fix(security): 安全漏洞修复与依赖升级

- 升级 Vert.x 4.5.24 → 4.5.27, postgresql 42.7.3 → 42.7.11, logback 1.5.18 → 1.5.32, axios 1.13.5 → 1.16.1
- 修复 JWT 签名验证和密码比较的时序攻击漏洞 (MessageDigest.isEqual)
- 修复 AESUtils 使用不安全 Random 改为 SecureRandom
- 修复登录用户枚举和异常信息泄露，统一错误提示
- 修复 RateLimiter count++ 非原子操作 (AtomicInteger)
- 修复 JsParserExecutor DCL 模式缺少 volatile
- 修复 Token 日志泄露，仅打印前8字符
- 修复 Playground 密码时序攻击和堆栈泄露
- 所有 window.open 添加 noopener,noreferrer
- LocalConstant 改用 ConcurrentHashMap 保证线程安全
- Dockerfile 添加非 root 用户运行，secret.yml 加入 .gitignore

parser/pom.xml

@@ -12,7 +12,7 @@
 
     <groupId>cn.qaiu</groupId>
     <artifactId>parser</artifactId>
-    <version>10.2.5</version>
+    <version>${parserVersion}</version>
     <packaging>jar</packaging>
 
     <name>cn.qaiu:parser</name>
@@ -35,9 +35,9 @@
     </developers>
 
     <scm>
-        <connection>scm:git:https://github.com/qaiu/netdisk-fast-download.git</connection>
-        <developerConnection>scm:git:ssh://git@github.com:qaiu/netdisk-fast-download.git</developerConnection>
-        <url>https://github.com/qaiu/netdisk-fast-download</url>
+        <connection>scm:git:https://github.com/${github.owner}/${github.repo}.git</connection>
+        <developerConnection>scm:git:ssh://git@github.com:${github.owner}/${github.repo}.git</developerConnection>
+        <url>https://github.com/${github.owner}/${github.repo}</url>
     </scm>
 
     <distributionManagement>
@@ -52,20 +52,19 @@
     </distributionManagement>
 
     <properties>
-        <revision>0.2.1</revision>
         <java.version>17</java.version>
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <!-- Versions -->
-        <vertx.version>4.5.24</vertx.version>
+        <vertx.version>4.5.27</vertx.version>
         <org.reflections.version>0.10.2</org.reflections.version>
         <lombok.version>1.18.38</lombok.version>
         <slf4j.version>2.0.16</slf4j.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
         <jackson.version>2.18.6</jackson.version>
-        <logback.version>1.5.19</logback.version>
+        <logback.version>1.5.32</logback.version>
         <junit.version>4.13.2</junit.version>
     </properties>
 
@@ -124,6 +123,41 @@
     <build>
         <plugins>
 
+            <!-- 从 git remote origin 自动识别 GitHub 仓库地址 -->
+            <plugin>
+                <groupId>org.codehaus.gmavenplus</groupId>
+                <artifactId>gmavenplus-plugin</artifactId>
+                <version>4.1.1</version>
+                <dependencies>
+                    <dependency>
+                        <groupId>org.apache.groovy</groupId>
+                        <artifactId>groovy</artifactId>
+                        <version>4.0.24</version>
+                    </dependency>
+                </dependencies>
+                <executions>
+                    <execution>
+                        <phase>initialize</phase>
+                        <goals><goal>execute</goal></goals>
+                        <configuration>
+                            <scripts>
+                                <script>
+                                    def url = 'git remote get-url origin'.execute().text.trim()
+                                    def m = (url =~ 'github\\.com[:/]([^/]+)/([^/.]+?)(?:\\.git)?$')
+                                    if (m.find()) {
+                                        project.properties.setProperty('github.owner', m.group(1))
+                                        project.properties.setProperty('github.repo', m.group(2))
+                                    } else {
+                                        project.properties.setProperty('github.owner', 'qaiu')
+                                        project.properties.setProperty('github.repo', 'netdisk-fast-download')
+                                    }
+                                </script>
+                            </scripts>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <!-- 编译 -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>

parser/src/main/java/cn/qaiu/parser/customjs/JsParserExecutor.java

@@ -33,7 +33,7 @@ public class JsParserExecutor implements IPanTool, AutoCloseable {
 
     private static final Logger log = LoggerFactory.getLogger(JsParserExecutor.class);
 
-    private static WorkerExecutor EXECUTOR;
+    private static volatile WorkerExecutor EXECUTOR;
     private static final Object EXECUTOR_LOCK = new Object();
 
     private static String FETCH_RUNTIME_JS = null;

parser/src/main/java/cn/qaiu/util/AESUtils.java

@@ -14,7 +14,6 @@ import java.security.spec.X509EncodedKeySpec;
 import java.util.Base64;
 import java.util.Date;
 import java.util.HexFormat;
-import java.util.Random;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -299,7 +298,7 @@ public class AESUtils {
     //length用户要求产生字符串的长度
     public static String getRandomString(int length){
         String str="abcdefghijklmnopqrstuvwxyz0123456789";
-        Random random=new Random();
+        SecureRandom random=new SecureRandom();
         StringBuilder sb=new StringBuilder();
         for(int i=0;i<length;i++){
             int number=random.nextInt(36);