From 21b4f0c3d8441b7decf8d88952f4cfe310df226f Mon Sep 17 00:00:00 2001 From: yumoqing Date: Tue, 25 Aug 2026 15:01:22 +0800 Subject: [PATCH] =?UTF-8?q?security:=20switch=5Fbizdate.dspy=20=E6=A0=A1?= =?UTF-8?q?=E9=AA=8C=E8=A1=A5=E5=85=A8=20IPv6=20+=20=E6=8B=92=E7=BB=9D?= =?UTF-8?q?=E6=97=B6=E4=B8=8D=E5=9B=9E=E6=98=BE=20client=5Fip?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 原实现只认 127.0.0.1(漏 ::1)，且校验失败时 return ip 把探测结果回显给调用方， 便于攻击者试探代理头处理方式。改为中性拒绝信息。 --- wwwroot/cron/switch_bizdate.dspy | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/wwwroot/cron/switch_bizdate.dspy b/wwwroot/cron/switch_bizdate.dspy index 8614985..0355c8c 100644 --- a/wwwroot/cron/switch_bizdate.dspy +++ b/wwwroot/cron/switch_bizdate.dspy @@ -1,6 +1,9 @@ -ip = request['client_ip'] -if ip not in ['127.0.0.1']: - return ip +# 安全：定时任务入口（改全平台业务日期 business_date），只允许本机调用。 +# 校验失败不回显 client_ip（原实现 `return ip` 把探测结果反馈给调用方， +# 便于攻击者试探代理头处理方式），统一返回中性拒绝信息。 +ip = request.get('client_ip') or '' +if ip not in ('127.0.0.1', '::1', 'localhost'): + return 'Forbidden: 仅允许本机调用' async with get_sor_context(request._run_ns, 'appbase') as sor: try: