meowv / blog

🤣本项目有不同开发版本，最新版底层基于 abp vNext 搭建和免费开源跨平台框架 .NET5 进行开发，使用 MongoDB 存储数据，Redis 缓存数据。项目采用前后端分离的模式进行开发，API 遵循 RESTful 接口规范，页面使用 Blazor 进行开发，可作为 .NET Core 入门项目进行学习。If you liked `Blog` project or if it helped you, please give a star ⭐️ for this repository. 👍👍👍

🤣阿星Plus⭐⭐⭐ 个人博客

项目介绍

本项目有不同开发版本，最新版底层基于 abp vNext 搭建和免费开源跨平台框架 .NET5 进行开发，使用 MongoDB 存储数据，Redis 缓存数据。项目采用前后端分离的模式进行开发，API 遵循 RESTful 接口规范，页面使用 Blazor 进行开发，可作为 .NET Core 入门项目进行学习。

注：历史版本，请切换不同分支查看。

If you liked Blog project or if it helped you, please give a star ⭐️ for this repository. 👍👍👍

blog
 ├── assets ---------- assets
 ├── LICENSE ---------- LICENSE
 ├── meowv.blog.sln ---------- Solution
 ├── README.md ---------- README.md
 └── src
     ├── Meowv.Blog.Admin ---------- Admin项目 admin.meowv.com
     ├── Meowv.Blog.Api ---------- Api项目 api.meowv.com
     ├── Meowv.Blog.Application ---------- Application
     ├── Meowv.Blog.BackgroundWorkers ---------- BackgroundWorkers
     ├── Meowv.Blog.Core ---------- Core
     ├── Meowv.Blog.DbMigrator ---------- DbMigrator
     ├── Meowv.Blog.MongoDb ---------- MongoDb
     ├── Meowv.Blog.Response ---------- Response
     └── Meowv.Blog.Web ---------- Web项目 meowv.com

预览体验

Web项目：https://meowv.com

Admin项目：https://admin.meowv.com

Api项目：https://api.meowv.com

文章介绍

v3.4.0

1. 使用 abp cli 搭建项目
2. 给项目瘦身，让它跑起来
3. 完善与美化，Swagger登场
4. 数据访问和代码优先
5. 自定义仓储之增删改查
6. 统一规范API，包装返回模型
7. 再说Swagger，分组、描述、小绿锁
8. 接入GitHub，用JWT保护你的API
9. 异常处理和日志记录
10. 使用Redis缓存数据
11. 集成Hangfire实现定时任务处理
12. 用AutoMapper搞定对象映射
13. 定时任务最佳实战（一）
14. 定时任务最佳实战（二）
15. 定时任务最佳实战（三）
16. 博客接口实战篇（一）
17. 博客接口实战篇（二）
18. 博客接口实战篇（三）
19. 博客接口实战篇（四）
20. 博客接口实战篇（五）
21. Blazor 实战系列（一）
22. Blazor 实战系列（二）
23. Blazor 实战系列（三）
24. Blazor 实战系列（四）
25. Blazor 实战系列（五）
26. Blazor 实战系列（六）
27. Blazor 实战系列（七）
28. Blazor 实战系列（八）
29. Blazor 实战系列（九）
30. 终结篇之发布项目

v4.0.0

TODO...

LICENSE

This project is licensed under MIT.

blog's Issues

接口debug可以启动， 发布之后启动不了，

dotnet Meowv.Blog.Api.dll 启动了5分钟，控制台无任何输出

你好，阿星

你的接口和WEB分开部署不会有跨域问题吗，我的新增可以，删除会有跨域问题

Good learning resources, thank you for sharing！

请问会添加搜索功能吗?

这个博客项目很棒! 但是没有搜索这个功能好像少了什么? 搜索会在计划中吗?

集成hangfire 出现

AuthorizeService中GenerateTokenAsync方法，调用Github获取用户信息接口问题

使用https://api.github.com/user?access_token={access_token} 尝试获取github用户信息时无法获取，提示Authorization是必须， 查看文档后发现现在不能用查询字符串形式获取github用户信息，而是需要在header中添加“Authorization”。类似："Authorization", $"token {access_token}"

GitHub OAuth securityToken无效

因为Github返回的个人信息中，Email为null, 导致claims创建失败。
个人修复为：
new Claim(ClaimTypes.Email, user.Email ?? "")

随机妹子图有没有json格式的返回

随机妹子图有没有json格式的返回

Security : Server Side Request Forgery Vulnerability found

I have identified potential security vulnerabilities in this project.

I am committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to me.

If you are NOT the correct point of contact for this report, please let me know!

Summary

Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. In typical SSRF examples, the attacker might cause the server to make a connection back to itself, or to other web-based services within the organization's infrastructure, or to external third-party systems

Severity

High

Product

https://github.com/Meowv/Blog

Tested Version

Current master branch as of efa7a0c

Complexity

Easy

Attack Vector

Remote / External

Details

The url parameter on the endpoint /api/meowv/tool/img is vulnerable to SSRF. This can be exploited using a proof of concept similar to that shown below.

curl -i -s -k -X $'GET' \
    -H $'Host: api.meowv.com' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Dnt: 1' -H $'Upgrade-Insecure-Requests: 1' -H $'Sec-Fetch-Dest: document' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-Site: none' -H $'Sec-Fetch-User: ?1' -H $'Te: trailers' -H $'Connection: close' \
    $'https://api.meowv.com/api/meowv/tool/img?url=http://localhost:22'

Root Cause Analysis

This attack can be attributed to this vulnerable snippet

Blog/src/Meowv.Blog.Application/Tools/Impl/ToolService.cs

Lines 137 to 150 in 91c6de1

	/// <summary>
	/// Get img by url
	/// </summary>
	/// <param name="url"></param>
	/// <returns></returns>
	[Route("api/meowv/tool/img")]
	public async Task<FileContentResult> GetImgAsync([Required] string url)
	{
	using var client = _httpClient.CreateClient();
	var bytes = await client.GetByteArrayAsync(url);
	return new FileContentResult(bytes, "image/jpeg");
	}

Here the external parameter url is directly passed to the GetByteArrayAsync call causing an SSRF.

