猫史档案馆

. 关于WEY用户数据库隐私问题

在2023年2月2日panda 工作室一名成员在12:00左右的时间发布了一个文章，内容大概为不要再用wey账号系统了！连用户的隐私安全都不能保证算什么好的账号系统！原文链接： https://shequ.codemao.cn/wiki/forum/524192 他们通过window上的浏览器F 12开发者模式来看到后台图片如下这个问题确实是我们工作的失误，但是经过一些查找，我们发现在10个月前就有人发现了该漏洞原文在此： https://shequ.codemao.cn/community/433144

主要内容如下：关于coco中的维格云字典

大家应该都很熟悉了但是他的安全性如何呢如果我们打包一个app，其中包含一个维格云字典。打包前：

打包后，我们反编译，一点一点找。在软件目录下的 \assets\www\ 文件夹下，有一个 entrypoint.js 这个文件的内容是：

(function () {

const runAppOptions = {"blockCode":"","blockJsonMap":{"SCREEN_TesVPgLYD":{"comments":{},"blocks":{},"connections":{}}},"iconFileMap":{},"variableMap":{},"version":1,"screenList":[{"backgroundColor":"#ffffffff","size":{"width":360,"height":喵0},"backgroundImageResizeMode":"cover","widgetIds":[],"backgroundImage":"","id":"SCREEN_TesVPgLYD","position":{"x":0,"y":0},"title":"屏幕","type":"SCREEN","invisibleWidgetIds":[]}],"extensionWidgetList":[{"cdnUrl":"https://static.codemao.cn/appcraft/extension-widgets/production/vika-tinydb.js","id":6,"type":"EXTENSION_VIKA_TINYDB_WIDGET"}],"initialScreenId":"SCREEN_TesVPgLYD","apiToken":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ3b3JrX2lkIjoiMTQwN喵2MzEzIiwidXNlcl9pZCI6IjQxOTE1N喵ifQ.ePtXqnme9mshzezyhPGkPZm0dIDFOeleiFIKrAwcLuQ","gridMap":{},"imageFileMap":{},"soundFileMap":{},"fontFileMap":{},"unsafeExtensionWidgetList":[],"widgetMap":{"EXTENSION_VIKA_TINYDB_WIDGET_m72hrMpRR":{"visible":true,"size":{"width":0,"height":0},"animationRecord":{},"attributes":{"datasheetId":"假如这是id","token":"假如这是token"},"id":"EXTENSION_VIKA_TINYDB_WIDGET_m72hrMpRR","position":{"x":115,"y":188},"isGlobalWidget":true,"title":"维格云字典","type":"EXTENSION_VIKA_TINYDB_WIDGET"}},"id":"140536313","x-coconut-authorization":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ3b3JrX2lkIjoiMTQwN喵2MzEzIiwidXNlcl9pZCI6IjQxOTE1N喵ifQ.ePtXqnme9mshzezyhPGkPZm0dIDFOeleiFIKrAwcLuQ"};

const envMeta = document.createElement('META');

envMeta.name = 'environment';

envMeta.content = "production";

document.head.appendChild(envMeta);

document.addEventListener('deviceready', start, false);

function start() {

setTimeout(() => {

window.postMessage({ type: 'run', options: runAppOptions }, '*');

});

}

})();

拉一拉，你是不是看到了这个: