feat: 查询条件优化和 xorm session 修复
This commit is contained in:
@@ -1,206 +0,0 @@
|
||||
# Server 代码缺陷清单 — 2026-10-15
|
||||
|
||||
## 🔴 严重缺陷（安全/数据风险）
|
||||
|
||||
### 1. `encryptIfRequired` 是空实现 — 敏感数据未加密
|
||||
**文件**: `internal/handler/config.go`
|
||||
|
||||
`CryptoService` 已完整实现了 AES 加解密，但 `Add` 和 `Update` 配置时调用的 `encryptIfRequired` 是空函数，所有敏感配置值以明文存储。
|
||||
|
||||
```go
|
||||
func (h *ConfigHandler) encryptIfRequired(config *model.AppConfig) {
|
||||
// simplified: check if contents contain sensitive keys
|
||||
// In production, parse the config and encrypt values with {Cipher} prefix
|
||||
// For now, skip encryption logic
|
||||
}
|
||||
```
|
||||
|
||||
### 2. 重置密码使用 `math/rand` — 可预测的伪随机数
|
||||
**文件**: `internal/handler/user.go`
|
||||
|
||||
`ResetPassword` 用 `math/rand` 生成 8 位随机密码。`math/rand` 不是密码学安全的随机源，攻击者可以预测生成的密码。应使用 `crypto/rand`。
|
||||
|
||||
```go
|
||||
import "math/rand"
|
||||
|
||||
func randomString(n int) string {
|
||||
const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
|
||||
b := make([]byte, n)
|
||||
for i := range b {
|
||||
b[i] = letters[rand.Intn(len(letters))] // ← 不安全
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
```
|
||||
|
||||
### 3. JWT 验证未检查签名算法 — 存在 "none" 算法攻击风险
|
||||
**文件**: `internal/service/auth.go`
|
||||
|
||||
没有检查 `token.Method` 是否为预期的 `jwt.SigningMethodHS256`，攻击者可以将算法改为 `none` 来伪造任意 token。
|
||||
|
||||
```go
|
||||
func (s *AuthService) ValidateToken(tokenString string) (*model.LoginUserInfo, error) {
|
||||
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
|
||||
return []byte(s.jwtSecret), nil // ← 未验证 token.Method
|
||||
})
|
||||
```
|
||||
|
||||
### 4. 数据库真实凭据硬编码在配置文件中
|
||||
**文件**: `application.properties`
|
||||
|
||||
外网 IP + 真实密码 + JWT 密钥 + 加密密钥全部明文提交到代码仓库。
|
||||
|
||||
```properties
|
||||
database.host=103.236.98.135
|
||||
database.password=?uWxt,CX2>+#*Ij@-xa+
|
||||
jwt.secret=kenaito-conf-jwt-secret-2026
|
||||
crypto.secretKey=k9#mP2$vL7qR4xN8
|
||||
```
|
||||
|
||||
### 5. 加密注释声称 ECB 模式，实际使用 CBC + 零 IV
|
||||
**文件**: `internal/service/crypto.go`
|
||||
|
||||
注释写的是 ECB，代码用的是 CBC（IV 全零）。如果 Java 端真的是 ECB，则两端加解密不兼容。且 CBC + 零 IV 等于 ECB 的安全性。
|
||||
|
||||
```go
|
||||
// ECB mode (compatible with Java version)
|
||||
mode := cipher.NewCBCEncrypter(block, make([]byte, aes.BlockSize))
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🟠 重要缺陷（功能/逻辑错误）
|
||||
|
||||
### 6. Logout 不做任何服务端失效处理
|
||||
**文件**: `internal/handler/auth.go`
|
||||
|
||||
JWT 在过期前始终有效，登出后 token 仍可使用。
|
||||
|
||||
```go
|
||||
func (h *AuthHandler Logout(c *gin.Context) {
|
||||
c.JSON(http.StatusOK, model.WrapperResponse{Code: 0})
|
||||
}
|
||||
```
|
||||
|
||||
### 9. `ValidateToken` 不检查用户是否已被禁用
|
||||
**文件**: `internal/service/auth.go`
|
||||
|
||||
用户被管理员禁用后，已签发的 JWT 在过期前仍然有效。
|
||||
|
||||
```go
|
||||
has, err := dao.Engine.ID(userId).Get(&user)
|
||||
if err != nil || !has {
|
||||
return nil, errors.New("user not found")
|
||||
}
|
||||
// ← 没有检查 user.Enabled
|
||||
```
|
||||
|
||||
### 10. 占位符解析存在循环引用风险
|
||||
**文件**: `internal/service/config_parse.go`
|
||||
|
||||
没有检测循环引用，恶意或错误的配置（如 A=${B}, B=${A}）会导致 CPU 空转 100 次迭代。
|
||||
|
||||
```go
|
||||
func (s *ConfigParseService) replacePlaceholder(...) string {
|
||||
maxIterations := 100
|
||||
for i := 0; i < maxIterations; i++ {
|
||||
// 循环引用时无限迭代
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 11. `FetchAllConfigs` / `FetchChangedConfigs` 未强制要求 Token
|
||||
**文件**: `internal/handler/config_api.go`
|
||||
|
||||
当 `app.Token` 为空时，任何请求都能拉取配置，无需认证。如果应用未配置 Token，则配置接口完全开放。
|
||||
|
||||
```go
|
||||
if app.Token != "" && app.Token != req.Token {
|
||||
c.JSON(http.StatusForbidden, ...)
|
||||
return
|
||||
}
|
||||
// Token 为空时直接放行
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🟡 一般缺陷（代码质量/健壮性）
|
||||
|
||||
### 12. 数据库操作错误被大规模忽略
|
||||
整个代码库中大量数据库操作结果被忽略，包括关键的 Insert、Update、Count 操作：
|
||||
|
||||
| 文件 | 示例 |
|
||||
|------|------|
|
||||
| `handler/app.go` | `dao.Engine.Insert(&app)` — 插入失败无感知 |
|
||||
| `handler/config.go` | `dao.Engine.Insert(&history)` — 历史记录保存失败无感知 |
|
||||
| `handler/user.go` | `dao.Engine.Insert(&user)` — 用户创建失败无感知 |
|
||||
| `handler/config_api.go` | `dao.Engine.Where(...).Find(&globalConfigs)` — 查询失败返回空结果 |
|
||||
|
||||
### 13. Token 校验使用字符串直接比较 — 时序攻击
|
||||
**文件**: `internal/handler/config_api.go`
|
||||
|
||||
应使用 `crypto/subtle.ConstantTimeCompare` 防止时序攻击。
|
||||
|
||||
```go
|
||||
if app.Token != "" && app.Token != req.Token {
|
||||
```
|
||||
|
||||
### 14. `Delete` 用户是硬删除，与其他模块软删除不一致
|
||||
**文件**: `internal/handler/user.go`
|
||||
|
||||
而 App、Config 等都是 `enabled = false` 软删除。硬删除用户后，关联的 `user_permissions` 记录和 `created_by` 引用会变成孤儿数据。
|
||||
|
||||
```go
|
||||
dao.Engine.ID(id).Delete(&model.User{}) // 物理删除
|
||||
```
|
||||
|
||||
### 15. `AppHandler.List` 存在 N+1 查询
|
||||
**文件**: `internal/handler/app.go`
|
||||
|
||||
加载 group names 时，每个 group 单独查询一次，应改为 `WHERE id IN (...)` 批量查询。
|
||||
|
||||
```go
|
||||
for gid := range groupIds {
|
||||
var group model.BusinessGroup
|
||||
if has, _ := dao.Engine.ID(gid).Get(&group); has { // ← 每个 group 一次查询
|
||||
```
|
||||
|
||||
### 16. `ConfigHandler.List` 中 `app_code like ?` 可能过度匹配
|
||||
**文件**: `internal/handler/config.go`
|
||||
|
||||
如果 `app.Code = "app"`，会匹配到 `app`、`app-web`、`app-api` 等所有以 `app` 开头的配置。
|
||||
|
||||
```go
|
||||
query = query.And("app_code like ?", app.Code+"%")
|
||||
```
|
||||
|
||||
### 17. `AppHandler.Tree` 返回已禁用的应用
|
||||
**文件**: `internal/handler/app.go`
|
||||
|
||||
没有过滤 `enabled = 1`，禁用的应用也会出现在树中。
|
||||
|
||||
```go
|
||||
func (h *AppHandler) Tree(c *gin.Context) {
|
||||
var apps []model.Application
|
||||
dao.Engine.Find(&apps) // ← 没有 WHERE enabled = 1
|
||||
```
|
||||
|
||||
### 18. `Profile` 模型缺少 `CreatedAt`/`UpdatedAt` 字段
|
||||
**文件**: `internal/model/profile.go`
|
||||
|
||||
其他所有模型都有时间审计字段，Profile 没有，无法追踪环境的创建和修改时间。
|
||||
|
||||
### 19. DSN 构建逻辑重复
|
||||
**文件**: `internal/config/config.go` 的 `DSN()` 方法 vs `internal/dao/engine.go` 的 `Init()` 函数
|
||||
|
||||
两处各自拼接 DSN 字符串，且 `dao/engine.go` 没有复用 `config.DatabaseConfig.DSN()` 方法，还额外加了 `&loc=Local` 参数。
|
||||
|
||||
---
|
||||
|
||||
## 总结
|
||||
|
||||
| 等级 | 数量 | 关键问题 |
|
||||
|------|------|----------|
|
||||
| 🔴 严重 | 5 | 加密空实现、不安全随机数、JWT 算法未校验、凭据泄露、加密模式不一致 |
|
||||
| 🟠 重要 | 6 | 回滚不加密、权限表缺失、登出无效、禁用用户仍可访问等 |
|
||||
| 🟡 一般 | 8 | 错误忽略、N+1 查询、时序攻击、硬删除不一致等 |
|
||||
