","pathClass":"test-example-docs","line":38,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"c0a0a0aa84ea5fdbd3b8a943"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/plugin-contract.test.mjs","pathClass":"test-example-docs","line":90,"evidence":"vm.runInContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"6f3b3ade075982181b7b1dc3"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/plugin-contract.test.mjs","pathClass":"test-example-docs","line":91,"evidence":"vm.runInContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"6f3b3ade075982181b7b1dc3"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"high","confidence":"low","layer":"static","path":"scripts/screenshots.mjs","pathClass":"source","line":21,"evidence":"credential access at line 21 + outbound network at line 130","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"0302635d40875f77eb171a8e","review":{"verdict":"placeholder","reason":"PASSWORD默认值'DemoPass!1'是README截图脚本的演示占位密码，仅用于本地开发环境(BASE=127.0.0.1:8002)登录测试，未随插件分发(不在package.json files列表)，不构成凭据外泄风险。","model":"sonnet","reviewedAt":"2026-08-22T08:26:02.145Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":2},"rawCounts":{"critical":0,"high":5,"medium":1,"low":2},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":57,"bytesScanned":578231,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":15,"source":27,"cordis":1,"data":1,"manifest":1,"script":2,"test-example-docs":10}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:26:02.145Z","summary":"该脚本scripts/screenshots.mjs是开发辅助工具，用于给README生成截图，使用固定演示密码登录本地(127.0.0.1)的调试实例，不属于插件运行时代码也未打包进npm files，与插件声明的认证网关功能无直接关系，判定为占位/开发用途，无实际风险。","intentMatch":"consistent","findingsReviewed":1,"findingsCandidates":1,"fromCache":0,"usage":{"inputTokens":2,"outputTokens":495,"costUsd":0.019368,"durationMs":9144}}},"timeline":[{"scannedAt":"2026-08-22T08:26:02.145Z","commit":"c406fd4868d03cd0565d60e6d4ff71bc90f7b999","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:27:26.685Z","commit":"59a793d0b3d471d1b3216a768d87d554a2772829","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:56:23.488Z","commit":"362d0495a117e2ceaf0946e91217d097b1108d23","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"c406fd4868d03cd0565d60e6d4ff71bc90f7b999","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:26:02.145Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"59a793d0b3d471d1b3216a768d87d554a2772829","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:27:26.685Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"362d0495a117e2ceaf0946e91217d097b1108d23","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:56:23.488Z"}]}