新增简易的8080面板😊

store/@{Falck}/web-toolkit/SIGNATURE

@@ -0,0 +1,8 @@
+{
+  "signature": "GYBKpyVNgNFbpeoGlkXNY+wvt5wrJFHeP06At2h3SPsZUX3sXCtUL8RoidfzkqrfphBKAaKYvRnXaZdi3hyaDfXNQ88Ik18U+K7Usx+/o/rrQqzMKqh1pT75UZgZtJpXHu7CiIEjNIQ0pbujRHVfnRFe/4K3E2IClpJLcrziyrvn0fUBcUytt/WCTGBJ8pnyWB+ybcIDTJJQ+l4E69vsy2YmJHZBbBreyOo+TN5AQHDAlZ851dxI1K9euCNtdnlufbW6QSshnQ7DSS94KYZEUgTYFGON4Qi1RiVTFJK4iJEkTExEmohc3AuFJtEoIBBJzbUj/yCmfGcyWrbK7wchdwdGuNxGbexB97FONGm0WFS/z6OM08ljMJUAgvDRZtpInpQHFWJfxBfH+wzBx0AvhkgiJeeUApeofOxlggveOLDYDEH8P858sf0sjHHL0qgE17alvn0Fi8rArOI40wrh420SF7p4VlXE7fufXoue+yAhlSt68zaXOJHAtK5CuMh2ytVFKonRJgF5TAXvXYJeOZgujHyUUTtVqje+thIaBzqtGhEt9xp5N6Ikky2sutKRMgXx34As3hvx0U6a2CHuVykcX9neoB8XtJNlE1+AT24wnWw8LBqm6OjCTeJtAOFWFkliHNID9b1xfq69rZBp/L4Djj1bzy8WNLM7QLbjAvc=",
+  "signer": "Falck",
+  "algorithm": "RSA-SHA256",
+  "timestamp": 1775964953.1846428,
+  "plugin_hash": "eab1e047be16fe50b9c46f26570924f2975fac71a45af7f6c0b1f9c16ac8b096",
+  "author": "Falck"
+}

store/@{Falck}/web-toolkit/main.py

@@ -1,5 +1,6 @@
 """Web 工具包 - 路由注册、静态文件服务、前端事件（不负责渲染）"""
 import json
+import sys
 from pathlib import Path
 from oss.plugin.types import Plugin, register_plugin_type, Response
 from .router import WebRouter
@@ -7,6 +8,20 @@ from .static import StaticFileHandler
 from .template import TemplateEngine
 
 
+class _Log:
+    _TTY = sys.stdout.isatty()
+    _C = {"reset": "\033[0m", "white": "\033[0;37m", "yellow": "\033[1;33m", "blue": "\033[1;34m", "red": "\033[1;31m"}
+    @classmethod
+    def _c(cls, t, c):
+        return f"{cls._C.get(c,'')}{t}{cls._C['reset']}" if cls._TTY else t
+    @classmethod
+    def info(cls, m): print(f"{cls._c('[web-toolkit]', 'white')} {cls._c(m, 'white')}")
+    @classmethod
+    def warn(cls, m): print(f"{cls._c('[web-toolkit]', 'yellow')} {cls._c('⚠', 'yellow')} {cls._c(m, 'yellow')}")
+    @classmethod
+    def error(cls, m): print(f"{cls._c('[web-toolkit]', 'red')} {cls._c('✗', 'red')} {cls._c(m, 'red')}")
+
+
 class WebToolkitPlugin(Plugin):
     """Web 工具包插件 - 提供网站前端所有服务"""
 
@@ -26,7 +41,7 @@ class WebToolkitPlugin(Plugin):
         self.template_engine = TemplateEngine()
         self._load_config()
         self.static_handler = StaticFileHandler(root=str(self.root_dir))
-        print(f"[web-toolkit] 配置加载完成: root_dir={self.root_dir}")
+        _Log.info(f"配置加载完成: root_dir={self.root_dir}")
 
     def start(self):
         """启动"""
@@ -65,7 +80,7 @@ class WebToolkitPlugin(Plugin):
                     self._serve_static
                 )
 
