app/lib/password_blacklist.json

[
  "123456",
  "1234567",
  "12345678",
  "123456789",
  "1234567890",
  "654321",
  "0987654321",
  "111111",
  "000000",
  "222222",
  "333333",
  "444444",
  "555555",
  "666666",
  "777777",
  "888888",
  "999999",
  "123123",
  "112233",
  "121212",
  "123321",
  "159357",
  "5201314",
  "1314520",
  "666888",
  "168168",
  "a123456",
  "123456a",
  "123456789a",
  "password",
  "passw0rd",
  "password1",
  "password123",
  "p@ssw0rd",
  "admin",
  "admin123",
  "admin888",
  "administrator",
  "root",
  "root123",
  "qwerty",
  "qwertyuiop",
  "qwerty123",
  "abc123",
  "abcd1234",
  "abcabc",
  "aa123456",
  "iloveyou",
  "letmein",
  "welcome",
  "monkey",
  "dragon",
  "master",
  "sunshine",
  "princess",
  "football",
  "baseball",
  "superman",
  "hello123",
  "test123",
  "test1234",
  "zxcvbnm",
  "asdfgh",
  "asdfghjkl",
  "qazwsx",
  "1qaz2wsx",
  "1qazxsw2",
  "qwe123",
  "qweasd",
  "q1w2e3",
  "pass123",
  "p123456",
  "123abc",
  "abcd123",
  "a1b2c3",
  "beidou",
  "beidouin",
  "brskills",
  "competition",
  "competition123",
  "contest",
  "contest2026",
  "hwasmart",
  "hwasmart123"
]
feat(auth): 口令强度策略（弱口令黑名单 / 账号派生值 / 长度上限）背景（R61 实测）：浏览器密码管理器在「设置密码」页预填 123456，考生若直接提交，该口令即成为其账号真实口令；而后端此前仅由 validate 校验「长度 >= 6」，弱口令完全合法。R62 已从前端修掉预填，本次补齐后端这道闸门。 - app/lib/passwordPolicy.js + password_blacklist.json：口令策略唯一事实来源。黑名单刻意做成纯 JSON，供 Node 运行时与运维脚本共用，避免两份清单漂移。 - controller/auth.js：activate() 与 resetPassword() 接入策略（错误码 2001 / 7001），位置在 validate 之后、短信校验之前（纯本地计算、无副作用、快速失败）。 - validate/index.js：补 max:20，与前端 el-form 规则对齐（此前只有前端限制长度上限）。 - scripts/_db.cjs：DB 配置解析唯一入口；scan_weak_password_accounts.cjs：存量弱口令只读扫描器；verify_password_policy_api.cjs：真接口验证（含「强口令通过」正向对照臂，防假绿）。 2026-09-30 11:56:35 +08:00			`[`
			`"123456",`
			`"1234567",`
			`"12345678",`
			`"123456789",`
			`"1234567890",`
			`"654321",`
			`"0987654321",`
			`"111111",`
			`"000000",`
			`"222222",`
			`"333333",`
			`"444444",`
			`"555555",`
			`"666666",`
			`"777777",`
			`"888888",`
			`"999999",`
			`"123123",`
			`"112233",`
			`"121212",`
			`"123321",`
			`"159357",`
			`"5201314",`
			`"1314520",`
			`"666888",`
			`"168168",`
			`"a123456",`
			`"123456a",`
			`"123456789a",`
			`"password",`
			`"passw0rd",`
			`"password1",`
			`"password123",`
			`"p@ssw0rd",`
			`"admin",`
			`"admin123",`
			`"admin888",`
			`"administrator",`
			`"root",`
			`"root123",`
			`"qwerty",`
			`"qwertyuiop",`
			`"qwerty123",`
			`"abc123",`
			`"abcd1234",`
			`"abcabc",`
			`"aa123456",`
			`"iloveyou",`
			`"letmein",`
			`"welcome",`
			`"monkey",`
			`"dragon",`
			`"master",`
			`"sunshine",`
			`"princess",`
			`"football",`
			`"baseball",`
			`"superman",`
			`"hello123",`
			`"test123",`
			`"test1234",`
			`"zxcvbnm",`
			`"asdfgh",`
			`"asdfghjkl",`
			`"qazwsx",`
			`"1qaz2wsx",`
			`"1qazxsw2",`
			`"qwe123",`
			`"qweasd",`
			`"q1w2e3",`
			`"pass123",`
			`"p123456",`
			`"123abc",`
			`"abcd123",`
			`"a1b2c3",`
			`"beidou",`
			`"beidouin",`
			`"brskills",`
			`"competition",`
			`"competition123",`
			`"contest",`
			`"contest2026",`
			`"hwasmart",`
			`"hwasmart123"`
			`]`