检测到 huisunan/epic4j 一共引入了9个开源组件，存在1个漏洞

漏洞标题：FasterXML jackson-databind 代码问题漏洞
缺陷组件：com.fasterxml.jackson.core:[email protected]
漏洞编号：CVE-2020-25649
漏洞描述：FasterXML jackson-databind是一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。
FasterXML Jackson Databind存在代码问题漏洞，攻击者可利用该漏洞可以将恶意的XML数据传输到FasterXML Jackson Databind，以读取文件、扫描站点或触发拒绝服务。
影响范围：[2.10.0, 2.10.5.1)
最小修复版本：2.10.5.1
缺陷组件引入路径：io.github.huisunan:[email protected]>io.github.fanyong920:[email protected]>com.fasterxml.jackson.core:[email protected]

另外还有几个漏洞，详细报告：https://mofeisec.com/jr?p=iea3f9

2022-03-25 17:53:36.992 INFO 445 --- [TaskScheduler-1] com.hsn.epic4j.notify.ConsoleNotify : success receive game:《DEMON'S TILT》
2022-03-25 17:53:37.037 INFO 445 --- [ctReadThread-41] c.r.j.transport.WebSocketTransport : Connection closed by us Code: 1000 Reason:

原因未知

使用epic4j（docker），显示登陆超时。网络环境为**电信，无代理。

启动命令：docker run -d -e EMAIL=[email protected] -e PASSWORD=xxxxxxxxx -e LOG_LEVEL=debug --name epic4j --restart=always huisunan/epic4j:latest

运行docker run -d -v ~/epic4j:/opt/epic4j/config --name myepic huisunan/epic4j:latest 命令docker不运行

挂在目录也改成自己自定义的了

相关日志：

2022-05-06 17:15:13.644 INFO 7 --- [ main] com.hsn.epic4j.Epic4jApplication : Starting Epic4jApplication v1.3.3 using Java 1.8.0_275 on 6e013483f750 with PID 7 (/opt/epic4j/epic4j.jar started by chrome in /opt/epic4j)
2022-05-06 17:15:13.650 DEBUG 7 --- [ main] com.hsn.epic4j.Epic4jApplication : Running with Spring Boot v2.6.2, Spring v5.3.14
2022-05-06 17:15:13.650 INFO 7 --- [ main] com.hsn.epic4j.Epic4jApplication : No active profile set, falling back to default profiles: default
2022-05-06 17:15:14.900 INFO 7 --- [ main] com.hsn.epic4j.Epic4jApplication : Started Epic4jApplication in 2.847 seconds (JVM running for 5.624)
2022-05-06 17:15:14.970 INFO 7 --- [ main] com.hsn.epic4j.start.BaseRunner : use cron:17 15 17 * * ?
2022-05-06 17:15:18.622 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.BaseRunner : https://store-site-backend-static.ak.epicgames.com/freeGamesPromotions?locale=zh-CN&country=CN&allowCountries=CN
2022-05-06 17:15:19.492 INFO 7 --- [TaskScheduler-1] com.hsn.epic4j.start.BaseRunner : start *@gmail.com work
2022-05-06 17:15:19.497 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.MainStart : driver data path :/opt/epic4j/./data/@gmail.com
2022-05-06 17:15:20.750 INFO 7 --- [ctReadThread-21] c.r.j.transport.WebSocketTransport : Websocket serverHandshake status: 101
2022-05-06 17:15:20.751 INFO 7 --- [TaskScheduler-1] c.r.j.core.browser.BrowserRunner : Connect to browser by websocket url: ws://127.0.0.1:34976/devtools/browser/6c89093c-8f60-48b6-b979-4da0b59a092b
2022-05-06 17:15:26.752 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.BaseRunner : needLogin:true
2022-05-06 17:15:26.752 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.PasswordLogin : login start
2022-05-06 17:15:46.284 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.util.PageUtil : ignore exception

java.lang.RuntimeException: com.ruiyun.jvppeteer.exception.ProtocolException: Protocol error : "Cannot find context with specified id"
at com.ruiyun.jvppeteer.core.page.ExecutionContext.evaluateInternal(ExecutionContext.java:119) ~[jvppeteer-1.1.4.jar!/:na]
at com.ruiyun.jvppeteer.core.page.ExecutionContext.evaluateHandle(ExecutionContext.java:65) ~[jvppeteer-1.1.4.jar!/:na]
at com.ruiyun.jvppeteer.core.page.JSHandle.evaluateHandle(JSHandle.java:50) ~[jvppeteer-1.1.4.jar!/:na]
at com.ruiyun.jvppeteer.core.page.ElementHandle.$(ElementHandle.java:238) ~[jvppeteer-1.1.4.jar!/:na]
at com.ruiyun.jvppeteer.core.page.DOMWorld.$(DOMWorld.java:139) ~[jvppeteer-1.1.4.jar!/:na]
at com.ruiyun.jvppeteer.core.page.Frame.$(Frame.java:102) ~[jvppeteer-1.1.4.jar!/:na]
at com.ruiyun.jvppeteer.core.page.Page.$(Page.java:535) ~[jvppeteer-1.1.4.jar!/:na]
at com.hsn.epic4j.bean.SelectItem.lambda$new$0(SelectItem.java:25) ~[classes!/:1.3.3]
at com.hsn.epic4j.util.PageUtil.lambda$findSelectors$0(PageUtil.java:68) ~[classes!/:1.3.3]
at com.hsn.epic4j.util.PageUtil.timer(PageUtil.java:132) ~[classes!/:1.3.3]
at com.hsn.epic4j.util.PageUtil.findSelectors(PageUtil.java:64) ~[classes!/:1.3.3]
at com.hsn.epic4j.start.PasswordLogin.login(PasswordLogin.java:41) ~[classes!/:1.3.3]
at com.hsn.epic4j.start.BaseRunner.doStart(BaseRunner.java:164) ~[classes!/:1.3.3]
at com.hsn.epic4j.start.BaseRunner.start(BaseRunner.java:128) ~[classes!/:1.3.3]
at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54) ~[spring-context-5.3.14.jar!/:5.3.14]
at org.springframework.scheduling.concurrent.ReschedulingRunnable.run(ReschedulingRunnable.java:95) ~[spring-context-5.3.14.jar!/:5.3.14]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) ~[na:1.8.0_275]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[na:1.8.0_275]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) ~[na:1.8.0_275]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) ~[na:1.8.0_275]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_275]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_275]
at java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_275]
Caused by: com.ruiyun.jvppeteer.exception.ProtocolException: Protocol error : "Cannot find context with specified id"
at com.ruiyun.jvppeteer.transport.CDPSession.send(CDPSession.java:140) ~[jvppeteer-1.1.4.jar!/:na]
at com.ruiyun.jvppeteer.core.page.ExecutionContext.evaluateInternal(ExecutionContext.java:114) ~[jvppeteer-1.1.4.jar!/:na]
... 22 common frames omitted

2022-05-06 17:15:46.598 INFO 7 --- [TaskScheduler-1] com.hsn.epic4j.start.PasswordLogin : login success
2022-05-06 17:15:46.598 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.PasswordLogin : login end
2022-05-06 17:15:46.600 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.MainStart : all free items:Terraforming Mars
2022-05-06 17:15:46.602 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.MainStart : item url:https://store.epicgames.com/zh-CN/p/terraforming-mars-18c3ad
2022-05-06 17:16:00.876 DEBUG 7 --- [TaskScheduler-1] com.hsn.epic4j.start.MainStart : user licence check