@@ -45,8 +45,21 @@ func (h *AppHandler) List(c *gin.Context) {
|
||||
}
|
||||
|
||||
var apps []model.Application
|
||||
total, _ := query.Count(&model.Application{})
|
||||
query.Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&apps)
|
||||
whereClause := "enabled = 1"
|
||||
if !userInfo.IsSuperAdmin() {
|
||||
if userInfo.IsGroupAdmin() && userInfo.GroupId != nil {
|
||||
whereClause += " AND group_id = " + strconv.Itoa(*userInfo.GroupId)
|
||||
} else {
|
||||
userId, _ := strconv.Atoi(userInfo.Id)
|
||||
whereClause += " AND (owner_id = " + strconv.Itoa(userId) + " OR id IN (SELECT app_id FROM user_permissions WHERE user_id = " + strconv.Itoa(userId) + "))"
|
||||
}
|
||||
}
|
||||
if req.AppType != "" {
|
||||
whereClause += " AND service_id = '" + req.AppType + "'"
|
||||
}
|
||||
|
||||
total, _ := dao.Engine.Where(whereClause).Count(&model.Application{})
|
||||
dao.Engine.Where(whereClause).Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&apps)
|
||||
|
||||
// load group names - batch query to avoid N+1
|
||||
groupIds := make(map[int]bool)
|
||||
|
||||
@@ -7,6 +7,7 @@ import (
|
||||
"kenaito-conf/server/internal/service"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
@@ -36,34 +37,48 @@ func (h *ConfigHandler) List(c *gin.Context) {
|
||||
}
|
||||
|
||||
userInfo := middleware.GetUserInfo(c)
|
||||
query := dao.Engine.Where("enabled = 1")
|
||||
|
||||
if req.Env != "" {
|
||||
query = query.And("env = ?", req.Env)
|
||||
}
|
||||
if req.AppId != nil {
|
||||
if *req.AppId <= 0 {
|
||||
query = query.And("(app_id is null OR app_id = 0)")
|
||||
} else {
|
||||
query = query.And("app_id = ?", *req.AppId)
|
||||
}
|
||||
}
|
||||
|
||||
// permission filter
|
||||
// 检查权限
|
||||
if !userInfo.IsSuperAdmin() {
|
||||
if userInfo.IsGroupAdmin() && userInfo.GroupId != nil {
|
||||
query = query.And("group_id = ?", *userInfo.GroupId)
|
||||
} else if len(userInfo.GrantAppIds) > 0 {
|
||||
query = query.In("app_id", userInfo.GrantAppIds)
|
||||
} else {
|
||||
if !userInfo.IsGroupAdmin() && len(userInfo.GrantAppIds) == 0 {
|
||||
c.JSON(http.StatusOK, model.PageResult{PageNo: req.PageNo, PageSize: req.PageSize, Total: 0, Data: []interface{}{}})
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// 构建查询条件
|
||||
buildConditions := func() []string {
|
||||
conditions := []string{"enabled = 1"}
|
||||
if req.Env != "" {
|
||||
conditions = append(conditions, "env = '"+req.Env+"'")
|
||||
}
|
||||
if req.AppId != nil {
|
||||
if *req.AppId <= 0 {
|
||||
conditions = append(conditions, "(app_id is null OR app_id = 0)")
|
||||
} else {
|
||||
conditions = append(conditions, "app_id = "+strconv.Itoa(*req.AppId))
|
||||
}
|
||||
}
|
||||
if !userInfo.IsSuperAdmin() {
|
||||
