Merge pull request #259 from qaiu/fix/iz-auth-fallback

fix(iz): 蓝奏优享登录失败回退免登录 + release 0.4.8

README.md

@@ -18,6 +18,8 @@ QQ交流群：1017480890
 ![alt text](web-front/img/image.png)
 
 
+> 本平台所有音乐解析工具不再维护，请移步[Sonder播放器](https://sodecode.qaiu.top)  
+> 需要百度，迅雷，UC，夸克的完整支持请使用[专业版](https://189.qaiu.top)  
 
 ## 介绍
 > netdisk-fast-download网盘直链解析可以把云盘分享链接转为直链，可广泛应用于各类下载站，资源站，个人博客，图床，APP下载更新，视频点播等领域。支持市面各大主流云盘的文件分享以及文件夹分享链接，已支持蓝奏云/蓝奏云优享/移动云云空间/小飞机盘/亿方云/123云盘/永硕E盘/Cloudreve等，支持加密分享，以及部分网盘文件夹分享。  
@@ -459,7 +461,7 @@ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtow
 > 注意: netdisk-fast-download.service中的ExecStart的路径改为实际路径
 ```shell
 cd ~
-wget -O netdisk-fast-download.zip https://github.com/qaiu/netdisk-fast-download/releases/download/v0.4.6/netdisk-fast-download-linux-amd64.zip
+wget -O netdisk-fast-download.zip https://github.com/qaiu/netdisk-fast-download/releases/download/v0.4.8/netdisk-fast-download-linux-amd64.zip
 unzip netdisk-fast-download.zip
 cd netdisk-fast-download
 bash service-install.sh

parser/src/main/java/cn/qaiu/parser/impl/IzTool.java

@@ -3,6 +3,7 @@ package cn.qaiu.parser.impl;
 import cn.qaiu.entity.FileInfo;
 import cn.qaiu.entity.ShareLinkInfo;
 import cn.qaiu.parser.PanBase;
+import cn.qaiu.parser.TokenCache;
 import cn.qaiu.util.AESUtils;
 import cn.qaiu.util.AcwScV2Generator;
 import cn.qaiu.util.CommonUtils;
@@ -85,12 +86,31 @@ public class IzTool extends PanBase {
     }
     public IzTool(ShareLinkInfo shareLinkInfo) {
         super(shareLinkInfo);
+        IzXffHeader.apply(header);
+        String accountId = "_default";
+        if (shareLinkInfo.getOtherParam().containsKey("auths")) {
+            MultiMap auths = (MultiMap) shareLinkInfo.getOtherParam().get("auths");
+            if (auths.contains("_configId")) {
+                accountId = auths.get("_configId");
+            } else if (auths.contains("username")) {
+                accountId = auths.get("username");
+            }
+        }
+        this.cacheKey = TokenCache.key("iz", accountId);
     }
 
     String uuid = UUID.randomUUID().toString().toLowerCase(); // 也可以使用 UUID.randomUUID().toString()
 
-    public static volatile String token = null;
+    // 多账号隔离：用 TokenCache 代替 static 变量
-    public static volatile boolean authFlag = true;
+    private final String cacheKey;
+
+    private String token() {
+        return TokenCache.getToken(cacheKey);
+    }
+
+    private boolean authFlag() {
+        return TokenCache.getFlag(cacheKey, true);
+    }
 
     public Future<String> parse() {
 
@@ -101,22 +121,21 @@ public class IzTool extends PanBase {
         // 检查并输出认证状态
         if (shareLinkInfo.getOtherParam().containsKey("auths")) {
             boolean isTempAuth = shareLinkInfo.getOtherParam().containsKey("__TEMP_AUTH_ADDED");
+            String token = token();
             log.info("文件解析检测到认证信息: isTempAuth={}, authFlag={}, token={}",
-                    isTempAuth, authFlag, token != null ? "已登录(" + token.substring(0, Math.min(8, token.length())) + "...)" : "未登录");
+                    isTempAuth, authFlag(), token != null ? "已登录(" + token.substring(0, Math.min(8, token.length())) + "...)" : "未登录");
             
             // 如果需要认证但还没有token，先执行登录
-            if ((isTempAuth || authFlag) && token == null) {
+            if ((isTempAuth || authFlag()) && token == null) {
                 log.info("文件解析需要登录，开始执行登录流程...");
                 MultiMap auths = (MultiMap) shareLinkInfo.getOtherParam().get("auths");
                 return login(tsEncode, auths)
-                        .compose(v -> {
+                        .recover(err -> {
-                            log.info("文件解析预登录成功，继续解析流程");
+                            // 预登录失败不终止解析，继续走免登录
-                            return parseWithAuth(shareId, tsEncode);
+                            log.warn("文件解析预登录失败: {}，使用免登录模式", err.getMessage());
+                            return Future.succeededFuture();
                         })
-                        .onFailure(err -> {
+                        .compose(v -> parseWithAuth(shareId, tsEncode));
-                            log.warn("文件解析预登录失败: {}，尝试使用免登录模式", err.getMessage());
-                            // 登录失败，继续使用免登录模式
-                        });
             } else if (token != null) {
                 log.info("文件解析使用已有token: {}...", token.substring(0, Math.min(8, token.length())));
             }
@@ -231,8 +250,8 @@ public class IzTool extends PanBase {
             // 检查是否为临时认证（临时认证每次都尝试登录）
             boolean isTempAuth = shareLinkInfo.getOtherParam().containsKey("__TEMP_AUTH_ADDED");
             // 如果是临时认证，或者是后台配置且authFlag为true，则尝试使用认证
-            if (isTempAuth || authFlag) {
+            if (isTempAuth || authFlag()) {
-                log.debug("尝试使用认证信息解析, isTempAuth={}, authFlag={}", isTempAuth, authFlag);
+                log.debug("尝试使用认证信息解析, isTempAuth={}, authFlag={}", isTempAuth, authFlag());
                 HttpRequest<Buffer> httpRequest =
                         webClientSession.getAbs(UriTemplate.of(SECOND_REQUEST_URL_VIP))
                                 .setTemplateParam("fidEncode", fidEncode)
@@ -241,18 +260,19 @@ public class IzTool extends PanBase {
                                 .setTemplateParam("auth", auth)
                                 .setTemplateParam("dataKey", dataKey);
                 MultiMap auths = (MultiMap) shareLinkInfo.getOtherParam().get("auths");
-                if (token == null) {
+                if (token() == null) {
-                    // 执行登录
+                    // 执行登录，失败则回退免登录
                     login(tsEncode2, auths).onFailure(failRes-> {
-                        log.warn("登录失败: {}", failRes.getMessage());
+                        log.warn("登录失败，回退免登录: {}", failRes.getMessage());
-                        fail(failRes.getMessage());
+                        downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
                     }).onSuccess(r-> {
-                        httpRequest.setTemplateParam("appToken", token)
+                        httpRequest.setTemplateParam("appToken", token())
                                 .putHeaders(header);
                         httpRequest.send().onSuccess(this::down).onFailure(handleFail("请求2"));
                     });
                 } else {
-                    // 验证token
+                    // 验证token — 先从缓存恢复到 header
+                    header.set("appToken", token());
                     webClientSession.postAbs(UriTemplate.of(TOKEN_VERIFY_URL))
                             .setTemplateParam("uuid", uuid)
                             .setTemplateParam("ts", tsEncode2)
@@ -260,15 +280,15 @@ public class IzTool extends PanBase {
                                 // log.info("res: {}",asJson(res));
                                 if (asJson(res).getInteger("code") != 200) {
                                     login(tsEncode2, auths).onFailure(failRes -> {
-                                        log.warn("重新登录失败: {}", failRes.getMessage());
+                                        log.warn("重新登录失败，回退免登录: {}", failRes.getMessage());
-                                        fail(failRes.getMessage());
+                                        downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
                                     }).onSuccess(r-> {
-                                        httpRequest.setTemplateParam("appToken", token)
+                                        httpRequest.setTemplateParam("appToken", token())
                                                 .putHeaders(header);
                                         httpRequest.send().onSuccess(this::down).onFailure(handleFail("请求2"));
                                     });
                                 } else {
-                                    httpRequest.setTemplateParam("appToken", token)
+                                    httpRequest.setTemplateParam("appToken", token())
                                             .putHeaders(header);
                                     httpRequest.send().onSuccess(this::down).onFailure(handleFail("请求2"));
                                 }
@@ -277,29 +297,27 @@ public class IzTool extends PanBase {
             } else {
                 // authFlag 为 false，使用免登录解析
                 log.debug("authFlag=false，使用免登录解析");
-                webClientSession.getAbs(UriTemplate.of(SECOND_REQUEST_URL))
+                downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
-                        .putHeaders(header)
-                        .setTemplateParam("fidEncode", fidEncode)
-                        .setTemplateParam("uuid", uuid)
-                        .setTemplateParam("ts", tsEncode2)
-                        .setTemplateParam("auth", auth)
-                        .setTemplateParam("dataKey", dataKey).send()
-                        .onSuccess(this::down).onFailure(handleFail("请求2"));
             }
         } else {
             // 没有认证信息，使用免登录解析
             log.debug("无认证信息，使用免登录解析");
-            webClientSession.getAbs(UriTemplate.of(SECOND_REQUEST_URL))
+            downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
-                    .putHeaders(header)
-                    .setTemplateParam("fidEncode", fidEncode)
-                    .setTemplateParam("uuid", uuid)
-                    .setTemplateParam("ts", tsEncode2)
-                    .setTemplateParam("auth", auth)
-                    .setTemplateParam("dataKey", dataKey).send()
-                    .onSuccess(this::down).onFailure(handleFail("请求2"));
         }
     }
 
+    private void downloadAnonymous(String fidEncode, String tsEncode2, String auth, String dataKey) {
+        log.debug("使用免登录解析");
+        webClientSession.getAbs(UriTemplate.of(SECOND_REQUEST_URL))
+                .putHeaders(header)
+                .setTemplateParam("fidEncode", fidEncode)
+                .setTemplateParam("uuid", uuid)
+                .setTemplateParam("ts", tsEncode2)
+                .setTemplateParam("auth", auth)
+                .setTemplateParam("dataKey", dataKey).send()
+                .onSuccess(this::down).onFailure(handleFail("请求2"));
+    }
+
     private Future<Void> login(String tsEncode2, MultiMap auths) {
         Promise<Void> promise1 = Promise.promise();
         webClientSession.postAbs(UriTemplate.of(LOGIN_URL))
@@ -310,8 +328,13 @@ public class IzTool extends PanBase {
                 .onSuccess(res2->{
                     JsonObject json = asJson(res2);
                     if (json.getInteger("code") == 200) {
-                        token = json.getJsonObject("data").getString("appToken");
+                        String loginToken = json.getJsonObject("data").getString("appToken");
-                        log.info("登录成功 token: {}...", token != null ? token.substring(0, Math.min(8, token.length())) : "null");
+                        TokenCache.putToken(cacheKey, loginToken);
+                        TokenCache.queueCachedTokenPersist(cacheKey, loginToken, System.currentTimeMillis() + 24 * 60 * 60 * 1000L);
+                        if (loginToken != null) {
+                            header.set("appToken", loginToken);
+                        }
+                        log.info("登录成功 token: {}...", loginToken != null ? loginToken.substring(0, Math.min(8, loginToken.length())) : "null");
                         promise1.complete();
                     } else {
                         // 检查是否为临时认证
@@ -323,7 +346,7 @@ public class IzTool extends PanBase {
                         } else {
                             // 后台配置的认证失败，设置authFlag并返回失败，让下次请求使用免登陆解析
                             log.warn("后台配置认证失败: {}, authFlag将设为false，请重新解析", json.getString("msg"));
-                            authFlag = false;
+                            TokenCache.putFlag(cacheKey, false);
                             promise1.fail("认证失败: " + json.getString("msg") + ", 请重新解析将使用免登陆模式");
                         }
                     }
@@ -443,75 +466,75 @@ public class IzTool extends PanBase {
         }
     }
 
-    private void down(HttpResponse<Buffer> res2) {
+    private void down(HttpResponse<Buffer> res2) {
-        MultiMap headers = res2.headers();
+        MultiMap headers = res2.headers();
-        String location = headers.get("Location");
+        String location = headers.get("Location");
-        if (StringUtils.isBlank(location)) {
+        if (StringUtils.isBlank(location)) {
-            fail("{}", buildMissingLocationMessage(res2));
+            fail("{}", buildMissingLocationMessage(res2));
-            return;
+            return;
-        }
+        }
-        promise.complete(location);
+        promise.complete(location);
-    }
+    }
-
+
-    private String buildMissingLocationMessage(HttpResponse<Buffer> response) {
+    private String buildMissingLocationMessage(HttpResponse<Buffer> response) {
-        StringBuilder message = new StringBuilder("未获取到下载重定向地址");
+        StringBuilder message = new StringBuilder("未获取到下载重定向地址");
-        message.append(", HTTP ").append(response.statusCode());
+        message.append(", HTTP ").append(response.statusCode());
-
+
-        String body = null;
+        String body = null;
-        try {
+        try {
-            body = asText(response);
+            body = asText(response);
-        } catch (Exception e) {
+        } catch (Exception e) {
-            body = "<响应体读取失败: " + e.getMessage() + ">";
+            body = "<响应体读取失败: " + e.getMessage() + ">";
-        }
+        }
-
+
-        if (StringUtils.isNotBlank(body)) {
+        if (StringUtils.isNotBlank(body)) {
-            try {
+            try {
-                JsonObject json = new JsonObject(body);
+                JsonObject json = new JsonObject(body);
-                String upstreamMsg = json.getString("msg");
+                String upstreamMsg = json.getString("msg");
-                Object code = json.getValue("code");
+                Object code = json.getValue("code");
-                if (StringUtils.isNotBlank(upstreamMsg)) {
+                if (StringUtils.isNotBlank(upstreamMsg)) {
-                    message.append(", 上游返回: ").append(upstreamMsg);
+                    message.append(", 上游返回: ").append(upstreamMsg);
-                    if (code != null) {
+                    if (code != null) {
-                        message.append(" (code=").append(code).append(")");
+                        message.append(" (code=").append(code).append(")");
-                    }
+                    }
-                } else {
+                } else {
-                    message.append(", 响应体: ").append(previewBody(body));
+                    message.append(", 响应体: ").append(previewBody(body));
-                }
+                }
-            } catch (Exception ignored) {
+            } catch (Exception ignored) {
-                message.append(", 响应体: ").append(previewBody(body));
+                message.append(", 响应体: ").append(previewBody(body));
-            }
+            }
-        } else {
+        } else {
-            message.append(", 响应体为空");
+            message.append(", 响应体为空");
-        }
+        }
-
+
-        Object fileName = shareLinkInfo.getOtherParam().get("fileName");
+        Object fileName = shareLinkInfo.getOtherParam().get("fileName");
-        Object fileSize = shareLinkInfo.getOtherParam().get("fileSizeFormat");
+        Object fileSize = shareLinkInfo.getOtherParam().get("fileSizeFormat");
-        if (fileName != null) {
+        if (fileName != null) {
-            message.append(", 文件: ").append(fileName);
+            message.append(", 文件: ").append(fileName);
-        }
+        }
-        if (fileSize != null) {
+        if (fileSize != null) {
-            message.append(", 大小: ").append(fileSize);
+            message.append(", 大小: ").append(fileSize);
-        }
+        }
-        if (!hasConfiguredAuth()) {
+        if (!hasConfiguredAuth()) {
-            message.append(", 当前为免登录解析，上游可能要求登录、会员或人工处理");
+            message.append(", 当前为免登录解析，上游可能要求登录、会员或人工处理");
-        }
+        }
-        return message.toString();
+        return message.toString();
-    }
+    }
-
+
-    private boolean hasConfiguredAuth() {
+    private boolean hasConfiguredAuth() {
-        Object authObj = shareLinkInfo.getOtherParam().get("auths");
+        Object authObj = shareLinkInfo.getOtherParam().get("auths");
-        if (!(authObj instanceof MultiMap auths)) {
+        if (!(authObj instanceof MultiMap auths)) {
-            return false;
+            return false;
-        }
+        }
-        return StringUtils.isNotBlank(auths.get("username")) && StringUtils.isNotBlank(auths.get("password"));
+        return StringUtils.isNotBlank(auths.get("username")) && StringUtils.isNotBlank(auths.get("password"));
-    }
+    }
-
+
-    private String previewBody(String body) {
+    private String previewBody(String body) {
-        int maxLength = 500;
+        int maxLength = 500;
-        return body.length() <= maxLength ? body : body.substring(0, maxLength) + "...";
+        return body.length() <= maxLength ? body : body.substring(0, maxLength) + "...";
-    }
+    }
-
+
-    // 目录解析
+    // 目录解析
     @Override
     public Future<List<FileInfo>> parseFileList() {
         Promise<List<FileInfo>> promise = Promise.promise();
@@ -691,7 +714,6 @@ public class IzTool extends PanBase {
     }
 
     public static void resetToken() {
-        token = null;
+        TokenCache.removeByDiskType("iz");
-        authFlag = true;
     }
 }

parser/src/main/java/cn/qaiu/parser/impl/IzToolWithAuth.java

@@ -84,6 +84,7 @@ public class IzToolWithAuth extends PanBase {
     }
     public IzToolWithAuth(ShareLinkInfo shareLinkInfo) {
         super(shareLinkInfo);
+        IzXffHeader.apply(header);
     }
 
     String uuid = UUID.randomUUID().toString().toLowerCase(); // 也可以使用 UUID.randomUUID().toString()
@@ -213,8 +214,8 @@ public class IzToolWithAuth extends PanBase {
                 if (token == null) {
                     // 执行登录
                     login(tsEncode2, auths).onFailure(failRes-> {
-                        log.warn("登录失败: {}", failRes.getMessage());
+                        log.warn("登录失败，回退免登录: {}", failRes.getMessage());
-                        fail(failRes.getMessage());
+                        downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
                     }).onSuccess(r-> {
                         httpRequest.setTemplateParam("appToken", token)
                                 .putHeaders(header);
@@ -229,8 +230,8 @@ public class IzToolWithAuth extends PanBase {
                                 // log.info("res: {}",asJson(res));
                                 if (asJson(res).getInteger("code") != 200) {
                                     login(tsEncode2, auths).onFailure(failRes -> {
-                                        log.warn("重新登录失败: {}", failRes.getMessage());
+                                        log.warn("重新登录失败，回退免登录: {}", failRes.getMessage());
-                                        fail(failRes.getMessage());
+                                        downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
                                     }).onSuccess(r-> {
                                         httpRequest.setTemplateParam("appToken", token)
                                                 .putHeaders(header);
@@ -246,29 +247,27 @@ public class IzToolWithAuth extends PanBase {
             } else {
                 // authFlag 为 false，使用免登录解析
                 log.debug("authFlag=false，使用免登录解析");
-                webClientSession.getAbs(UriTemplate.of(SECOND_REQUEST_URL))
+                downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
-                        .putHeaders(header)
-                        .setTemplateParam("fidEncode", fidEncode)
-                        .setTemplateParam("uuid", uuid)
-                        .setTemplateParam("ts", tsEncode2)
-                        .setTemplateParam("auth", auth)
-                        .setTemplateParam("dataKey", dataKey).send()
-                        .onSuccess(this::down).onFailure(handleFail("请求2"));
             }
         } else {
             // 没有认证信息，使用免登录解析
             log.debug("无认证信息，使用免登录解析");
-            webClientSession.getAbs(UriTemplate.of(SECOND_REQUEST_URL))
+            downloadAnonymous(fidEncode, tsEncode2, auth, dataKey);
-                    .putHeaders(header)
-                    .setTemplateParam("fidEncode", fidEncode)
-                    .setTemplateParam("uuid", uuid)
-                    .setTemplateParam("ts", tsEncode2)
-                    .setTemplateParam("auth", auth)
-                    .setTemplateParam("dataKey", dataKey).send()
-                    .onSuccess(this::down).onFailure(handleFail("请求2"));
         }
     }
 
+    private void downloadAnonymous(String fidEncode, String tsEncode2, String auth, String dataKey) {
+        log.debug("使用免登录解析");
+        webClientSession.getAbs(UriTemplate.of(SECOND_REQUEST_URL))
+                .putHeaders(header)
+                .setTemplateParam("fidEncode", fidEncode)
+                .setTemplateParam("uuid", uuid)
+                .setTemplateParam("ts", tsEncode2)
+                .setTemplateParam("auth", auth)
+                .setTemplateParam("dataKey", dataKey).send()
+                .onSuccess(this::down).onFailure(handleFail("请求2"));
+    }
+
     private Future<Void> login(String tsEncode2, MultiMap auths) {
         Promise<Void> promise1 = Promise.promise();
         webClientSession.postAbs(UriTemplate.of(LOGIN_URL))

parser/src/main/java/cn/qaiu/parser/impl/IzXffHeader.java

@@ -0,0 +1,60 @@
+package cn.qaiu.parser.impl;
+
+import io.vertx.core.MultiMap;
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.concurrent.ThreadLocalRandom;
+
+/**
+ * 蓝奏云优享 X-Forwarded-For 配置。
+ * <p>
+ * 读取系统属性 {@code nfd.iz.xff}，其次环境变量 {@code NFD_IZ_XFF}：
+ * <ul>
+ *     <li>未设置 / 空 / {@code off}：不发送该头（默认）</li>
+ *     <li>{@code random}：每次创建解析器时随机一个国内常见网段 IP</li>
+ *     <li>其它值：原样作为头的值，例如 {@code 113.96.181.18}</li>
+ * </ul>
+ */
+public final class IzXffHeader {
+
+    public static final String PROP = "nfd.iz.xff";
+    public static final String ENV = "NFD_IZ_XFF";
+    private static final String HEADER = "X-Forwarded-For";
+
+    /** 国内运营商常见 /8 段首字节 */
+    private static final int[] CN_PREFIX = {36, 39, 42, 58, 59, 60, 61, 101, 106, 110, 111, 112, 113, 114,
+            115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 175, 180, 182, 183, 202, 210, 211, 218, 219, 220, 221, 222, 223};
+
+    private IzXffHeader() {
+    }
+
+    static String configured() {
+        String v = System.getProperty(PROP);
+        if (StringUtils.isBlank(v)) {
+            v = System.getenv(ENV);
+        }
+        return v == null ? "" : v.trim();
+    }
+
+    /** 根据配置得到头的值，返回 null 表示不发送 */
+    static String resolve(String mode) {
+        if (StringUtils.isBlank(mode) || "off".equalsIgnoreCase(mode)) {
+            return null;
+        }
+        if ("random".equalsIgnoreCase(mode)) {
+            ThreadLocalRandom r = ThreadLocalRandom.current();
+            return CN_PREFIX[r.nextInt(CN_PREFIX.length)] + "." + r.nextInt(256) + "." + r.nextInt(256) + "." + (1 + r.nextInt(254));
+        }
+        return mode;
+    }
+
+    /** 按当前配置写入或移除请求头 */
+    public static void apply(MultiMap headers) {
+        String value = resolve(configured());
+        if (value == null) {
+            headers.remove(HEADER);
+        } else {
+            headers.set(HEADER, value);
+        }
+    }
+}

parser/src/main/java/cn/qaiu/parser/impl/LzTool.java

@@ -7,6 +7,7 @@ import cn.qaiu.parser.PanBase;
 import cn.qaiu.util.*;
 import io.netty.handler.codec.http.cookie.DefaultCookie;
 import io.vertx.core.Future;
+import io.vertx.core.Handler;
 import io.vertx.core.MultiMap;
 import io.vertx.core.Promise;
 import io.vertx.core.buffer.Buffer;
@@ -41,9 +42,37 @@ public class LzTool extends PanBase {
 
     private final WebClientSession webClientSession;
 
-    /** 实测服务器出口 IP 上 wwww.lanzoux.com 可用，且个性域名目录内文件 ID 也能打开。 */
+    /**
-    public static final String SHARE_URL_PREFIX = "https://wwww.lanzoux.com/";
+     * 没有原始分享页主机时才使用（目录内文件 ID、shareKey 占位）。
-    private static final String SHARE_ORIGIN = "https://wwww.lanzoux.com";
+     * 与 PanDomainTemplate.LZ 标准模板一致：{@code https://w1.lanzn.com/{shareKey}}。
+     * 已有分享页不要改写到 wwww.lanzoux.com，部分出口连四个 w 的域名会超时。
+     */
+    public static final String SHARE_URL_PREFIX = "https://w1.lanzn.com/";
+    /** 页面 URL 解析失败时的源站兜底，与 {@link #SHARE_URL_PREFIX} 同主机。 */
+    private static final String SHARE_ORIGIN = "https://w1.lanzn.com";
+    /**
