Merge Release Into master

.gitignore

@@ -292,4 +292,4 @@ NeoWeb/CandidateBackgrounder/
 NeoWeb/validators.json
 NeoWeb/wwwroot/css/*.css
 SendGridTest/Program.cs
-.DS_Store
+.DS_Store

NeoWeb.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 16
-VisualStudioVersion = 16.0.29324.140
+# Visual Studio Version 17
+VisualStudioVersion = 17.8.3
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "NeoWeb", "NeoWeb\NeoWeb.csproj", "{EFDED9C5-0650-4FA2-B532-FCD2ADDCC7F9}"
 EndProject

NeoWeb/.editorconfig

@@ -1,10 +1,13 @@
-# 若要了解有关 .editorconfig 的详细信息，请参阅 https://aka.ms/editorconfigdocs
-root = true
-
-# All files
-[*]
-indent_style = space
-insert_final_newline = true
-trim_trailing_whitespace = true
-charset = utf-8
-end_of_line = lf
+# 若要了解有关 .editorconfig 的详细信息，请参阅 https://aka.ms/editorconfigdocs
+root = true
+
+# All files
+[*]
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+end_of_line = lf
+
+# SYSLIB1045: 转换为“GeneratedRegexAttribute”。
+dotnet_diagnostic.SYSLIB1045.severity = none

NeoWeb/CCAntiAttackMiddleware.cs

@@ -0,0 +1,82 @@
+using Microsoft.AspNetCore.Http;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace NeoWeb
+{
+    public class CCAntiAttackMiddleware(RequestDelegate next)
+    {
+        private readonly List<RequestItem> _requestList = [];
+        private readonly List<BlockItem> _blockList = [];
+
+        private const int MaxRequestsPerMinute = 10;
+        private const int BlockDurationMinutes = 10;
+
+        public async Task Invoke(HttpContext context)
+        {
+            var ipAddress = context.Connection.RemoteIpAddress?.ToString();
+            if (!string.IsNullOrEmpty(ipAddress) && System.IO.File.ReadAllLines("whitelist.txt").All(p => p != ipAddress))
+            {
+                CleanUpExpiredRequestsAndBlocks();
+
+                var block = _blockList.FirstOrDefault(p => p?.IP == ipAddress);
+                var requestsPerMinute = _requestList.Count(p => p?.IP == ipAddress);
+
+                if (block is not null)
+                {
+                    await HandleBlockedRequest(context, block);
+                    return;
+                }
+
+                if (requestsPerMinute > MaxRequestsPerMinute * 2 /*Request & Response*/)
+                {
+                    await HandleExceededRequestLimit(context, ipAddress);
+                    return;
+                }
+
+                _requestList.Add(new RequestItem { IP = ipAddress, DateTime = DateTime.UtcNow });
+            }
+
+            await next(context);
+        }
+
+        private void CleanUpExpiredRequestsAndBlocks()
+        {
+            var utcNow = DateTime.UtcNow;
+            _requestList.RemoveAll(p => p == null || p?.DateTime < utcNow.AddMinutes(-1));
+            _blockList.RemoveAll(p => p == null || p?.DateTime < utcNow);
+        }
+
+        private static async Task HandleBlockedRequest(HttpContext context, BlockItem block)
+        {
+            context.Response.StatusCode = 429; // Too Many Requests
+            context.Response.Headers.Append("Retry-After", block.DateTime.ToString("R"));
+            context.Response.ContentType = "text/html";
+            await context.Response.WriteAsync(string.Format(System.IO.File.ReadAllText("wwwroot/429.html"), (int)(block.DateTime - DateTime.UtcNow).TotalSeconds, block.IP, block.DateTime.ToString("R")));
+        }
+
+        private async Task HandleExceededRequestLimit(HttpContext context, string ipAddress)
+        {
+            var blockTime = DateTime.UtcNow.AddMinutes(BlockDurationMinutes);
+            _blockList.Add(new BlockItem { IP = ipAddress, DateTime = blockTime });
+            context.Response.StatusCode = 429; // Too Many Requests
+            context.Response.Headers.Append("Retry-After", blockTime.ToString("R"));
+            context.Response.ContentType = "text/html";
+            await context.Response.WriteAsync(string.Format(System.IO.File.ReadAllText("wwwroot/429.html"), (int)(blockTime - DateTime.UtcNow).TotalSeconds, ipAddress, blockTime.ToString("R")));
+        }
+    }
+
+    public class RequestItem
+    {
+        public string IP { get; set; }
+        public DateTime DateTime { get; set; } //访问时间
+    }
+
+    public class BlockItem
+    {
+        public string IP { get; set; }
+        public DateTime DateTime { get; set; } //阻止访问的截止时间
+    }
+}

