refactor(captcha): вынести inject.js из Go и убрать легаси image-капчу

This commit is contained in:
samosvalishe
2026-07-08 00:49:19 +03:00
parent adcf0a0d21
commit ea1cb930cc
7 changed files with 183 additions and 266 deletions
@@ -11,7 +11,6 @@ type Error struct {
ErrorCode int
ErrorMsg string
CaptchaSid string
CaptchaImg string
RedirectURI string
IsSoundCaptchaAvailable bool
SessionToken string
@@ -42,8 +41,6 @@ func ParseError(errData map[string]any) *Error {
}
}
captchaImg, _ := errData["captcha_img"].(string)
errorMsg, ok := errData["error_msg"].(string)
if !ok {
Log.Warnf("[Captcha] missing error_msg in error data")
@@ -88,7 +85,6 @@ func ParseError(errData map[string]any) *Error {
ErrorCode: code,
ErrorMsg: errorMsg,
CaptchaSid: captchaSid,
CaptchaImg: captchaImg,
RedirectURI: redirectURI,
IsSoundCaptchaAvailable: isSound,
SessionToken: sessionToken,
@@ -0,0 +1,154 @@
(() => {
'use strict';
const { local: LOCAL, upstream: UPSTREAM } = window.__ftpCaptcha ?? {};
const PROXY = '/generic_proxy?proxy_url=';
const RESULT = '/local-captcha-result';
const CHECK = 'captchaNotRobot.check';
function rewriteUrl(url) {
if (!url || typeof url !== 'string') return url;
if (url.startsWith(LOCAL)) return url;
if (url.startsWith(UPSTREAM)) return LOCAL + url.slice(UPSTREAM.length);
if (url.startsWith('//')) return PROXY + encodeURIComponent(location.protocol + url);
if (url.startsWith('http://') || url.startsWith('https://')) return PROXY + encodeURIComponent(url);
return url;
}
function rewriteAttr(el, attr) {
const value = el.getAttribute?.(attr);
if (!value) return;
const rewritten = rewriteUrl(value);
if (rewritten !== value) el.setAttribute(attr, rewritten);
}
function rewriteTree(root) {
if (!root.querySelectorAll) return;
for (const attr of ['href', 'src', 'action']) {
root.querySelectorAll(`[${attr}]`).forEach((el) => rewriteAttr(el, attr));
}
}
const extractToken = (data) => data?.response?.success_token;
function sendToken(token) {
if (!token) return;
const body = `token=${encodeURIComponent(token)}`;
// sendBeacon переживает уход со страницы (mobile Safari)
if (navigator.sendBeacon?.(RESULT, new Blob([body], { type: 'application/x-www-form-urlencoded' }))) {
showDone();
return;
}
fetch(RESULT, {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body,
}).then(showDone).catch(() => {
const form = document.createElement('form');
form.method = 'POST';
form.action = RESULT;
const input = document.createElement('input');
input.type = 'hidden';
input.name = 'token';
input.value = token;
form.append(input);
document.body.append(form);
form.submit();
});
}
function showPending() {
document.body.style.background = '#000';
const banner = document.createElement('div');
banner.textContent = 'free turn proxy - captcha';
banner.style.cssText = 'position:fixed;top:0;left:0;right:0;z-index:99999;padding:12px;text-align:center;font:13.5px ui-monospace,monospace;color:#e1e1e1;background:#000';
document.body.append(banner);
}
function showDone() {
document.body.style.background = '#000';
document.body.innerHTML =
'<div style="min-height:100vh;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;font-family:ui-monospace,monospace;text-align:center">' +
'<div style="font-size:16.5px;font-weight:700;color:#e1e1e1">free turn proxy</div>' +
'<div style="font-size:13.5px;color:#818181">gg</div></div>';
setTimeout(() => window.close(), 1000);
}
const xhrOpen = XMLHttpRequest.prototype.open;
XMLHttpRequest.prototype.open = function (...args) {
if (typeof args[1] === 'string') {
this._origUrl = args[1];
args[1] = rewriteUrl(args[1]);
}
return xhrOpen.apply(this, args);
};
const xhrSend = XMLHttpRequest.prototype.send;
XMLHttpRequest.prototype.send = function (...args) {
if (this._origUrl?.includes(CHECK)) {
this.addEventListener('load', () => {
try { sendToken(extractToken(JSON.parse(this.responseText))); } catch {}
});
}
return xhrSend.apply(this, args);
};
const origFetch = window.fetch;
window.fetch = function (...args) {