+     * 目录 filemoreajax.php 换域顺序。个性域名上会立刻返回「已超时」。
+     * wwww 只放最后，避免单一主机超时直接失败。
+     * 文件 ajax 走 {@link #FILE_AJAX_FALLBACK_ORIGINS}，不要把 apifile 混进目录列表。
+     */
+    static final List<String> AJAX_FALLBACK_ORIGINS = List.of(
+            "https://w1.lanzn.com",
+            "https://www.lanzoux.com",
+            "https://wwww.lanzoux.com"
+    );
+    /**
+     * 文件页 iframe / 密码页里的 ajaxfile.php 经常是绝对地址
+     * {@code https://apifile.lanzouw.com/ajaxfile.php?file=…}。
+     * 相对路径打到页面源站或 w1/www 会空响应。apifile 放在文件 ajax 兜底的最前，
+     * 页面源站空响应后立刻换过去，不在四 w 上耗光超时。
+     */
+    static final String APIFILE_ORIGIN = "https://apifile.lanzouw.com";
+    static final List<String> FILE_AJAX_FALLBACK_ORIGINS = List.of(
+            APIFILE_ORIGIN,
+            "https://w1.lanzn.com",
+            "https://www.lanzoux.com",
+            "https://wwww.lanzoux.com"
+    );
     /** 分享页 / ajax 请求超时 */
     private static final long REQUEST_TIMEOUT = 8000;
     /** 下载域跳转与二次验证超时，链路更长 */
@@ -54,6 +83,10 @@ public class LzTool extends PanBase {
     private static final Pattern P_AJAXDATA = Pattern.compile("ajaxdata\\s*=\\s*'([^']+)'");
     private static final Pattern P_WEBSIGN = Pattern.compile("'websign'\\s*:\\s*'([^']*)'");
     private static final Pattern P_WEBPAGE = Pattern.compile("[?&]webpage=([^&\"'\\s#]+)");
+    /** 页面脚本里的绝对 ajax，例如 https://apifile.lanzouw.com/ajaxfile.php?file=123 */
+    private static final Pattern P_AJAX_ABSOLUTE = Pattern.compile(
+            "['\"]((?:https?:)?//[^'\"\\s<>]+/ajax(?:m|file)\\.php\\?file=\\d+)['\"]",
+            Pattern.CASE_INSENSITIVE);
     private static final Pattern P_AJAX_PATH = Pattern.compile("(?:['\"/]|^)(ajax(?:m|file)\\.php\\?file=\\d+)");
     private static final Pattern P_SIGN = Pattern.compile("'sign'\\s*:\\s*'([^']+)'");
     private static final Pattern P_ISNGIS = Pattern.compile("var\\s+isngis\\s*=\\s*'([^']+)'");
@@ -259,18 +292,17 @@ public class LzTool extends PanBase {
         return path.isEmpty() || "-".equals(path);
     }
 
-    /** 统一改写到 {@link #SHARE_URL_PREFIX}，只保留分享路径。 */
+    /**
-    private String resolveShareUrl() {
+     * 分享页 / 目录页 GET 保留原始主机和路径。
-        String u = shareLinkInfo.getShareUrl();
+     * 只有分享路径缺失（空链接、shareKey 占位）时才落到 {@link #SHARE_URL_PREFIX}。
+     */
+    static String resolveSharePageUrl(String shareUrl, String standardUrl, String shareKey) {
+        String u = shareUrl;
         if (isPlaceholderShare(u)) {
-            u = shareLinkInfo.getStandardUrl();
+            u = standardUrl;
         }
         if (isPlaceholderShare(u)) {
-            String key = shareLinkInfo.getShareKey();
+            return canonicalShareUrl(shareKey, null);
-            if (key == null || key.isBlank() || "-".equals(key)) {
-                return SHARE_URL_PREFIX;
-            }
-            return SHARE_URL_PREFIX + key;
         }
         int q = u.indexOf('?');
         String query = null;
@@ -284,10 +316,167 @@ public class LzTool extends PanBase {
         }
         int pathStart = u.indexOf('/', schemeEnd + 3);
         if (pathStart < 0) {
-            String key = shareLinkInfo.getShareKey();
+            String base = u.endsWith("/") ? u : u + "/";
-            return appendWebpage(SHARE_URL_PREFIX + (key == null ? "" : key), query);
+            if (shareKey == null || shareKey.isBlank() || "-".equals(shareKey)) {
+                return appendWebpage(base, query);
+            }
+            return appendWebpage(base + shareKey, query);
         }
-        return appendWebpage(SHARE_ORIGIN + u.substring(pathStart), query);
+        return appendWebpage(u, query);
+    }
+
+    private String resolveShareUrl() {
+        return resolveSharePageUrl(
+                shareLinkInfo.getShareUrl(),
+                shareLinkInfo.getStandardUrl(),
+                shareLinkInfo.getShareKey());
+    }
+
+    /** 无原始主机时用标准下载域拼分享路径，不再写死 wwww.lanzoux.com。 */
+    private static String canonicalShareUrl(String shareKey, String query) {
+        if (shareKey == null || shareKey.isBlank() || "-".equals(shareKey)) {
+            return appendWebpage(SHARE_URL_PREFIX, query);
+        }
+        return appendWebpage(SHARE_URL_PREFIX + shareKey, query);
+    }
+
+    /**
+     * 目录内文件页主机：沿用已有分享主机，否则用 {@link #SHARE_URL_PREFIX}。
+     */
+    static String sharePageHostBase(String shareUrl, String standardUrl) {
+        String u = !isPlaceholderShare(shareUrl) ? shareUrl : standardUrl;
+        if (!isPlaceholderShare(u)) {
+            String origin = normalizeOrigin(originOf(u, SHARE_ORIGIN));
+            return origin + "/";
+        }
+        return SHARE_URL_PREFIX;
+    }
+
+    /**
+     * 目录 filemore 的 POST 主机顺序：分享页源站优先（普通节点通常可用），
+     * 然后是稳定下载域。wwww.lanzoux.com 固定排在最后。
+     */
+    static List<String> ajaxOrigins(String pageUrl) {
+        List<String> origins = new ArrayList<>();
+        addAjaxOrigin(origins, normalizeOrigin(originOf(pageUrl, "")));
+        for (String candidate : AJAX_FALLBACK_ORIGINS) {
+            addAjaxOrigin(origins, candidate);
+        }
+        return origins;
+    }
+
+    /**
+     * 文件 ajax 主机顺序。页面里若写出绝对 ajax URL，该主机最先尝试；
+     * 否则先打页面源站。空响应后再试 {@link #APIFILE_ORIGIN}，四 w 仍在最后。
+     *
+     * @param ajaxTarget {@link #fileAjaxTarget} 的返回值，绝对 URL 或相对路径；可为 null
+     */
+    static List<String> fileAjaxOrigins(String pageUrl, String ajaxTarget) {
+        List<String> origins = new ArrayList<>();
+        addAjaxOrigin(origins, originFromAjaxTarget(ajaxTarget));
+        addAjaxOrigin(origins, normalizeOrigin(originOf(pageUrl, "")));
+        for (String candidate : FILE_AJAX_FALLBACK_ORIGINS) {
+            addAjaxOrigin(origins, candidate);
+        }
+        return origins;
+    }
+
+    /**
+     * 从分享页或 iframe HTML 取出文件 ajax 地址。
+     * 绝对 URL（含协议相对 {@code //host/...}）原样返回；否则返回以 {@code /} 开头的相对路径。
+     */
+    static String fileAjaxTarget(String html) {
+        if (html == null || html.isEmpty()) {
+            return null;
+        }
+        Matcher abs = P_AJAX_ABSOLUTE.matcher(html);
+        if (abs.find()) {
+            String url = abs.group(1);
+            if (url.startsWith("//")) {
+                url = "https:" + url;
+            }
+            return url;