Impact

An Adversary can carry out SSRF attack to scan the internal network, perform sensitive actions, download sensitive files like meta-data etc

Remediation

This can be avoided by testing untrusted input values against a trusted whitelist.

GitHub Security Advisories

If possible, please could you create a private GitHub Security Advisory for these findings? This allows you to invite me to collaborate and further discuss these findings in private before they are published. I will be happy to collaborate with you, and review your fix to make sure that all corner cases are covered.

When you use a GitHub Security Advisory, you can request a CVE identification number from GitHub. GitHub usually reviews the request within 72 hours, and the CVE details will be published after you make your security advisory public. Publishing a GitHub Security Advisory and a CVE will help notify the downstream consumers of your project, so they can update to the fixed version.

This was found using CodeQL by Github

找不到默认构造器

你好，我在学习你的这个abp系列的时候遇到了一个问题
在 《基于 abp vNext 和 .NET Core 开发博客项目 - 自定义仓储之增删改查》 这篇文章中我按照你的代码操作了之后代码跑起来后swagger报500的错误

具体内容如下图

.net core 3.1
mysql

编译错误

dotnet restore
/usr/share/dotnet/sdk/2.2.401/NuGet.targets(123,5): error : Unable to load the service index for source https://api.nuget.org/v3/index.json. [/root/Blog/MeowvBlog.sln]
/usr/share/dotnet/sdk/2.2.401/NuGet.targets(123,5): error : The SSL connection could not be established, see inner exception. [/root/Blog/MeowvBlog.sln]
/usr/share/dotnet/sdk/2.2.401/NuGet.targets(123,5): error : The remote certificate is invalid according to the validation procedure. [/root/Blog/MeowvBlog.sln]

缓存中出现数据更新时缓存如何更新的？

说明

阿星 ，我翻阅了下源代码，几乎没什么问题，我这里有一个疑惑。

我看大多数的Get | Query请求都是走的缓存，我再看Insert | Update的时候并没有更新缓存，那么这时候获取的数据就不是最新的？
是我那点没理解到吗？

swagger添加描述过滤不属于同一个分组的api

swagger添加描述后，把不属于同一个分组的helloworld过滤掉怎么实现呢

老哥，前端的源码，可否发一波，学习学习

关于缓存的开启与停用时，Application层的机制是如何规避缓存

 "Caching": {
    "IsOpen": true,
    "RedisConnectionString": "127.0.0.1:6379,defaultDatabase=0,poolsize=50,ssl=false,writeBuffer=10240,ConnectTimeout=15000,SyncTimeout=5000"
  }

你好，关于这里的 IsOpen，如果设置为false；按照你的写法就是停用了Redis，那么在 .Application 中如下：

      /// <summary>
       /// 获取分类名称
       /// </summary>
       /// <param name="name"></param>
       /// <returns></returns>
       public async Task<ServiceResult<string>> GetCategoryAsync(string name)
       {
           return await _blogCacheService.GetCategoryAsync(name, async () =>
           {
               var result = new ServiceResult<string>();

               var category = await _categoryRepository.FindAsync(x => x.DisplayName.Equals(name));
               if (null == category)
               {
                   result.IsFailed(ResponseText.WHAT_NOT_EXIST.FormatWith("分类", name));
                   return result;
               }

               result.IsSuccess(category.CategoryName);
               return result;
           });
       }

_blogCacheService.GetCategoryAsync 是会自动规避调用Redis吗？是怎样规避的，能告知一下原理？

登录账户密码?

https://admin.meowv.com/login
请惠予提供登录账户密码,
谢谢！

a very important async query issue!!!

query=...from category in await _categoryRepository.GetListAsync()
join posts in await _postRepository.GetListAsync()
on category.Id equals posts.CategoryId
this code snip in your code is very expensive!!!
can change to this:
query=...from category in _categoryRepository
join posts in _postRepository
on category.Id equals posts.CategoryId
await AsyncExecuter.ToListAsync(query);

后台页面加载问题

进入后台页面时会显示（闪现）后台然后跳转到登录页面。

怎么设置sqlite呢

这是一个很好的blog和笔记软件，请教怎么设置和支持sqlite呢？怎么增加一个搜索功能？

SEO：纯JS模版没法被搜索引擎抓取啊

SEO：纯JS模版没法被搜索引擎抓取啊

时间戳转时间位数不正确

Blog/src/MeowvBlog.API/Extensions/Extensions.cs

Line 296 in b2ed64d

var ticks = 621355968000000000 + long.Parse(timestamp) * 10000;

var ticks = 621355968000000000 + long.Parse(timestamp) * 10000000;

不是乘10000，而是乘10000000 才对

Is there any possible to provide a sample in this repo with Volo.Abp.EventBus.RabbitMQ

Is there any possible to provide a sample in this repo with Volo.Abp.EventBus.RabbitMQ,very appreciate!

Is there any possible to provide another db type in this repo ? ps Sqlite, MySql……