const urlStr = typeof args[0] === 'object' ? args[0]?.url : args[0];
if (typeof args[0] === 'string') args[0] = rewriteUrl(args[0]);
const promise = origFetch.apply(this, args);
if (typeof urlStr === 'string' && urlStr.includes(CHECK)) {
promise
.then((res) => res.clone().json())
.then((data) => sendToken(extractToken(data)))
.catch(() => {});
}
return promise;
};
document.addEventListener('submit', (event) => {
if (event.target?.action) event.target.action = rewriteUrl(event.target.action);
}, true);
document.addEventListener('click', (event) => {
const link = event.target?.closest?.('a[href]');
if (link?.href) link.href = rewriteUrl(link.href);
}, true);
const formSubmit = HTMLFormElement.prototype.submit;
HTMLFormElement.prototype.submit = function (...args) {
if (this.action) this.action = rewriteUrl(this.action);
return formSubmit.apply(this, args);
};
const windowOpen = window.open;
window.open = function (...args) {
if (typeof args[0] === 'string') args[0] = rewriteUrl(args[0]);
return windowOpen.apply(this, args);
};
rewriteTree(document);
new MutationObserver((mutations) => {
for (const { type, target, attributeName, addedNodes } of mutations) {
if (type === 'attributes') {
rewriteAttr(target, attributeName);
continue;
}
for (const node of addedNodes) {
if (node.nodeType === 1) rewriteTree(node);
}
}
}).observe(document.documentElement, {
subtree: true,
childList: true,
attributes: true,
attributeFilter: ['href', 'src', 'action'],
});
if (document.body) showPending();
else document.addEventListener('DOMContentLoaded', showPending);
})();
@@ -9,10 +9,10 @@ import (
"bytes"
"compress/gzip"
"context"
_ "embed"
"encoding/json"
"errors"
"fmt"
"html"
"io"
"net"
"net/http"
@@ -42,6 +42,16 @@ func SetLogger(l logx.Logger) { Log = logx.OrNop(l) }
const captchaListenPort = "8765"
//go:embed inject.js
var injectJS string
// injectScriptTag: конфиг отдельной строкой (json.Marshal экранирует, включая "<"),
// сам inject.js статичный, без плейсхолдеров.
func injectScriptTag(localOrigin, upstreamOrigin string) string {
cfg, _ := json.Marshal(map[string]string{"local": localOrigin, "upstream": upstreamOrigin})
return "\n<script>window.__ftpCaptcha=" + string(cfg) + ";</script>\n<script>\n" + injectJS + "</script>\n"
}
type browserCommand struct {
name string
args []string
@@ -296,199 +306,7 @@ func rewriteCaptchaHTML(html string, targetURL *neturl.URL) string {
// сразу при парсинге HTML - раньше любых инжектированных JS-перехватов.
html = rewriteHTMLAttrsServerSide(html, targetURL)
script := fmt.Sprintf(`
<script>
(function() {
var localOrigin = %q;
var upstreamOrigin = %q;
function rewriteUrl(urlStr) {
if (!urlStr || typeof urlStr !== 'string') return urlStr;
if (urlStr.indexOf(localOrigin) === 0) return urlStr;
if (urlStr.indexOf(upstreamOrigin) === 0) return localOrigin + urlStr.slice(upstreamOrigin.length);
if (urlStr.indexOf('//') === 0) {
return '/generic_proxy?proxy_url=' + encodeURIComponent(window.location.protocol + urlStr);
}
if (urlStr.indexOf('http://') === 0 || urlStr.indexOf('https://') === 0) {
return '/generic_proxy?proxy_url=' + encodeURIComponent(urlStr);
}
return urlStr;
}
function rewriteElementAttr(el, attr) {
if (!el || !el.getAttribute) return;
var value = el.getAttribute(attr);
if (!value) return;
var rewritten = rewriteUrl(value);
if (rewritten !== value) {
el.setAttribute(attr, rewritten);
}
}
function rewriteDocument(root) {
if (!root || !root.querySelectorAll) return;
root.querySelectorAll('[href]').forEach(function(el) { rewriteElementAttr(el, 'href'); });
root.querySelectorAll('[src]').forEach(function(el) { rewriteElementAttr(el, 'src'); });
root.querySelectorAll('form[action]').forEach(function(el) { rewriteElementAttr(el, 'action'); });
}
function handleSuccessToken(token) {
if (!token) return;
console.log('Captcha solved, sending token to proxy...');
var body = 'token=' + encodeURIComponent(token);
// sendBeacon is the most reliable on mobile Safari:
// it's fire-and-forget and works even if the page navigates away.