相关的配置文件：

epic:
#浏览器用户文件存储位置,默认为jar包同路径下data文件夹,不存在会新建目录
dataPath: ./data
#浏览器启动参数
driverArgs:
#epic站点url
epicUrl: https://store.epicgames.com/zh-CN/
#headLess无头模式
headLess: true
#browserVersion指定chromium的版本,可能有一定风险
browser-version:
#checkLoginUrl epic登录判断api
check-login-url: https://www.epicgames.com/account/v2/ajaxCheckLogin
#userInfoUrl获取用户信息url
user-info-url: https://www.epicgames.com/account/v2/personal/ajaxGet?sessionInvalidated=true
#freeGameUrl免费游戏url
free-game-url: https://store-site-backend-static.ak.epicgames.com/freeGamesPromotions?locale={}&country={}&allowCountries={}
#storeUrl商店url
store-url: https://store.epicgames.com/zh-CN/p/{}
cron:
no-sandbox: true
cookie-path:
auto-update: true
multi-user: true
users:
- email: [email protected]
password: ￥￥￥￥
- email: [email protected]
password: ￥￥￥
error-screen-shoot: true

目前我们发现该项目存在 2 个安全风险，因此提示您使用该开源项目前关注它的安全问题，避免对您开发的应用造成威胁

huisunan/epic4j 项目安全报告
项目地址：https://github.com/huisunan/epic4j
直接和间接引入的组件数量：28
存在安全缺陷的组件数量：2
涉及漏洞数量：2
风险组件列表：
组件 级别 版本 最小安全版本
org.springframework:spring-beans 高危 5.3.14 5.3.18
com.fasterxml.jackson.core:jackson-databind 中危 2.13.1 2.13.2.1
在线详细报告: https://www.oscs1024.com/cd/1525239149525733376?sign=e54b46d2

2022-05-20 10:02:11.521  INFO 6 --- [TaskScheduler-1] com.hsn.epic4j.core.PasswordLogin        : 登录成功
2022-05-20 10:02:11.522  INFO 6 --- [TaskScheduler-1] com.hsn.epic4j.core.MainStart            : 游戏url:https://store.epicgames.com/en-US/p/borderlands-3
2022-05-20 10:02:17.542  INFO 6 --- [TaskScheduler-1] com.hsn.epic4j.core.MainStart            : 18+检测
2022-05-20 10:02:23.061  INFO 6 --- [TaskScheduler-1] c.hsn.epic4j.core.notify.ConsoleNotify   : 所有领取到的游戏:
2022-05-20 10:02:23.063  INFO 6 --- [ctReadThread-20] c.r.j.transport.WebSocketTransport       : Connection closed by us Code: 1000 Reason: 

不好意思，看错了，领取成功了!

运行后，报登录超时异常，请问如何解决

2022-05-11 15:32:25.086 ERROR 25156 --- [TaskScheduler-1] com.hsn.epic4j.start.BaseRunner          : 程序异常

com.hsn.epic4j.exception.TimeException: Check login result timeout.
        at com.hsn.epic4j.start.PasswordLogin.lambda$login$0(PasswordLogin.java:43) ~[classes!/:1.3.4]
        at com.hsn.epic4j.util.PageUtil.timer(PageUtil.java:137) ~[classes!/:1.3.4]
        at com.hsn.epic4j.util.PageUtil.findSelectors(PageUtil.java:64) ~[classes!/:1.3.4]
        at com.hsn.epic4j.start.PasswordLogin.login(PasswordLogin.java:41) ~[classes!/:1.3.4]
        at com.hsn.epic4j.start.BaseRunner.doStart(BaseRunner.java:164) [classes!/:1.3.4]
        at com.hsn.epic4j.start.BaseRunner.start(BaseRunner.java:128) [classes!/:1.3.4]
        at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54) ~[spring-context-5.3.14.jar!/:5.3.14]
        at org.springframework.scheduling.concurrent.ReschedulingRunnable.run(ReschedulingRunnable.java:95) ~[spring-context-5.3.14.jar!/:5.3.14]
        at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) ~[na:1.8.0_331]
        at java.util.concurrent.FutureTask.run(Unknown Source) ~[na:1.8.0_331]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown Source) ~[na:1.8.0_331]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) ~[na:1.8.0_331]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) ~[na:1.8.0_331]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ~[na:1.8.0_331]
        at java.lang.Thread.run(Unknown Source) ~[na:1.8.0_331]

2022-05-11 15:32:25.088  INFO 25156 --- [ctReadThread-83] c.r.j.transport.WebSocketTransport       : Connection closed by us Code: 1000 Reason:

环境应该没啥问题