Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

提高内容加密安全性 #492

Closed
1 task done
Lruihao opened this issue Aug 21, 2024 · 1 comment
Closed
1 task done

提高内容加密安全性 #492

Lruihao opened this issue Aug 21, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request help wanted Extra attention is needed

Comments

@Lruihao
Copy link
Member

Lruihao commented Aug 21, 2024

正如当时设计开发之初所担心的,内置内容加密功能的对称加密算法受限于 Hugo 的模板语法,仅通过 base64 加盐,非常简陋~。随着 Hugo 版本的更新,相关加密函数或得到支持,所以 FixIt 主题的内容加密功能预计分两个阶段进行优化。

Stage 1

从 Hugo 已提供的 hashcrypto 函数中使用尽可能更好的方法优化加密过程。

  • 替换密码散列值算法:md5 -> xxhash1(尽可能避免密码撞库风险)

处理进度:#494

Stage 2 (Help wanted)

通过 Go/JS 开发额外的插件,来更好的内容加密算法 AES 加密内容。

(如果 Hugo 后续内置支持 AES 算法相关的模板函数,则本阶段设想可放弃,在第一阶段就能达到预期目标)

Footnotes

  1. xxhash new in Hugo v0.129.0

@Lruihao Lruihao added the enhancement New feature or request label Aug 21, 2024
@Lruihao Lruihao added the help wanted Extra attention is needed label Aug 24, 2024
@Lruihao Lruihao self-assigned this Aug 24, 2024
@Lruihao Lruihao moved this from To do to In progress in Roadmap of FixIt Aug 26, 2024
@Lruihao
Copy link
Member Author

Lruihao commented Aug 29, 2024

第二阶段设想暂无计划,且也存在诸如无法使用 hugo server 实时调试等问题,暂且搁置。

另外,如果想自定义内容加密算法,可以新建一个 hugo 组件,覆盖 FixIt 主题的 layouts/partials/function/content-encryption.htmlassets/js/fixit-decryptor.js,重写加解密逻辑。

@Lruihao Lruihao closed this as completed Aug 29, 2024
@github-project-automation github-project-automation bot moved this from In progress to Done in Roadmap of FixIt Aug 29, 2024
@Lruihao Lruihao mentioned this issue Sep 4, 2024
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed
Projects
Status: Done
Development

No branches or pull requests

1 participant