if (navigator && navigator.sendBeacon) {
var blob = new Blob([body], {type: 'application/x-www-form-urlencoded'});
var sent = navigator.sendBeacon('/local-captcha-result', blob);
if (sent) {
console.log('Token sent via sendBeacon');
showDone();
return;
}
}
// Fallback: fetch
fetch('/local-captcha-result', {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: body
}).then(function(r) {
console.log('Proxy acknowledged token');
showDone();
}).catch(function(e) {
console.error('Fetch failed, trying form submit...', e);
// Last resort: form POST (navigates the page)
var form = document.createElement('form');
form.method = 'POST';
form.action = '/local-captcha-result';
var input = document.createElement('input');
input.type = 'hidden';
input.name = 'token';
input.value = token;
form.appendChild(input);
document.body.appendChild(form);
form.submit();
});
}
function showDone() {
document.body.innerHTML = '<div style="text-align:center;margin-top:20vh;font-family:sans-serif">' +
'<h2 style="color:#4caf50">✔ Done!</h2>' +
'<p>Captcha solved successfully. You can close this tab now.</p>' +
'</div>';
// On iOS, window.close() often doesn't work, so we just let the user know they are done.
setTimeout(function() { window.close(); }, 1000);
}
var origOpen = XMLHttpRequest.prototype.open;
XMLHttpRequest.prototype.open = function() {
if (arguments[1] && typeof arguments[1] === 'string') {
this._origUrl = arguments[1];
arguments[1] = rewriteUrl(arguments[1]);
}
return origOpen.apply(this, arguments);
};
var origSend = XMLHttpRequest.prototype.send;
XMLHttpRequest.prototype.send = function() {
var xhr = this;
if (this._origUrl && this._origUrl.indexOf('captchaNotRobot.check') !== -1) {
xhr.addEventListener('load', function() {
try {
var data = JSON.parse(xhr.responseText);
if (data.response && data.response.success_token) {
handleSuccessToken(data.response.success_token);
}
} catch (e) {}
});
}
return origSend.apply(this, arguments);
};
var origFetch = window.fetch;
if (origFetch) {
window.fetch = function() {
var url = arguments[0];
var isObj = (typeof url === 'object' && url && url.url);
var urlStr = isObj ? url.url : url;
var origUrlStr = urlStr;
if (typeof urlStr === 'string') {
urlStr = rewriteUrl(urlStr);
arguments[0] = urlStr;
}
var p = origFetch.apply(this, arguments);
if (typeof origUrlStr === 'string' && origUrlStr.indexOf('captchaNotRobot.check') !== -1) {
p.then(function(response) {
return response.clone().json();
}).then(function(data) {
if (data.response && data.response.success_token) {
handleSuccessToken(data.response.success_token);
}
}).catch(function() {});
}
return p;
};
}
document.addEventListener('submit', function(event) {
if (event.target && event.target.action) {
event.target.action = rewriteUrl(event.target.action);
}
}, true);
document.addEventListener('click', function(event) {
var target = event.target && event.target.closest ? event.target.closest('a[href]') : null;
if (target && target.href) {
target.href = rewriteUrl(target.href);
}
}, true);
var origFormSubmit = HTMLFormElement.prototype.submit;
HTMLFormElement.prototype.submit = function() {
if (this.action) {
this.action = rewriteUrl(this.action);
}
return origFormSubmit.apply(this, arguments);
};
var origWindowOpen = window.open;
if (origWindowOpen) {
window.open = function(url) {
if (typeof url === 'string') {
arguments[0] = rewriteUrl(url);
}
return origWindowOpen.apply(this, arguments);
};
}
rewriteDocument(document);
if (document.documentElement && window.MutationObserver) {
new MutationObserver(function(mutations) {
mutations.forEach(function(mutation) {
if (mutation.type === 'attributes' && mutation.target) {
rewriteElementAttr(mutation.target, mutation.attributeName);
return;
}
mutation.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
rewriteDocument(node);
}
});
});
}).observe(document.documentElement, {
subtree: true,
childList: true,
attributes: true,
attributeFilter: ['href', 'src', 'action']
});
}
})();
</script>
`, localOrigin, upstreamOrigin)
script := injectScriptTag(localOrigin, upstreamOrigin)
// Шаг 3: инжектируем клиентский скрипт как можно раньше - после <head>,
// чтобы XHR/fetch-перехваты были активны до любого inline <script> в <head>.
