Google Docs插件onOpen事件遭虚假用户频繁触发，如何拦截？

一、先检查脚本是否公开 #

• 打开Google Apps Script编辑器，点击左侧齿轮图标进入「项目设置」，查看「共享权限」，确认是否设置为“任何人可查看/编辑”
• 若Add-on已发布到Marketplace，进入发布页面查看受众范围，是否为公开可见

二、拦截虚假用户的实用方案 #

1. 延迟注册到用户实际操作时 #

虚假账号仅触发onOpen就停止，因此不要在onOpen中直接执行注册逻辑，改为用户主动触发插件功能（如打开侧边栏、点击菜单）时再注册：

function onOpen() {
  // 仅添加插件菜单，不执行注册
  DocumentApp.getUi().createMenu('我的插件')
    .addItem('启动插件', 'initPlugin')
    .addToUi();
}

function initPlugin() {
  // 此处执行用户注册逻辑
  registerValidUser();
  // 打开插件侧边栏或执行其他功能
  DocumentApp.getUi().showSidebar(HtmlService.createHtmlOutput('欢迎使用'));
}

2. 基于邮箱特征的正则过滤 #

针对虚假账号“固定前缀+变体后缀/数字”的特征，用正则表达式识别并拦截：

function isSuspiciousEmail(email) {
  // 可根据实际观察到的虚假账号模式调整正则规则
  const suspiciousRegexes = [
    /^[a-z]{6,}[0-9]{2,}@gmail\.com$/, // 长字母前缀+多位数字后缀
    /^[a-z]+[a-z0-9]{4,}@gmail\.com$/   // 基础前缀+长混合变体后缀
  ];
  return suspiciousRegexes.some(regex => regex.test(email.toLowerCase()));
}

function registerValidUser() {
  const userEmail = Session.getActiveUser().getEmail();
  if (isSuspiciousEmail(userEmail)) {
    console.log(`拦截可疑账号: ${userEmail}`);
    return;
  }
  // 正常注册逻辑
  // ...
}

3. 添加频率限制 #

记录账号的触发频率，短时间内多次触发的直接拦截，可使用Google Sheets或数据库存储触发记录：

function checkRateLimit(email) {
  const rateLimitSheet = SpreadsheetApp.openById('你的记录表格ID').getSheetByName('RateLimitLogs');
  const logs = rateLimitSheet.getDataRange().getValues();
  const now = Date.now();
  const interval = 5 * 60 * 1000; // 5分钟内只允许一次触发

  for (const row of logs) {
    if (row[0] === email && now - row[1].getTime() < interval) {
      return true; // 超过频率限制，拦截
    }
  }
  // 更新触发记录
  rateLimitSheet.appendRow([email, new Date()]);
  return false;
}

4. 增加用户交互验证 #

在插件首次启动时添加简单的人机交互（如点击确认按钮），自动脚本无法完成该操作：

• 在侧边栏HTML中添加确认按钮，点击后才触发注册：

<!-- 侧边栏HTML -->
<button onclick="confirmUsage()">确认使用插件</button>
<script>
  function confirmUsage() {
    google.script.run.registerValidUser();
    document.body.innerHTML = '<p>已完成注册</p>';
  }
</script>

三、提供的脚本执行记录 #

—   onOpen  Simple Trigger  Nov 12, 2023, 4:38:06 PM    0.502 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:36:47 PM    0.506 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:36:36 PM    0.823 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:34:20 PM    0.651 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:33:27 PM    0.59 s  
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:30:48 PM    0.723 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:28:57 PM    0.5 s   
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:28:51 PM    0.469 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:28:40 PM    0.558 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:28:35 PM    0.505 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:21:08 PM    0.693 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:16:18 PM    0.481 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:14:31 PM    1.332 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:13:58 PM    0.521 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:12:18 PM    0.511 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:09:19 PM    0.469 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:03:59 PM    0.477 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:03:06 PM    0.74 s  
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 4:03:03 PM    0.48 s  
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 3:48:43 PM    0.46 s  
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 3:48:40 PM    0.661 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 3:43:44 PM    0.453 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 3:42:57 PM    0.731 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 3:42:24 PM    0.708 s 
Completed
—   onOpen  Simple Trigger  Nov 12, 2023, 3:42:12 PM    0.415 s 
Completed

内容的提问来源于stack exchange，提问作者Random Data Monster