-        print("[web-toolkit] Web 工具包已启动")
+        _Log.info("Web 工具包已启动")
 
     def stop(self):
         """停止"""
@@ -97,7 +112,7 @@ class WebToolkitPlugin(Plugin):
         """读取 config.json，解析网站根目录"""
         config_path = Path("./data/web-toolkit/config.json")
         if not config_path.exists():
-            print("[web-toolkit] 警告: config.json 不存在，使用默认配置")
+            _Log.warn("config.json 不存在，使用默认配置")
             self.config = {
                 "root_dir": "../website",
                 "index_file": "index.html",
@@ -146,6 +161,10 @@ class WebToolkitPlugin(Plugin):
         else:
             filename = path.lstrip("/")
 
+        # 安全检查：防止路径穿越
+        if ".." in filename or filename.startswith("/"):
+            return Response(status=403, body="Forbidden")
+
         if not filename:
             return self._serve_website_index(request)
         return self.static_handler.serve(filename)

store/@{Falck}/web-toolkit/template.py

@@ -43,27 +43,74 @@ class TemplateEngine:
         return content
 
     def _safe_eval(self, expression: str, context: dict) -> Any:
-        """安全评估表达式（仅允许简单的属性访问和比较）"""
-        # 只允许访问 context 中的变量
-        # 支持的运算符: and, or, not, ==, !=, <, >, <=, >=, in
-        # 不允许函数调用、导入、属性访问等
-        
-        # 使用 AST 解析并验证
+        """安全评估表达式（使用 AST 验证，不使用 eval）"""
         try:
             tree = ast.parse(expression, mode='eval')
         except SyntaxError:
             return False
-        
+
         # 验证 AST 节点
         if not self._validate_ast(tree.body[0].value, set(context.keys())):
             return False
-        
-        # 在受限环境中评估
+
+        # 使用安全的 AST 解释器，不使用 eval
         try:
-            return eval(expression, {"__builtins__": {}}, context)
+            return self._eval_ast(tree.body[0].value, context)
         except Exception:
             return False
 
+    def _eval_ast(self, node: ast.AST, context: dict) -> Any:
+        """安全地评估 AST 节点"""
+        if isinstance(node, ast.Constant):
+            return node.value
+        elif isinstance(node, ast.Name):
+            return context.get(node.id, False)
+        elif isinstance(node, ast.BoolOp):
+            if isinstance(node.op, ast.And):
+                return all(self._eval_ast(v, context) for v in node.values)
+            elif isinstance(node.op, ast.Or):
+                return any(self._eval_ast(v, context) for v in node.values)
+        elif isinstance(node, ast.Compare):
+            return self._eval_compare(node, context)
+        elif isinstance(node, ast.UnaryOp):
+            if isinstance(node.op, ast.Not):
+                return not self._eval_ast(node.operand, context)
+        elif isinstance(node, ast.Subscript):
+            return self._eval_subscript(node, context)
+        return False
+
+    def _eval_compare(self, node: ast.Compare, context: dict) -> bool:
+        """评估比较表达式"""
+        left = self._eval_ast(node.left, context)
+        for op, comp in zip(node.ops, node.comparators):
+            right = self._eval_ast(comp, context)
+            if isinstance(op, ast.Eq):
+                if not (left == right): return False
+            elif isinstance(op, ast.NotEq):
+                if not (left != right): return False
+            elif isinstance(op, ast.Lt):
+                if not (left < right): return False
+            elif isinstance(op, ast.Gt):
+                if not (left > right): return False
+            elif isinstance(op, ast.LtE):
+                if not (left <= right): return False
+            elif isinstance(op, ast.GtE):
+                if not (left >= right): return False
+            elif isinstance(op, ast.In):
+                if not (left in right): return False
+            elif isinstance(op, ast.NotIn):
+                if not (left not in right): return False
+            left = right
+        return True
+
+    def _eval_subscript(self, node: ast.Subscript, context: dict) -> Any:
+        """评估下标访问"""
+        value = self._eval_ast(node.value, context)
+        key = self._eval_ast(node.slice, context)
+        if isinstance(value, (dict, list, str)):
+            return value[key]
+        return None
+
     def _validate_ast(self, node: ast.AST, allowed_names: set) -> bool:
         """验证 AST 只包含安全的操作"""
         if isinstance(node, ast.Name):