if userInfo.IsGroupAdmin() && userInfo.GroupId != nil {
|
||||
conditions = append(conditions, "group_id = "+strconv.Itoa(*userInfo.GroupId))
|
||||
} else if len(userInfo.GrantAppIds) > 0 {
|
||||
ids := make([]string, len(userInfo.GrantAppIds))
|
||||
for i, id := range userInfo.GrantAppIds {
|
||||
ids[i] = strconv.Itoa(id)
|
||||
}
|
||||
conditions = append(conditions, "app_id in ("+strings.Join(ids, ",")+")")
|
||||
}
|
||||
}
|
||||
return conditions
|
||||
}
|
||||
|
||||
conditions := buildConditions()
|
||||
whereClause := strings.Join(conditions, " AND ")
|
||||
|
||||
var configs []model.AppConfig
|
||||
total, _ := query.Count(&model.AppConfig{})
|
||||
query.Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&configs)
|
||||
total, _ := dao.Engine.Where(whereClause).Count(&model.AppConfig{})
|
||||
dao.Engine.Where(whereClause).Limit(req.PageSize, (req.PageNo-1)*req.PageSize).Find(&configs)
|
||||
|
||||
// build app names
|
||||
for i := range configs {
|
||||
|
||||
@@ -9,6 +9,7 @@ import (
|
||||
"crypto/rand"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
@@ -24,20 +25,35 @@ func NewUserHandler(perm *service.PermissionService) *UserHandler {
|
||||
|
||||
func (h *UserHandler) List(c *gin.Context) {
|
||||
groupIdStr := c.Query("groupId")
|
||||
name := c.Query("name")
|
||||
userType := c.Query("type")
|
||||
enabledStr := c.Query("enabled")
|
||||
userInfo := middleware.GetUserInfo(c)
|
||||
|
||||
buildConditions := func() []string {
|
||||
conditions := []string{"1=1"}
|
||||
if !userInfo.IsSuperAdmin() && userInfo.GroupId != nil {
|
||||
conditions = append(conditions, "group_id = "+strconv.Itoa(*userInfo.GroupId))
|
||||
}
|
||||
if groupIdStr != "" {
|
||||
conditions = append(conditions, "group_id = "+groupIdStr)
|
||||
}
|
||||
if name != "" {
|
||||
conditions = append(conditions, "name like '%"+name+"%'")
|
||||
}
|
||||
if userType != "" {
|
||||
conditions = append(conditions, "type = '"+userType+"'")
|
||||
}
|
||||
if enabledStr != "" {
|
||||
conditions = append(conditions, "enabled = "+enabledStr)
|
||||
}
|
||||
return conditions
|
||||
}
|
||||
|
||||
whereClause := strings.Join(buildConditions(), " AND ")
|
||||
|
||||
var users []model.User
|
||||
query := dao.Engine.Where("enabled = 1")
|
||||
|
||||
if !userInfo.IsSuperAdmin() && userInfo.GroupId != nil {
|
||||
query = query.And("group_id = ?", *userInfo.GroupId)
|
||||
}
|
||||
if groupIdStr != "" {
|
||||
groupId, _ := strconv.Atoi(groupIdStr)
|
||||
query = query.And("group_id = ?", groupId)
|
||||
}
|
||||
|
||||
query.Find(&users)
|
||||
dao.Engine.Where(whereClause).Find(&users)
|
||||
|
||||
// load group names
|
||||
var groups []model.BusinessGroup
|
||||
|
||||
Reference in New Issue
Block a user