From 26b1cdcdc6bdb49f755e2dd963fc6a7b1eae3d46 Mon Sep 17 00:00:00 2001 From: wangbo Date: Sat, 12 Sep 2026 23:09:34 +0800 Subject: [PATCH] =?UTF-8?q?Revert=20"fix(security):=20=E8=A1=A5=E9=BD=90?= =?UTF-8?q?=E6=97=A7=E9=83=A8=E7=BD=B2=E5=AE=89=E5=85=A8=E5=AF=86=E9=92=A5?= =?UTF-8?q?"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit d01b0e90367f05202b4b702684f6d1074547f236. --- scripts/Initialize-SecurityEnv.ps1 | 12 ++++++++---- scripts/Test-SecurityEnv.ps1 | 16 +++------------- scripts/init-security-env.sh | 8 ++++---- scripts/test-security-env.sh | 28 ++++++---------------------- 4 files changed, 21 insertions(+), 43 deletions(-) diff --git a/scripts/Initialize-SecurityEnv.ps1 b/scripts/Initialize-SecurityEnv.ps1 index 8857cc4..528ac17 100644 --- a/scripts/Initialize-SecurityEnv.ps1 +++ b/scripts/Initialize-SecurityEnv.ps1 @@ -57,12 +57,16 @@ function Initialize-SecurityEnv { if ($null -eq $content) { $content = "" } $definitions = @( @{ Key = "CONFIG_JWT_SECRET"; Legacy = "this is a very secret secret"; MinLength = 32 }, - @{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 }, - @{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 }, - @{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 }, - @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 }, @{ Key = "WS_AUTH_WS_TICKET_SECRET"; Legacy = ""; MinLength = 32 } ) + if ($Mode -eq "new") { + $definitions += @( + @{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 }, + @{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 }, + @{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 }, + @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 } + ) + } foreach ($definition in $definitions) { $current = Get-EnvValue $content $definition.Key diff --git a/scripts/Test-SecurityEnv.ps1 b/scripts/Test-SecurityEnv.ps1 index 3af6947..4585a31 100644 --- a/scripts/Test-SecurityEnv.ps1 +++ b/scripts/Test-SecurityEnv.ps1 @@ -30,24 +30,14 @@ try { $upgrade = Write-TestEnv "upgrade.env" @( "CONFIG_JWT_SECRET='this is a very secret secret'", "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=", - "CONFIG_OTP_HASH_SECRET=", - "CONFIG_AUDIT_HASH_PEPPER=", - "CONFIG_AUDIT_INTEGRITY_KEY=", "WS_AUTH_WS_TICKET_SECRET=", "WS_AUTH_METHODS=none,bearer" ) Initialize-SecurityEnv -Path $upgrade -Mode upgrade $upgradeContent = Get-Content $upgrade -Raw -Encoding UTF8 - foreach ($key in @( - "CONFIG_JWT_SECRET", - "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY", - "CONFIG_OTP_HASH_SECRET", - "CONFIG_AUDIT_HASH_PEPPER", - "CONFIG_AUDIT_INTEGRITY_KEY", - "WS_AUTH_WS_TICKET_SECRET" - )) { - Assert-MinLength $upgradeContent $key 32 - } + Assert-MinLength $upgradeContent "CONFIG_JWT_SECRET" 32 + Assert-MinLength $upgradeContent "WS_AUTH_WS_TICKET_SECRET" 32 + Assert-Value $upgradeContent "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" "" Assert-Value $upgradeContent "WS_AUTH_METHODS" "none,bearer,ws_ticket" $upgradeBeforeRepeat = $upgradeContent Initialize-SecurityEnv -Path $upgrade -Mode upgrade diff --git a/scripts/init-security-env.sh b/scripts/init-security-env.sh index faff635..e6b27db 100644 --- a/scripts/init-security-env.sh +++ b/scripts/init-security-env.sh @@ -128,13 +128,13 @@ init_security_env() { fi ensure_security_secret "$file" "CONFIG_JWT_SECRET" "this is a very secret secret" - ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" - ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET" - ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER" - ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY" ensure_security_secret "$file" "WS_AUTH_WS_TICKET_SECRET" ensure_env_list_item "$file" "WS_AUTH_METHODS" "ws_ticket" "none,bearer" if [ "$mode" = "new" ]; then + ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" + ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET" + ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER" + ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY" ensure_initial_admin_password "$file" fi chmod 600 "$file" diff --git a/scripts/test-security-env.sh b/scripts/test-security-env.sh index f6e3d75..a249a85 100755 --- a/scripts/test-security-env.sh +++ b/scripts/test-security-env.sh @@ -60,38 +60,22 @@ upgrade_log="$TMP_DIR/upgrade.log" write_env "$upgrade_env" \ "CONFIG_JWT_SECRET='this is a very secret secret'" \ "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=" \ - "CONFIG_OTP_HASH_SECRET=" \ - "CONFIG_AUDIT_HASH_PEPPER=" \ - "CONFIG_AUDIT_INTEGRITY_KEY=" \ "WS_AUTH_WS_TICKET_SECRET=" \ "WS_AUTH_METHODS=none,bearer" init_security_env "$upgrade_env" upgrade > "$upgrade_log" assert_min_length "$upgrade_env" "CONFIG_JWT_SECRET" 32 assert_min_length "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET" 32 -for key in \ - CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \ - CONFIG_OTP_HASH_SECRET \ - CONFIG_AUDIT_HASH_PEPPER \ - CONFIG_AUDIT_INTEGRITY_KEY; do - assert_min_length "$upgrade_env" "$key" 32 -done +assert_value "$upgrade_env" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" "" assert_value "$upgrade_env" "WS_AUTH_METHODS" "none,bearer,ws_ticket" assert_single_key "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET" assert_single_key "$upgrade_env" "WS_AUTH_METHODS" -for key in \ - CONFIG_JWT_SECRET \ - CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \ - CONFIG_OTP_HASH_SECRET \ - CONFIG_AUDIT_HASH_PEPPER \ - CONFIG_AUDIT_INTEGRITY_KEY \ - WS_AUTH_WS_TICKET_SECRET; do - value="$(read_env_value "$upgrade_env" "$key")" - if grep -Fq "$value" "$upgrade_log"; then - fail "security initialization output must not reveal generated secrets" - fi -done +upgrade_jwt="$(read_env_value "$upgrade_env" "CONFIG_JWT_SECRET")" +upgrade_ws="$(read_env_value "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET")" +if grep -Fq "$upgrade_jwt" "$upgrade_log" || grep -Fq "$upgrade_ws" "$upgrade_log"; then + fail "security initialization output must not reveal generated secrets" +fi before_repeat="$(file_sha256 "$upgrade_env")" init_security_env "$upgrade_env" upgrade > "$TMP_DIR/repeat.log"