NeoWeb/ClientIpCheckActionFilter.cs

@@ -0,0 +1,43 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using System.Linq;
+
+namespace NeoWeb
+{
+    public class ClientIpCheckActionFilter : ActionFilterAttribute
+    {
+        public ClientIpCheckActionFilter(string fileName)
+        {
+            if (Helper.Banlist.Count > 0) return;
+            var temp = System.IO.File.ReadAllLines(fileName).ToList();
+            foreach (var item in temp)
+            {
+                var start = item.Split('\t')[0].IPToInteger();
+                var end = item.Split('\t')[1].IPToInteger();
+                Helper.Banlist.Add(new IPZone(start, end));
+            }
+        }
+
+        public override void OnActionExecuting(ActionExecutingContext context)
+        {
+            var remoteIp = context.HttpContext.Connection.RemoteIpAddress;
+
+            remoteIp = remoteIp.IsIPv4MappedToIPv6 ? remoteIp.MapToIPv4() : remoteIp;
+            var ipInteger = remoteIp.IPToInteger();
+
+            if (Helper.Banlist.Any(p => ipInteger > p.Start && ipInteger < p.End))
+            {
+                context.Result = new ViewResult() { ViewName = "403", StatusCode = 403 };
+                return;
+            }
+
+            base.OnActionExecuting(context);
+        }
+    }
+
+    public class IPZone(long start, long end)
+    {
+        public long Start { get; set; } = start;
+        public long End { get; set; } = end;
+    }
+}

NeoWeb/Controllers/AboutController.cs

@@ -2,6 +2,7 @@
 
 namespace NeoWeb.Controllers
 {
+    [ServiceFilter(typeof(ClientIpCheckActionFilter))]
     public class AboutController : Controller
     {
         public IActionResult Index()

NeoWeb/Controllers/BlogController.cs

@@ -10,7 +10,6 @@
 using System.IO;
 using System.Linq;
 using System.Security.Claims;
-using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using System.Xml;
 
@@ -34,7 +33,6 @@ public BlogController(ApplicationDbContext context, IHttpContextAccessor httpCon
             if (_userId != null)
             {
                 _userRules = _context.UserRoles.Any(p => p.UserId == _userId);
-                var asfs = _context.UserRoles.Where(p => p.UserId == _userId).ToList();
             }
         }
 
@@ -57,10 +55,12 @@ public async Task<IActionResult> Details(int? id, string language = null)
             language = !string.IsNullOrEmpty(language) ? language : _sharedLocalizer["en"];
 
             #region Previous and  Next
+
             var idList = _context.Blogs.OrderByDescending(o => o.CreateTime).Select(p => p.Id).ToList();
-            ViewBag.NextBlogId = idList.Count == 0 ? id: idList[Math.Max(idList.IndexOf((int)id) - 1, 0)];
-            ViewBag.PrevBlogId = idList.Count == 0 ? id : idList[Math.Min(idList.IndexOf((int)id) + 1, idList.Count - 1)];
-            #endregion
+            ViewBag.NextBlogId = idList.Count == 0 ? id : idList[Math.Max(idList.IndexOf((int)id) - 1, 0)];
+            ViewBag.PrevBlogId = idList.Count == 0 ? id : idList[Math.Min(idList.IndexOf((int)id) + 1, idList.Count - 1)];
+
+            #endregion Previous and  Next
 
             ViewBag.UserRules = _userRules;
 
