release: v1.2.2 — 双域名配置与 Host 隔离修复

修复设置页误清空管理域、配置与生效 URL 混淆及第三 Host 绕过隔离；加固 Settings API 与中间件，并更新文档站。

server/utils/host-isolation.ts

@@ -8,6 +8,20 @@ import {
 } from './env'
 import { requestPathToImageKey } from './serve-image'
 
+const DEV_LOCAL_HOSTS = new Set(['localhost', '127.0.0.1'])
+
+function getIsolationRequestHost(event: H3Event): string {
+  const requestUrl = getRequestURL(event, {
+    xForwardedHost: true,
+    xForwardedProto: true
+  })
+  return requestUrl.hostname.toLowerCase()
+}
+
+function isDevLocalHost(host: string): boolean {
+  return process.env.NODE_ENV === 'development' && DEV_LOCAL_HOSTS.has(host)
+}
+
 export function getConfiguredSiteHost(event: H3Event): string | null {
   return hostnameFromBaseUrl(getSiteBaseUrlConfigured(event))
 }
@@ -16,6 +30,30 @@ export function getConfiguredImageHost(event: H3Event): string | null {
   return hostnameFromBaseUrl(getImageBaseUrlConfigured(event))
 }
 
+/** 双域名开启时，拒绝未配置的第三 Host（开发环境 localhost 例外） */
+export function shouldBlockUnknownHostRequest(
+  event: H3Event,
+  options?: {
+    requestHost?: string
+    separationActive?: boolean
+    siteHost?: string | null
+    imageHost?: string | null
+  }
+): boolean {
+  const separationActive = options?.separationActive ?? isDomainSeparationActive(event)
+  if (!separationActive) return false
+
+  const siteHost = options?.siteHost ?? getConfiguredSiteHost(event)
+  const imageHost = options?.imageHost ?? getConfiguredImageHost(event)
+  if (!siteHost || !imageHost) return false
+
+  const requestHost = (options?.requestHost ?? getIsolationRequestHost(event)).toLowerCase()
+  if (requestHost === siteHost || requestHost === imageHost) return false
+  if (isDevLocalHost(requestHost)) return false
+
+  return true
+}
+
 export function shouldBlockImageHostRequest(
   event: H3Event,
   options?: {
@@ -34,19 +72,16 @@ export function shouldBlockImageHostRequest(
   const imageHost = options?.imageHost ?? getConfiguredImageHost(event)
   if (!imageHost) return false
 
-  const requestUrl = options?.requestHost
-    ? null
-    : getRequestURL(event, {
-        xForwardedHost: true,
-        xForwardedProto: true
-      })
-  const requestHost = (options?.requestHost ?? requestUrl?.hostname ?? '').toLowerCase()
+  const requestHost = (options?.requestHost ?? getIsolationRequestHost(event)).toLowerCase()
   if (requestHost !== imageHost) return false
 
   const method = (options?.method ?? getMethod(event)).toUpperCase()
   if (method !== 'GET' && method !== 'HEAD') return true
 
-  const pathname = options?.pathname ?? requestUrl?.pathname ?? ''
+  const pathname = options?.pathname ?? getRequestURL(event, {
+    xForwardedHost: true,
+    xForwardedProto: true
+  }).pathname
   const hideFolder = options?.hideFolder ?? isHideFolderInUrl(event)
   return requestPathToImageKey(pathname, {
     hideFolder
@@ -71,19 +106,16 @@ export function shouldBlockSiteHostImageRequest(
   const siteHost = options?.siteHost ?? getConfiguredSiteHost(event)
   if (!siteHost) return false
 
-  const requestUrl = options?.requestHost
-    ? null
-    : getRequestURL(event, {
-        xForwardedHost: true,
-        xForwardedProto: true
-      })
-  const requestHost = (options?.requestHost ?? requestUrl?.hostname ?? '').toLowerCase()
+  const requestHost = (options?.requestHost ?? getIsolationRequestHost(event)).toLowerCase()
   if (requestHost !== siteHost) return false
 
   const method = (options?.method ?? getMethod(event)).toUpperCase()
   if (method !== 'GET' && method !== 'HEAD') return false
 
-  const pathname = options?.pathname ?? requestUrl?.pathname ?? ''
+  const pathname = options?.pathname ?? getRequestURL(event, {
+    xForwardedHost: true,
+    xForwardedProto: true
+  }).pathname
   const hideFolder = options?.hideFolder ?? isHideFolderInUrl(event)
   return requestPathToImageKey(pathname, {
     hideFolder