+        }
+        Matcher ajax = P_AJAX_PATH.matcher(html);
+        if (!ajax.find()) {
+            return null;
+        }
+        return "/" + ajax.group(1);
+    }
+
+    private static void addAjaxOrigin(List<String> origins, String origin) {
+        if (origin != null && origin.contains("://") && !origins.contains(origin)) {
+            origins.add(origin);
+        }
+    }
+
+    private static String originFromAjaxTarget(String ajaxTarget) {
+        if (ajaxTarget == null) {
+            return "";
+        }
+        if (ajaxTarget.startsWith("http://") || ajaxTarget.startsWith("https://")) {
+            return normalizeOrigin(originOf(ajaxTarget, ""));
+        }
+        return "";
+    }
+
+    private static String normalizeOrigin(String origin) {
+        if (origin == null) {
+            return "";
+        }
+        String o = origin.trim();
+        while (o.endsWith("/")) {
+            o = o.substring(0, o.length() - 1);
+        }
+        return o;
+    }
+
+    /**
+     * 个性域名常见 {@code inf=已超时}，或响应根本不是 JSON。这类结果说明当前主机不可用，应换下一个域名。
+     * 密码错误、分享失效等业务错误不换域名。
+     */
+    static boolean ajaxResponseShouldFallback(String text) {
+        if (text == null || text.isBlank()) {
+            return true;
+        }
+        JsonObject json = parseLzJson(text);
+        if (json == null) {
+            return true;
+        }
+        Integer zt = jsonInt(json, "zt");
+        if (zt != null && zt == 1) {
+            return false;
+        }
+        String info = ajaxInfoText(json);
+        return info != null && info.contains("超时");
+    }
+
+    private static Integer jsonInt(JsonObject json, String key) {
+        Object v = json.getValue(key);
+        if (v instanceof Number n) {
+            return n.intValue();
+        }
+        if (v instanceof CharSequence) {
+            try {
+                return Integer.parseInt(v.toString().trim());
+            } catch (NumberFormatException ignored) {
+                return null;
+            }
+        }
+        return null;
+    }
+
+    private static String ajaxInfoText(JsonObject json) {
+        for (String key : new String[]{"inf", "info"}) {
+            Object v = json.getValue(key);
+            if (v instanceof CharSequence) {
+                String s = v.toString().trim();
+                if (!s.isEmpty() && !"null".equalsIgnoreCase(s)) {
+                    return s;
+                }
+            }
+        }
+        return null;
     }
 
     /** 目录文件 ID 可能带 webpage=，必须保留；pwd 走独立字段，不拼进 URL。 */
@@ -411,8 +600,12 @@ public class LzTool extends PanBase {
         return true;
     }
 
-    /** 页面里提取出的 ajax 调用：相对路径 + 表单参数。 */
+    /** 页面里提取出的 ajax 调用。absoluteUrl 非空时优先打该主机。 */
-    private record AjaxCall(String path, Map<String, String> form) {
+    private record AjaxCall(String path, Map<String, String> form, String absoluteUrl) {
+        private AjaxCall(String path, Map<String, String> form) {
+            this(path, form, null);
+        }
+
         MultiMap toForm() {
             MultiMap m = MultiMap.caseInsensitiveMultiMap();
             form.forEach(m::set);
@@ -424,11 +617,12 @@ public class LzTool extends PanBase {
         if (html == null || html.isEmpty()) {
             return null;
         }
-        Matcher ajax = P_AJAX_PATH.matcher(html);
+        String target = fileAjaxTarget(html);
-        if (!ajax.find()) {
+        if (target == null) {
             return null;
         }
-        String ajaxPath = ajax.group(1);
+        String absolute = target.startsWith("http://") || target.startsWith("https://") ? target : null;
+        String ajaxPath = absolute == null ? target : pathOfAbsolute(absolute);
         Map<String, String> data = new LinkedHashMap<>();
         data.put("action", "downprocess");
         Matcher wp = P_WP_SIGN.matcher(html);
@@ -482,7 +676,23 @@ public class LzTool extends PanBase {
                 data.put("signs", ad2.group(1));
             }
         }
-        return new AjaxCall("/" + ajaxPath, data);
+        return new AjaxCall(ajaxPath, data, absolute);
+    }
+
+    private static String pathOfAbsolute(String url) {
+        try {
+            URL u = new URL(url);
+            String path = u.getPath() == null ? "" : u.getPath();
+            if (u.getQuery() != null && !u.getQuery().isEmpty()) {
+                path = path + "?" + u.getQuery();
+            }
+            if (!path.startsWith("/")) {
+                path = "/" + path;
+            }
+            return path;
+        } catch (Exception e) {
+            return url;
+        }
     }
 
     private static AjaxCall extractFolderAjax(String html, String pwd) {
@@ -576,12 +786,58 @@ public class LzTool extends PanBase {
 
     private void getDownURL(String referer, AjaxCall call) {
         MultiMap headers = HeaderUtils.parseHeaders(DOWN_AJAX_HEADERS);
-        // 个性域名 ajaxfile.php 会立刻 inf=已超时；POST 必须打 wwww。iframe 请求 Referer 用 iframe 地址。
+        // 文件 ajax 优先用页面里的绝对地址（常见 apifile.lanzouw.com）。
-        headers.set("referer", referer != null && !referer.isBlank() ? referer : resolveShareUrl());
+        // 页面源站空响应再换 FILE_AJAX_FALLBACK_ORIGINS，wwww 仍在最后。
-        String url = joinUrl(SHARE_ORIGIN + "/", call.path());
+        // iframe / 分享页的 Referer 保持原主机，不把页面 GET 改写到 wwww。
+        String page = referer != null && !referer.isBlank() ? referer : resolveShareUrl();
+        headers.set("referer", page);
+        String target = call.absoluteUrl() != null ? call.absoluteUrl() : call.path();
+        postAjaxAt(fileAjaxOrigins(page, target), 0, call, headers, this::handleAjaxDownResponse, null);
+    }
+
+    /**
+     * 依次向 {@link #ajaxOrigins} 发 POST。连接失败或「已超时」换下一个主机；
+     * wwww.lanzoux.com 只在最后尝试。业务错误（密码、失效）立即返回。
+     */
+    private void postAjaxWithFallback(String pageUrl, AjaxCall call, MultiMap headers,
+                                       Handler<String> onBody, Handler<Throwable> onFailure) {
+        postAjaxAt(ajaxOrigins(pageUrl), 0, call, headers, onBody, onFailure);
+    }
+
+    private void postAjaxAt(List<String> origins, int index, AjaxCall call, MultiMap headers,
+                             Handler<String> onBody, Handler<Throwable> onFailure) {