@@ -92,24 +92,38 @@ public async Task<IActionResult> Create(
             {
                 if (chineseCover != null)
                 {
-                    var fileName = Helper.UploadMedia(chineseCover, _env, 1000);
-                    if (Helper.ValidateCover(_env, fileName))
-                        blog.ChineseCover = fileName;
-                    else
-                        ModelState.AddModelError("ChineseCover", "Cover size must be 16:9.");
+                    try
+                    {
+                        var fileName = Helper.UploadMedia(chineseCover, _env, 1000);
+                        if (Helper.ValidateCover(_env, fileName))
+                            blog.ChineseCover = fileName;
+                        else
+                            ModelState.AddModelError("ChineseCover", "Cover size must be 16:9.");
+                    }
+                    catch (ArgumentException)
+                    {
+                        ModelState.AddModelError("ChineseCover", "Image files exceeding 10MB or in an unsupported format.");
+                    }
                 }
                 if (englishCover != null)
                 {
-                    var fileName = Helper.UploadMedia(englishCover, _env, 1000);
-                    if (Helper.ValidateCover(_env, fileName))
-                        blog.EnglishCover = fileName;
-                    else
-                        ModelState.AddModelError("EnglishCover", "Cover size must be 16:9.");
+                    try
+                    {
+                        var fileName = Helper.UploadMedia(englishCover, _env, 1000);
+                        if (Helper.ValidateCover(_env, fileName))
+                            blog.EnglishCover = fileName;
+                        else
+                            ModelState.AddModelError("EnglishCover", "Cover size must be 16:9.");
+                    }
+                    catch (ArgumentException)
+                    {
+                        ModelState.AddModelError("EnglishCover", "Image files exceeding 10MB or in an unsupported format.");
+                    }
                 }
-                if(!ModelState.IsValid) return View(blog);
+                if (!ModelState.IsValid) return View(blog);
 
