From a4657d3d65215e9cc96492ee3d9bd72e5b23d752 Mon Sep 17 00:00:00 2001 From: Rixuan Shao <2023311022@bipt.edu.cn> Date: Sat, 11 Jul 2026 21:32:09 +0800 Subject: [PATCH] fix: restore Douyin login page runtime proxy --- CHANGELOG.md | 2 ++ DouYinSparkFlow/Dockerfile.server | 9 +++++++++ .../tests/test_deployment_contract.py | 9 +++++++++ docker-compose.yml | 16 ++++++++++++++++ 4 files changed, 36 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cc1cd0e..3f004f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## 2026-07-11 +- Fixed a blank Douyin login desktop by preventing build-time localhost proxy variables from leaking into runtime Chromium and explicitly wiring lowercase/uppercase runtime proxy variables. + - Added an authenticated same-origin noVNC HTTP/WebSocket proxy and synchronous mobile popup handling so login tasks work from phones without exposing port 8788 publicly. - Fixed the server image to provision Node.js 22 explicitly for protocol mode and excluded runtime logs/configuration from the Docker build context. diff --git a/DouYinSparkFlow/Dockerfile.server b/DouYinSparkFlow/Dockerfile.server index 743a5da..db450e3 100644 --- a/DouYinSparkFlow/Dockerfile.server +++ b/DouYinSparkFlow/Dockerfile.server @@ -49,6 +49,15 @@ RUN sed -i 's/archive.ubuntu.com/mirrors.aliyun.com/g' /etc/apt/sources.list \ && node --version \ && rm -rf /var/lib/apt/lists/* +# Build proxies must never leak into the runtime container. Compose injects +# service-addressable runtime proxies explicitly. +ENV HTTP_PROXY= \ + HTTPS_PROXY= \ + ALL_PROXY= \ + http_proxy= \ + https_proxy= \ + all_proxy= + COPY . . CMD ["python", "main.py", "--doTask"] diff --git a/DouYinSparkFlow/tests/test_deployment_contract.py b/DouYinSparkFlow/tests/test_deployment_contract.py index d75d64b..6f7b715 100644 --- a/DouYinSparkFlow/tests/test_deployment_contract.py +++ b/DouYinSparkFlow/tests/test_deployment_contract.py @@ -64,6 +64,15 @@ class DeploymentContractTests(unittest.TestCase): self.assertEqual(len(lines), 1) self.assertTrue(lines[0].startswith("*/20 ")) + def test_build_proxy_does_not_leak_into_runtime_and_runtime_proxy_is_explicit(self): + dockerfile = (SOURCE_ROOT / "Dockerfile.server").read_text(encoding="utf-8") + compose = (REPO_ROOT / "docker-compose.yml").read_text(encoding="utf-8") + self.assertIn("# Build proxies must never leak", dockerfile) + self.assertIn("http_proxy=", dockerfile) + self.assertGreaterEqual(compose.count("http_proxy: http://proxy:7890"), 4) + self.assertGreaterEqual(compose.count("https_proxy: http://proxy:7890"), 4) + self.assertGreaterEqual(compose.count("no_proxy:"), 4) + def test_sensitive_ports_bind_to_loopback_by_default(self): text = (REPO_ROOT / "docker-compose.yml").read_text(encoding="utf-8") self.assertIn("${PROXY_BIND_ADDRESS:-127.0.0.1}:${PROXY_HTTP_PORT:-7890}:7890", text) diff --git a/docker-compose.yml b/docker-compose.yml index ee9221e..af68e2c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -41,7 +41,11 @@ services: HTTP_PROXY: http://proxy:7890 HTTPS_PROXY: http://proxy:7890 ALL_PROXY: socks5://proxy:7890 + http_proxy: http://proxy:7890 + https_proxy: http://proxy:7890 + all_proxy: socks5://proxy:7890 NO_PROXY: localhost,127.0.0.1,login-desktop,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com + no_proxy: localhost,127.0.0.1,login-desktop,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com SPARKFLOW_LOGIN_DESKTOP_API_URL: http://login-desktop:18090 LOGIN_DESKTOP_PUBLIC_PORT: ${LOGIN_DESKTOP_WEB_PORT:-8788} SPARKFLOW_LOGIN_DESKTOP_PUBLIC_URL: ${LOGIN_DESKTOP_PUBLIC_URL:-/login-desktop/proxy/vnc.html?autoconnect=1&resize=scale&view_only=0&path=login-desktop/proxy/websockify} @@ -72,7 +76,11 @@ services: HTTP_PROXY: http://proxy:7890 HTTPS_PROXY: http://proxy:7890 ALL_PROXY: socks5://proxy:7890 + http_proxy: http://proxy:7890 + https_proxy: http://proxy:7890 + all_proxy: socks5://proxy:7890 NO_PROXY: localhost,127.0.0.1,login-desktop,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com + no_proxy: localhost,127.0.0.1,login-desktop,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com ports: - "${LOGIN_DESKTOP_BIND_ADDRESS:-127.0.0.1}:${LOGIN_DESKTOP_WEB_PORT:-8788}:6080" command: bash /app/scripts/start_login_desktop.sh @@ -93,7 +101,11 @@ services: HTTP_PROXY: http://proxy:7890 HTTPS_PROXY: http://proxy:7890 ALL_PROXY: socks5://proxy:7890 + http_proxy: http://proxy:7890 + https_proxy: http://proxy:7890 + all_proxy: socks5://proxy:7890 NO_PROXY: localhost,127.0.0.1,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com + no_proxy: localhost,127.0.0.1,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com command: python /app/scripts/cron_runner.py /host-spool-cron/root volumes: - ./DouYinSparkFlow:/app @@ -113,7 +125,11 @@ services: HTTP_PROXY: http://proxy:7890 HTTPS_PROXY: http://proxy:7890 ALL_PROXY: socks5://proxy:7890 + http_proxy: http://proxy:7890 + https_proxy: http://proxy:7890 + all_proxy: socks5://proxy:7890 NO_PROXY: localhost,127.0.0.1,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com + no_proxy: localhost,127.0.0.1,douyin.com,amemv.com,snssdk.com,bytedance.com,pstatp.com,volccdn.com,bytescm.com,byted.net,douyinstatic.com,bytecdn.cn,byteimg.com,bytegoofy.com,toutiaostatic.com command: python main.py --doTask volumes: - ./DouYinSparkFlow:/app