yukaidi
|
17460ff271
|
fix(security): 安全漏洞修复与依赖升级
- 升级 Vert.x 4.5.24 → 4.5.27, postgresql 42.7.3 → 42.7.11, logback 1.5.18 → 1.5.32, axios 1.13.5 → 1.16.1
- 修复 JWT 签名验证和密码比较的时序攻击漏洞 (MessageDigest.isEqual)
- 修复 AESUtils 使用不安全 Random 改为 SecureRandom
- 修复登录用户枚举和异常信息泄露，统一错误提示
- 修复 RateLimiter count++ 非原子操作 (AtomicInteger)
- 修复 JsParserExecutor DCL 模式缺少 volatile
- 修复 Token 日志泄露，仅打印前8字符
- 修复 Playground 密码时序攻击和堆栈泄露
- 所有 window.open 添加 noopener,noreferrer
- LocalConstant 改用 ConcurrentHashMap 保证线程安全
- Dockerfile 添加非 root 用户运行，secret.yml 加入 .gitignore
|
2026-05-29 14:20:54 +08:00 |
|
q
|
acb646ee2d
|
升级netty依赖
|
2025-09-15 10:10:30 +08:00 |
|
dependabot[bot]
|
ae89e0be26
|
Bump org.apache.commons:commons-lang3 in /core-database
Bumps org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0.
---
updated-dependencies:
- dependency-name: org.apache.commons:commons-lang3
dependency-version: 3.18.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2025-07-12 01:16:21 +00:00 |
|
QAIU
|
fe71db0967
|
remove yarn.lock
|
2025-05-08 18:18:15 +08:00 |
|
QAIU
|
5b666e1fec
|
MySQL支持, 其他优化
|
2025-02-06 16:52:06 +08:00 |
|
QAIU
|
7663320a55
|
1. h2数据库文件优化, 取消h2server启动
2. 项目结构优化, pom版本统一管理
3. core的beanutils依赖升级为commons-beanutils2版本, 修复之前版本的安全风险.
4. 此版本打包部署需要替换之前所有依赖
|
2024-06-06 18:06:33 +08:00 |
|
qaiu
|
5768ba48e8
|
- 升级vertx到4.5.6
- 添加Cloudreve
- 蓝奏云优享和小飞机规则修改
|
2024-04-09 12:13:26 +08:00 |
|
qaiu
|
cb14be12e1
|
vertx升级4.5.0
|
2023-11-28 17:00:11 +08:00 |
|
QAIU
|
66de667fc3
|
版本更新至0.1.7,启用h2db,添加统计功能,框架优化
|
2023-08-25 16:55:38 +08:00 |
|
qaiu
|
5628d57299
|
- 更新版本号: 0.1.5->0.1.6
|
2023-07-16 03:11:41 +08:00 |
|
dependabot[bot]
|
00723cc2e2
|
Bump h2 from 2.1.214 to 2.2.220 in /core-database
Bumps [h2](https://github.com/h2database/h2database) from 2.1.214 to 2.2.220.
- [Release notes](https://github.com/h2database/h2database/releases)
- [Commits](https://github.com/h2database/h2database/compare/version-2.1.214...version-2.2.220)
---
updated-dependencies:
- dependency-name: com.h2database:h2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-07-07 22:00:11 +00:00 |
|
QAIU
|
c629525029
|
update 0.1.5
|
2023-06-13 13:23:09 +08:00 |
|
QAIU
|
7358931559
|
1. 项目重命名
2. 添加UC网盘解析
3. 添加移动云空间解析 #1
|
2023-05-24 16:20:06 +08:00 |
|
QAIU
|
905004b0ac
|
do db
|
2023-05-06 17:38:56 +08:00 |
|