@@ -592,39 +410,6 @@ func notifyKey(keyCh chan<- string, key string) {
}
}
// SolveViaHTTP отдаёт минимальную HTML-страницу для решения картинки CAPTCHA,
// открывает её в браузере и блокируется до прихода ключа.
func SolveViaHTTP(ctx context.Context, captchaImg string) (string, error) {
keyCh := make(chan string, 1)
mux := http.NewServeMux()
mux.HandleFunc("/", func(w http.ResponseWriter, _ *http.Request) {
w.Header().Set("Content-Type", "text/html; charset=utf-8")
_, _ = fmt.Fprintf(w, `<!DOCTYPE html>
<html><head>
<meta name="viewport" content="width=device-width,initial-scale=1">
<style>body{font-family:sans-serif;text-align:center;padding:20px}
img{max-width:100%%;margin:16px 0}
input{font-size:24px;padding:12px;width:80%%;box-sizing:border-box}
button{font-size:24px;padding:12px 32px;margin-top:12px;cursor:pointer}</style>
</head><body>
<h2>Solve the Captcha</h2>
<img src="%s" alt="captcha"/>
<form onsubmit="fetch('/solve?key='+encodeURIComponent(document.getElementById('k').value)).then(()=>{document.body.innerHTML='<h2>Done!</h2>';setTimeout(function(){window.close();}, 300);});return false;">
<br><input id="k" type="text" autofocus placeholder="Text from image"/>
<br><button type="submit">Submit</button>
</form></body></html>`, captchaImg)
})
mux.HandleFunc("/solve", func(w http.ResponseWriter, r *http.Request) {
notifyKey(keyCh, r.URL.Query().Get("key"))
w.Header().Set("Content-Type", "text/html; charset=utf-8")
_, _ = fmt.Fprint(w, `<!DOCTYPE html><html><body><h2>Done!</h2></body></html>`)
})
return runCaptchaServerAndWait(ctx, mux, localCaptchaOrigin(), keyCh, "captcha HTTP server error", openBrowser)
}
type loggingTransport struct {
rt http.RoundTripper
}
@@ -711,10 +496,9 @@ func solveViaProxy(ctx context.Context, redirectURI string, dialer net.Dialer, p
},
ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
Log.Errorf("[Captcha Proxy] %s %s: %v", r.Method, r.URL.String(), err)
w.Header().Set("Content-Type", "text/html; charset=utf-8")
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
w.WriteHeader(http.StatusBadGateway)
_, _ = fmt.Fprintf(w, `<!DOCTYPE html><html><body style="font-family:sans-serif;padding:20px"><h2>Captcha proxy error</h2><p>%s %s</p><p>%s</p></body></html>`,
html.EscapeString(r.Method), html.EscapeString(r.URL.String()), html.EscapeString(err.Error()))
_, _ = fmt.Fprintf(w, "ошибка прокси капчи: %s %s: %v", r.Method, r.URL.String(), err)
},
ModifyResponse: func(res *http.Response) error {
rewriteProxyCookies(res.Header)
@@ -54,11 +54,9 @@ type AutoSolveFunc func(
profile browserprofile.Profile,
) (token string, err error)
// ManualSolveFunc открывает локальный браузерный fallback. Возвращает либо
// success_token (token != ""), либо captcha_key - в зависимости от пути
// ошибки VK.
// ManualSolveFunc открывает локальный браузерный fallback и возвращает success_token.