-                blog.ChineseContent = Convert(blog.ChineseContent);
-                blog.EnglishContent = Convert(blog.EnglishContent);
+                blog.ChineseContent = Helper.Sanitizer(blog.ChineseContent);
+                blog.EnglishContent = Helper.Sanitizer(blog.EnglishContent);
                 blog.ChineseSummary = blog.ChineseContent.ClearHtmlTag(150);
                 blog.EnglishSummary = blog.EnglishContent.ClearHtmlTag(150);
                 blog.ChineseTags = blog.ChineseTags?.Replace(", ", ",").Replace("，", ",").Replace("， ", ",");
@@ -130,7 +144,8 @@ public async Task<IActionResult> Create(
                 return RedirectToAction("index", "news", new { type = NewsViewModelType.Blog });
             }
             return View(blog);
-        }
+        }
+
         // GET: blog/edit/5
         public IActionResult Edit(int? id)
         {
@@ -164,37 +179,51 @@ public async Task<IActionResult> Edit(
                 var item = _context.Blogs.FirstOrDefault(p => p.Id == blog.Id);
                 if (chineseCover != null)
                 {
-                    var fileName = Helper.UploadMedia(chineseCover, _env, 1000);
-                    if (Helper.ValidateCover(_env, fileName))
+                    try
                     {
-                        if (!string.IsNullOrEmpty(blog.ChineseCover))
-                            System.IO.File.Delete(Path.Combine(_env.ContentRootPath, "wwwroot/upload", blog.ChineseCover));
-                        item.ChineseCover = fileName;
+                        var fileName = Helper.UploadMedia(chineseCover, _env, 1000);
+                        if (Helper.ValidateCover(_env, fileName))
+                        {
+                            if (!string.IsNullOrEmpty(blog.ChineseCover))
+                                System.IO.File.Delete(Path.Combine(_env.ContentRootPath, "wwwroot/upload", blog.ChineseCover));
+                            item.ChineseCover = fileName;
+                        }
+                        else
+                        {
+                            ModelState.AddModelError("ChineseCover", "Cover size must be 16:9");
+                        }
                     }
-                    else
+                    catch (ArgumentException)
                     {
-                        ModelState.AddModelError("ChineseCover", "Cover size must be 16:9");
+                        ModelState.AddModelError("ChineseCover", "Image files exceeding 10MB or in an unsupported format.");
                     }
                 }
                 if (englishCover != null)
                 {
-                    var fileName = Helper.UploadMedia(englishCover, _env, 1000);
-                    if (Helper.ValidateCover(_env, fileName))
+                    try
                     {
-                        if (!string.IsNullOrEmpty(blog.EnglishCover))
-                            System.IO.File.Delete(Path.Combine(_env.ContentRootPath, "wwwroot/upload", blog.EnglishCover));
-                        item.EnglishCover = fileName;
+                        var fileName = Helper.UploadMedia(englishCover, _env, 1000);
+                        if (Helper.ValidateCover(_env, fileName))
+                        {
+                            if (!string.IsNullOrEmpty(blog.EnglishCover))
+                                System.IO.File.Delete(Path.Combine(_env.ContentRootPath, "wwwroot/upload", blog.EnglishCover));
+                            item.EnglishCover = fileName;
+                        }
+                        else
+                        {
+                            ModelState.AddModelError("EnglishCover", "Cover size must be 16:9");
+                        }
                     }
-                    else
+                    catch (ArgumentException)
                     {
-                        ModelState.AddModelError("EnglishCover", "Cover size must be 16:9");
+                        ModelState.AddModelError("EnglishCover", "Image files exceeding 10MB or in an unsupported format.");
                     }
                 }
                 if (!ModelState.IsValid) return View(blog);
                 try
                 {
-                    item.ChineseContent = Convert(blog.ChineseContent);
-                    item.EnglishContent = Convert(blog.EnglishContent);
+                    item.ChineseContent = Helper.Sanitizer(blog.ChineseContent);
+                    item.EnglishContent = Helper.Sanitizer(blog.EnglishContent);
                     item.ChineseSummary = blog.ChineseContent.ClearHtmlTag(150);
                     item.EnglishSummary = blog.EnglishContent.ClearHtmlTag(150);
                     item.ChineseTags = blog.ChineseTags?.Replace(", ", ",").Replace("，", ",").Replace("， ", ",");
@@ -204,7 +233,7 @@ public async Task<IActionResult> Edit(
                     item.Editor = blog.Editor;
                     item.EditTime = DateTime.Now;
                     item.IsShow = blog.IsShow;
-                    
+
                     _context.Update(item);
                     if (isTop != null)
                     {
@@ -256,7 +285,8 @@ public async Task<IActionResult> DeleteConfirmed(int id)
             _context.Blogs.Remove(blog);
             await _context.SaveChangesAsync();
             return RedirectToAction("index", "news", new { type = NewsViewModelType.Blog });
-        }
+        }
+
         private async Task UpdateRSSAsync()
         {
             await Task.Run(() =>
@@ -332,8 +362,7 @@ private void UpdateRssChinese()
             }
             rss.AppendChild(channel);
             xml.AppendChild(rss);
-            RssModel.Chinese = xml.OuterXml;
-
+            RssModel.Chinese = xml.OuterXml;
         }
 
         private void UpdateRssEnglish()
@@ -441,17 +470,6 @@ private bool BlogExists(int id)
             return _context.Blogs.Any(e => e.Id == id);
         }
 
-        private static string Convert(string input)
-        {
-            input = Regex.Replace(input, @"<!\-\-\[if gte mso 9\]>[\s\S]*<!\[endif\]\-\->", ""); //删除 ms office 注解
-            input = Regex.Replace(input, "src=\".*/upload", "data-original=\"/upload"); //替换上传图片的链接
-            input = Regex.Replace(input, "<img src=", "<img data-original="); //替换外部图片的链接
-            input = Regex.Replace(input, @"<p>((&nbsp;\s)|(&nbsp;)|\s)+", "<p>"); //删除段首由空格造成的缩进
-            input = Regex.Replace(input, @"\sstyle="".*?""", ""); //删除 Style 样式
-            input = Regex.Replace(input, @"\sclass="".*?""", ""); //删除 Class 样式
-            return input;
-        }
-
         private static string XmlEncode(string input)
         {
             return input?.Replace(">", "&gt;").Replace("<", "&lt;").Replace("&", "&amp;").Replace("'", "&apos;").Replace("\"", "&quot;");