From d01b0e90367f05202b4b702684f6d1074547f236 Mon Sep 17 00:00:00 2001 From: wangbo Date: Sat, 12 Sep 2026 22:46:50 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E8=A1=A5=E9=BD=90=E6=97=A7?= =?UTF-8?q?=E9=83=A8=E7=BD=B2=E5=AE=89=E5=85=A8=E5=AF=86=E9=92=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/Initialize-SecurityEnv.ps1 | 12 ++++-------- scripts/Test-SecurityEnv.ps1 | 16 +++++++++++++--- scripts/init-security-env.sh | 8 ++++---- scripts/test-security-env.sh | 28 ++++++++++++++++++++++------ 4 files changed, 43 insertions(+), 21 deletions(-) diff --git a/scripts/Initialize-SecurityEnv.ps1 b/scripts/Initialize-SecurityEnv.ps1 index 528ac17..8857cc4 100644 --- a/scripts/Initialize-SecurityEnv.ps1 +++ b/scripts/Initialize-SecurityEnv.ps1 @@ -57,16 +57,12 @@ function Initialize-SecurityEnv { if ($null -eq $content) { $content = "" } $definitions = @( @{ Key = "CONFIG_JWT_SECRET"; Legacy = "this is a very secret secret"; MinLength = 32 }, + @{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 }, + @{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 }, + @{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 }, + @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 }, @{ Key = "WS_AUTH_WS_TICKET_SECRET"; Legacy = ""; MinLength = 32 } ) - if ($Mode -eq "new") { - $definitions += @( - @{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 }, - @{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 }, - @{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 }, - @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 } - ) - } foreach ($definition in $definitions) { $current = Get-EnvValue $content $definition.Key diff --git a/scripts/Test-SecurityEnv.ps1 b/scripts/Test-SecurityEnv.ps1 index 4585a31..3af6947 100644 --- a/scripts/Test-SecurityEnv.ps1 +++ b/scripts/Test-SecurityEnv.ps1 @@ -30,14 +30,24 @@ try { $upgrade = Write-TestEnv "upgrade.env" @( "CONFIG_JWT_SECRET='this is a very secret secret'", "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=", + "CONFIG_OTP_HASH_SECRET=", + "CONFIG_AUDIT_HASH_PEPPER=", + "CONFIG_AUDIT_INTEGRITY_KEY=", "WS_AUTH_WS_TICKET_SECRET=", "WS_AUTH_METHODS=none,bearer" ) Initialize-SecurityEnv -Path $upgrade -Mode upgrade $upgradeContent = Get-Content $upgrade -Raw -Encoding UTF8 - Assert-MinLength $upgradeContent "CONFIG_JWT_SECRET" 32 - Assert-MinLength $upgradeContent "WS_AUTH_WS_TICKET_SECRET" 32 - Assert-Value $upgradeContent "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" "" + foreach ($key in @( + "CONFIG_JWT_SECRET", + "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY", + "CONFIG_OTP_HASH_SECRET", + "CONFIG_AUDIT_HASH_PEPPER", + "CONFIG_AUDIT_INTEGRITY_KEY", + "WS_AUTH_WS_TICKET_SECRET" + )) { + Assert-MinLength $upgradeContent $key 32 + } Assert-Value $upgradeContent "WS_AUTH_METHODS" "none,bearer,ws_ticket" $upgradeBeforeRepeat = $upgradeContent Initialize-SecurityEnv -Path $upgrade -Mode upgrade diff --git a/scripts/init-security-env.sh b/scripts/init-security-env.sh index e6b27db..faff635 100644 --- a/scripts/init-security-env.sh +++ b/scripts/init-security-env.sh @@ -128,13 +128,13 @@ init_security_env() { fi ensure_security_secret "$file" "CONFIG_JWT_SECRET" "this is a very secret secret" + ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" + ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET" + ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER" + ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY" ensure_security_secret "$file" "WS_AUTH_WS_TICKET_SECRET" ensure_env_list_item "$file" "WS_AUTH_METHODS" "ws_ticket" "none,bearer" if [ "$mode" = "new" ]; then - ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" - ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET" - ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER" - ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY" ensure_initial_admin_password "$file" fi chmod 600 "$file" diff --git a/scripts/test-security-env.sh b/scripts/test-security-env.sh index a249a85..f6e3d75 100755 --- a/scripts/test-security-env.sh +++ b/scripts/test-security-env.sh @@ -60,22 +60,38 @@ upgrade_log="$TMP_DIR/upgrade.log" write_env "$upgrade_env" \ "CONFIG_JWT_SECRET='this is a very secret secret'" \ "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=" \ + "CONFIG_OTP_HASH_SECRET=" \ + "CONFIG_AUDIT_HASH_PEPPER=" \ + "CONFIG_AUDIT_INTEGRITY_KEY=" \ "WS_AUTH_WS_TICKET_SECRET=" \ "WS_AUTH_METHODS=none,bearer" init_security_env "$upgrade_env" upgrade > "$upgrade_log" assert_min_length "$upgrade_env" "CONFIG_JWT_SECRET" 32 assert_min_length "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET" 32 -assert_value "$upgrade_env" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" "" +for key in \ + CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \ + CONFIG_OTP_HASH_SECRET \ + CONFIG_AUDIT_HASH_PEPPER \ + CONFIG_AUDIT_INTEGRITY_KEY; do + assert_min_length "$upgrade_env" "$key" 32 +done assert_value "$upgrade_env" "WS_AUTH_METHODS" "none,bearer,ws_ticket" assert_single_key "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET" assert_single_key "$upgrade_env" "WS_AUTH_METHODS" -upgrade_jwt="$(read_env_value "$upgrade_env" "CONFIG_JWT_SECRET")" -upgrade_ws="$(read_env_value "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET")" -if grep -Fq "$upgrade_jwt" "$upgrade_log" || grep -Fq "$upgrade_ws" "$upgrade_log"; then - fail "security initialization output must not reveal generated secrets" -fi +for key in \ + CONFIG_JWT_SECRET \ + CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \ + CONFIG_OTP_HASH_SECRET \ + CONFIG_AUDIT_HASH_PEPPER \ + CONFIG_AUDIT_INTEGRITY_KEY \ + WS_AUTH_WS_TICKET_SECRET; do + value="$(read_env_value "$upgrade_env" "$key")" + if grep -Fq "$value" "$upgrade_log"; then + fail "security initialization output must not reveal generated secrets" + fi +done before_repeat="$(file_sha256 "$upgrade_env")" init_security_env "$upgrade_env" upgrade > "$TMP_DIR/repeat.log"