type ManualSolveFunc func(
ctx context.Context,
captchaErr *captcha.Error,
dialer net.Dialer,
) (token, key string, err error)
) (token string, err error)
@@ -127,7 +127,6 @@ func (c *Client) solveCaptcha(
}
var successToken string
var captchaKey string
var solveErr error
switch solveMode {
@@ -158,21 +157,19 @@ func (c *Client) solveCaptcha(
type manualRes struct {
token string
key string
err error
}
resCh := make(chan manualRes, 1)
go func() {
t, k, e := c.manualSolve(manualCtx, captchaErr, c.dialer)
resCh <- manualRes{t, k, e}
t, e := c.manualSolve(manualCtx, captchaErr, c.dialer)
resCh <- manualRes{t, e}
}()
select {
case res := <-resCh:
successToken = res.token
captchaKey = res.key
solveErr = res.err
if successToken != "" || captchaKey != "" {
if successToken != "" {
if solveErr != nil {
c.log.Debugf("[STREAM %d] [Captcha] Token received (ignoring cleanup error: %v)", streamID, solveErr)
solveErr = nil
@@ -198,7 +195,7 @@ func (c *Client) solveCaptcha(
if hasNextSolveMode {
c.log.Infof("[STREAM %d] [Captcha] Falling back to %s",
streamID, CaptchaSolveModeLabel(nextSolveMode))
return buildCaptchaRetryData(link, escapedName, token1, captchaErr, "", captchaKey), nil
return buildCaptchaRetryData(link, escapedName, token1, captchaErr, ""), nil
}
c.engageLockout(60 * time.Second)
if c.streamsFn() == 0 {
@@ -211,23 +208,17 @@ func (c *Client) solveCaptcha(
if captchaErr.CaptchaAttempt == "0" || captchaErr.CaptchaAttempt == "" {
captchaErr.CaptchaAttempt = "1"
}
return buildCaptchaRetryData(link, escapedName, token1, captchaErr, successToken, captchaKey), nil
return buildCaptchaRetryData(link, escapedName, token1, captchaErr, successToken), nil
}
// buildCaptchaRetryData формирует тело POST для следующей попытки captcha.
func buildCaptchaRetryData(link, escapedName, token1 string, captchaErr *captcha.Error, successToken, captchaKey string) string {
func buildCaptchaRetryData(link, escapedName, token1 string, captchaErr *captcha.Error, successToken string) string {
if captchaErr.CaptchaSid == "" {
return fmt.Sprintf(
"vk_join_link=https://vk.ru/call/join/%s&name=%s&success_token=%s&access_token=%s",
link, escapedName, neturl.QueryEscape(successToken), token1,
)
}
if captchaKey != "" {
return fmt.Sprintf(
"vk_join_link=https://vk.ru/call/join/%s&name=%s&captcha_key=%s&captcha_sid=%s&access_token=%s",
link, escapedName, neturl.QueryEscape(captchaKey), captchaErr.CaptchaSid, token1,
)
}
return fmt.Sprintf(
"vk_join_link=https://vk.ru/call/join/%s&name=%s&captcha_key=&captcha_sid=%s&is_sound_captcha=0&success_token=%s&captcha_ts=%s&captcha_attempt=%s&access_token=%s",
link, escapedName, captchaErr.CaptchaSid, neturl.QueryEscape(successToken),
+3 -4
View File
@@ -14,9 +14,9 @@ var proxyManualMu sync.Mutex
// ProxyManualSolver показывает UI после запуска локального captcha-прокси.
func ProxyManualSolver(show func(url string), hide func()) ManualSolverFunc {
return func(ctx context.Context, e *captcha.Error, dialer net.Dialer) (string, string, error) {
return func(ctx context.Context, e *captcha.Error, dialer net.Dialer) (string, error) {
if e.RedirectURI == "" {
return "", "", fmt.Errorf("manual captcha: no redirect_uri")
return "", fmt.Errorf("manual captcha: no redirect_uri")
}
proxyManualMu.Lock()
@@ -25,7 +25,6 @@ func ProxyManualSolver(show func(url string), hide func()) ManualSolverFunc {
defer hide()
}
token, err := manualcaptcha.SolveViaProxyWithPresenter(ctx, e.RedirectURI, dialer, show)
return token, "", err
return manualcaptcha.SolveViaProxyWithPresenter(ctx, e.RedirectURI, dialer, show)
}
}
+4 -9
View File
@@ -113,14 +113,9 @@ func (*Provider) Name() string { return "vk" }
// DefaultManualSolver - стандартный manual-captcha solver, использует
// internal/provider/vk/internal/captcha/manual (HTTP-сервер 127.0.0.1:8765 + браузер).
func DefaultManualSolver(ctx context.Context, e *captcha.Error, d net.Dialer) (string, string, error) {
if e.RedirectURI != "" {
t, err := manualcaptcha.SolveViaProxy(ctx, e.RedirectURI, d)
return t, "", err
func DefaultManualSolver(ctx context.Context, e *captcha.Error, d net.Dialer) (string, error) {
if e.RedirectURI == "" {
return "", fmt.Errorf("no redirect_uri")
}
if e.CaptchaImg != "" {
k, err := manualcaptcha.SolveViaHTTP(ctx, e.CaptchaImg)
return "", k, err
}
return "", "", fmt.Errorf("no redirect_uri or captcha_img")
return manualcaptcha.SolveViaProxy(ctx, e.RedirectURI, d)
}