From 0fbd0cab076e5968d2927c77d5024f90ef209086 Mon Sep 17 00:00:00 2001 From: yumoqing Date: Sun, 13 Sep 2026 11:37:47 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20load=5Fpath=E4=B8=8D=E5=86=8D?= =?UTF-8?q?=E6=B3=A8=E5=86=8CCRUD=E7=94=9F=E6=88=90=E7=9A=84add/update/del?= =?UTF-8?q?ete=5F*.dspy=E2=80=94=E2=80=94=E5=AE=83=E4=BB=AC=E6=98=AF?= =?UTF-8?q?=E8=A3=B8sor.C/U/D=E7=BB=95=E8=BF=87=E5=8F=91=E5=88=B8=E5=BC=95?= =?UTF-8?q?=E6=93=8E=E5=8E=9F=E5=AD=90=E5=8D=A0=E9=A2=9D/=E5=AE=A1?= =?UTF-8?q?=E8=AE=A1=E6=B5=81=E6=B0=B4=E5=8F=AA=E8=AF=BB/org=E9=9A=94?= =?UTF-8?q?=E7=A6=BB/=E7=8A=B6=E6=80=81=E5=AE=88=E5=8D=AB=E5=85=A8?= =?UTF-8?q?=E9=83=A8=E6=A0=A1=E9=AA=8C;=E5=8F=AA=E6=B3=A8=E5=86=8Cindex.ui?= =?UTF-8?q?+get=5F*=E5=8F=AA=E8=AF=BB,=E5=86=99=E6=93=8D=E4=BD=9C=E4=BB=85?= =?UTF-8?q?=E8=B5=B0wwwroot/api/=E6=9C=89=E6=A0=A1=E9=AA=8C=E7=AB=AF?= =?UTF-8?q?=E7=82=B9(UI=20editable=20URL=E5=B7=B2=E6=8C=87=E5=90=91)?= =?UTF-8?q?=E3=80=82HTTP=E5=AE=9E=E6=B5=8B=E6=8A=93=E5=88=B0:update/delete?= =?UTF-8?q?=5Fvoucher=5Fusage=5Flog.dspy=E7=99=BB=E5=BD=95=E6=80=81200?= =?UTF-8?q?=E5=8F=AF=E7=AF=A1=E6=94=B9=E5=AE=A1=E8=AE=A1=E6=B5=81=E6=B0=B4?= =?UTF-8?q?=E3=80=82RBAC=E9=BB=98=E8=AE=A4=E6=8B=92=E7=BB=9D=E2=86=92?= =?UTF-8?q?=E6=9C=AA=E6=B3=A8=E5=86=8C=E5=8D=B3401?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/load_path.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/scripts/load_path.py b/scripts/load_path.py index aa3c774..34d53bd 100644 --- a/scripts/load_path.py +++ b/scripts/load_path.py @@ -62,15 +62,18 @@ PATHS_LOGINED = [ f"/{MOD}/api/instance/voucher_invalidate.dspy", ] -# CRUD 目录（框架生成，路径必须逐个注册） +# CRUD 生成目录（框架生成）：只注册 index.ui + get_*.dspy（只读）。 +# ⚠ 生成的 add/update/delete_*.dspy 一律【不注册权限】——它们是裸 sor.C/U/D， +# 绕过全部业务校验（发券引擎原子占额/流水审计只读/org 隔离/状态守卫）。 +# 写操作只走 wwwroot/api/ 下有校验的端点（UI 的 editable URL 已指向它们）。 +# 文件虽被 xls2ui 生成（noedit 也生成），无权限行即 401（RBAC 默认拒绝）。 +# 2026-09-12 实测抓到的漏洞：统一注册四件套后 update/delete_voucher_usage_log.dspy +# 登录态直接 200 可篡改审计流水——精确权限是防线，生成端点是攻击面。 for alias, tbl in CRUD_DIRS.items(): PATHS_LOGINED += [ f"/{MOD}/{alias}", f"/{MOD}/{alias}/index.ui", f"/{MOD}/{alias}/get_{tbl}.dspy", - f"/{MOD}/{alias}/add_{tbl}.dspy", - f"/{MOD}/{alias}/update_{tbl}.dspy", - f"/{MOD}/{alias}/delete_{tbl}.dspy", ]