+        if (index >= origins.size()) {
+            String msg = "蓝奏 ajax 全部域名均失败";
+            if (onFailure != null) {
+                onFailure.handle(new RuntimeException(msg));
+            } else {
+                fail(msg);
+            }
+            return;
+        }
+        String url = joinUrl(origins.get(index) + "/", call.path());
+        boolean hasNext = index + 1 < origins.size();
         postFormWithArg1Retry(url, headers, call.toForm())
-                .onSuccess(this::handleAjaxDownResponse)
+                .onSuccess(text -> {
-                .onFailure(handleFail(url));
+                    if (hasNext && ajaxResponseShouldFallback(text)) {
+                        log.warn("蓝奏 ajax {} 不可用，改试下一域名", url);
+                        postAjaxAt(origins, index + 1, call, headers, onBody, onFailure);
+                        return;
+                    }
+                    onBody.handle(text);
+                })
+                .onFailure(err -> {
+                    if (hasNext) {
+                        log.warn("蓝奏 ajax {} 请求失败: {}，改试下一域名", url, err.getMessage());
+                        postAjaxAt(origins, index + 1, call, headers, onBody, onFailure);
+                        return;
+                    }
+                    if (onFailure != null) {
+                        onFailure.handle(err);
+                    } else {
+                        handleFail(url).handle(err);
+                    }
+                });
     }
 
     private void handleAjaxDownResponse(String text) {
@@ -913,10 +1169,9 @@ public class LzTool extends PanBase {
             }
             log.debug("解析参数: {}", call.form());
 
-            String url = joinUrl(originOf(sUrl, SHARE_ORIGIN) + "/", call.path());
+            postAjaxWithFallback(sUrl, call, folderListHeaders(sUrl),
-            postFormWithArg1Retry(url, folderListHeaders(sUrl), call.toForm())
+                    body -> handleFileListResponse(body, listPromise),
-                    .onSuccess(body -> handleFileListResponse(body, listPromise))
+                    listPromise::fail);
-                    .onFailure(listPromise::fail);
         } catch (ScriptException | NoSuchMethodException | RuntimeException e) {
             listPromise.fail(e);
         }
@@ -1069,7 +1324,7 @@ public class LzTool extends PanBase {
         if (webpage == null || webpage.isBlank()) {
             webpage = extractWebpage(shareLinkInfo.getShareUrl(), null);
         }
-        String fileUrl = SHARE_URL_PREFIX + id;
+        String fileUrl = sharePageHostBase(shareLinkInfo.getShareUrl(), shareLinkInfo.getStandardUrl()) + id;
         if (webpage != null && !webpage.isBlank()) {
             fileUrl = fileUrl + "?webpage=" + webpage;
         }

parser/src/test/java/cn/qaiu/parser/impl/IzXffHeaderTest.java

@@ -0,0 +1,36 @@
+package cn.qaiu.parser.impl;
+
+import io.vertx.core.MultiMap;
+import org.junit.Test;
+
+import static org.junit.Assert.*;
+
+public class IzXffHeaderTest {
+    @Test
+    public void offByDefault() {
+        assertNull(IzXffHeader.resolve(null));
+        assertNull(IzXffHeader.resolve(""));
+        assertNull(IzXffHeader.resolve("OFF"));
+    }
+
+    @Test
+    public void literalAndRandom() {
+        assertEquals("113.96.181.18", IzXffHeader.resolve("113.96.181.18"));
+        String ip = IzXffHeader.resolve("random");
+        assertTrue(ip, ip.matches("\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"));
+    }
+
+    @Test
+    public void applyRemovesWhenOff() {
+        MultiMap h = MultiMap.caseInsensitiveMultiMap().set("X-Forwarded-For", "1.1.1.1");
+        System.clearProperty(IzXffHeader.PROP);
+        if (System.getenv(IzXffHeader.ENV) == null) {
+            IzXffHeader.apply(h);
+            assertFalse(h.contains("X-Forwarded-For"));
+        }
+        System.setProperty(IzXffHeader.PROP, "8.8.8.8");
+        IzXffHeader.apply(h);
+        assertEquals("8.8.8.8", h.get("X-Forwarded-For"));
+        System.clearProperty(IzXffHeader.PROP);
+    }
+}

parser/src/test/java/cn/qaiu/parser/impl/LzToolShareUrlTest.java

@@ -0,0 +1,178 @@
+package cn.qaiu.parser.impl;
+
+import org.junit.Test;
+
+import java.util.List;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * 个性域名 a.lanzouw.com 不能被改写到 wwww.lanzoux.com（四个 w）。
+ * 部分出口连不上四 w，页面请求会超时；ajax 只把四 w 当作最后兜底。
+ */
+public class LzToolShareUrlTest {
+
+    @Test
+    public void personalDomainPageStaysOffWwww() {
+        String resolved = LzTool.resolveSharePageUrl(
+                "https://a.lanzouw.com/xxx",
+                "https://w1.lanzn.com/xxx",
+                "xxx");
+        assertEquals("https://a.lanzouw.com/xxx", resolved);
+        assertFalse(resolved.contains("wwww.lanzoux.com"));
+    }
+
+    @Test
+    public void folderPageKeepsOriginalHost() {
+        String resolved = LzTool.resolveSharePageUrl(
+                "https://a.lanzouw.com/b710887",
+                "https://w1.lanzn.com/b710887",
+                "b710887");
+        assertEquals("https://a.lanzouw.com/b710887", resolved);
+    }
+
+    @Test
+    public void nodeShareIsNotRewrittenToWwww() {
+        String resolved = LzTool.resolveSharePageUrl(
+                "https://wwn.lanzouy.com/ihLkw1gezutg",
+                "https://w1.lanzn.com/ihLkw1gezutg",
+                "ihLkw1gezutg");
+        assertEquals("https://wwn.lanzouy.com/ihLkw1gezutg", resolved);
+    }
+
+    @Test
+    public void webpageQueryStaysOnOriginalHost() {
+        String resolved = LzTool.resolveSharePageUrl(
+                "https://a.lanzouw.com/iabc?webpage=wp1&pwd=secret",
+                "https://w1.lanzn.com/iabc",
+                "iabc");
+        assertEquals("https://a.lanzouw.com/iabc?webpage=wp1", resolved);
+    }
+
+    @Test
+    public void placeholderUsesStandardHostNotWwww() {
+        assertEquals("https://w1.lanzn.com/", LzTool.SHARE_URL_PREFIX);
+        assertFalse(LzTool.SHARE_URL_PREFIX.contains("wwww"));
+        String resolved = LzTool.resolveSharePageUrl(
+                "https://w1.lanzn.com/-",
+                "https://w1.lanzn.com/-",
+                "iFileId");
+        assertEquals("https://w1.lanzn.com/iFileId", resolved);
+        assertFalse(resolved.contains("wwww.lanzoux.com"));
+    }
+
+    @Test
+    public void missingShareUrlKeepsRealStandardHost() {
+        String resolved = LzTool.resolveSharePageUrl(
+                null,
+                "https://www.lanzoux.com/iabc",
+                "iabc");
+        assertEquals("https://www.lanzoux.com/iabc", resolved);
+    }
+
+    @Test
+    public void ajaxFallbackOrderPutsWwwwLast() {
+        List<String> fallback = LzTool.AJAX_FALLBACK_ORIGINS;
+        assertEquals("https://w1.lanzn.com", fallback.get(0));
+        assertEquals("https://www.lanzoux.com", fallback.get(1));
+        assertEquals("https://wwww.lanzoux.com", fallback.get(fallback.size() - 1));
+
+        List<String> origins = LzTool.ajaxOrigins("https://a.lanzouw.com/xxx");
+        assertEquals("https://a.lanzouw.com", origins.get(0));
+        assertEquals("https://w1.lanzn.com", origins.get(1));
+        assertEquals("https://www.lanzoux.com", origins.get(2));
+        assertEquals("https://wwww.lanzoux.com", origins.get(origins.size() - 1));
+        assertTrue(origins.indexOf("https://wwww.lanzoux.com")
+                > origins.indexOf("https://w1.lanzn.com"));
+    }
+
+    @Test
+    public void ajaxOriginsDoNotDuplicateKnownHost() {
+        List<String> origins = LzTool.ajaxOrigins("https://www.lanzoux.com/iabc");
+        assertEquals(3, origins.size());
+        assertEquals("https://www.lanzoux.com", origins.get(0));
+        assertEquals("https://w1.lanzn.com", origins.get(1));
+        assertEquals("https://wwww.lanzoux.com", origins.get(2));
+    }
+
+    @Test
+    public void timeoutAjaxFallsBackButBusinessErrorDoesNot() {
+        assertTrue(LzTool.ajaxResponseShouldFallback("{\"zt\":0,\"inf\":\"已超时\"}"));
+        assertTrue(LzTool.ajaxResponseShouldFallback("{\"info\":\"请求超时\"}"));
+        assertTrue(LzTool.ajaxResponseShouldFallback(""));
+        assertTrue(LzTool.ajaxResponseShouldFallback("<html>blocked</html>"));
+        assertFalse(LzTool.ajaxResponseShouldFallback("{\"zt\":0,\"inf\":\"密码错误\"}"));
+        assertFalse(LzTool.ajaxResponseShouldFallback(
+                "{\"zt\":1,\"inf\":\"name.zip\",\"dom\":\"https://x\",\"url\":\"abc\"}"));
+    }
+
+    @Test
+    public void filePagePrefersExistingHostOverWwww() {
+        assertEquals("https://a.lanzouw.com/",
+                LzTool.sharePageHostBase("https://a.lanzouw.com/b123", "https://w1.lanzn.com/b123"));
+        assertEquals("https://w1.lanzn.com/",
+                LzTool.sharePageHostBase("https://w1.lanzn.com/-", "https://w1.lanzn.com/-"));
+        assertFalse(LzTool.sharePageHostBase("https://a.lanzouw.com/b123", null).contains("wwww"));
+    }
+
+    @Test
+    public void absoluteAjaxUrlIsKeptAndTriedFirst() {
+        String html = """
+                url : 'https://apifile.lanzouw.com/ajaxfile.php?file=320665771',
+                data : { 'action':'downprocess','sign':isngis,'kd':kdns,'p':pwd, },
+                """;
+        String target = LzTool.fileAjaxTarget(html);
+        assertEquals("https://apifile.lanzouw.com/ajaxfile.php?file=320665771", target);
+
+        List<String> origins = LzTool.fileAjaxOrigins(
+                "https://wwaqg.lanzouu.com/iqouM49vy9ib", target);
+        assertEquals("https://apifile.lanzouw.com", origins.get(0));
+        assertTrue(origins.contains("https://wwaqg.lanzouu.com"));
+        assertEquals("https://wwww.lanzoux.com", origins.get(origins.size() - 1));
+        assertTrue(origins.indexOf("https://apifile.lanzouw.com")
+                < origins.indexOf("https://wwaqg.lanzouu.com"));
+        assertTrue(origins.indexOf("https://wwww.lanzoux.com")
+                > origins.indexOf("https://w1.lanzn.com"));
+        assertEquals(1, origins.stream().filter("https://apifile.lanzouw.com"::equals).count());
+    }
+
+    @Test
+    public void protocolRelativeAjaxBecomesHttps() {
+        String html = "url : '//apifile.lanzouw.com/ajaxfile.php?file=9',";
+        assertEquals("https://apifile.lanzouw.com/ajaxfile.php?file=9", LzTool.fileAjaxTarget(html));
+    }
+
+    @Test
+    public void absoluteAjaxWinsOverRelativePathInSamePage() {
+        String html = """
+                //data : { url : '/ajaxfile.php?file=1' }
+                url : "https://apifile.lanzouw.com/ajaxm.php?file=42",
+                """;
+        assertEquals("https://apifile.lanzouw.com/ajaxm.php?file=42", LzTool.fileAjaxTarget(html));
+    }
+
+    @Test
+    public void relativeFileAjaxFallsThroughToApifileBeforeWwww() {
+        String html = "url : '/ajaxfile.php?file=150233466',";
+        assertEquals("/ajaxfile.php?file=150233466", LzTool.fileAjaxTarget(html));
+
+        List<String> origins = LzTool.fileAjaxOrigins("https://a.lanzouw.com/xxx", LzTool.fileAjaxTarget(html));
+        assertEquals("https://a.lanzouw.com", origins.get(0));
+        assertEquals("https://apifile.lanzouw.com", origins.get(1));
+        assertEquals("https://wwww.lanzoux.com", origins.get(origins.size() - 1));
+        assertTrue(origins.indexOf("https://apifile.lanzouw.com")
+                < origins.indexOf("https://wwww.lanzoux.com"));
+        assertFalse(LzTool.ajaxOrigins("https://a.lanzouw.com/xxx").contains("https://apifile.lanzouw.com"));
+    }
+
+    @Test
+    public void missingAjaxTargetStillPutsApifileBeforeWwww() {
+        List<String> origins = LzTool.fileAjaxOrigins("https://www.lanzoux.com/ihLkw1gezutg", null);
+        assertEquals("https://www.lanzoux.com", origins.get(0));
+        assertEquals("https://apifile.lanzouw.com", origins.get(1));
+        assertEquals("https://wwww.lanzoux.com", origins.get(origins.size() - 1));
+        assertFalse(origins.get(0).contains("wwww"));
+    }
+}

pom.xml

@@ -17,7 +17,7 @@
     </modules>
 
     <properties>
-        <revision>0.4.6</revision>
+        <revision>0.4.8</revision>
         <java.version>17</java.version>
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>

web-front/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nfd-web",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "private": true,
   "scripts": {
     "serve": "vue-cli-service serve",