Files
competition-website/seed-carousel.js

50 lines
2.1 KiB
JavaScript
Raw Normal View History

const { Sequelize } = require('./node_modules/sequelize');
chore(security): 处置已入库的本地 DB 口令(P1-P3;P4 改历史不做) 背景(R14 登记的 §16.3): git grep -l "74191221" HEAD 曾命中 7 个文件,全为本地 MariaDB root 口令 (已核实无生产凭据)。本次按登记项执行 P1-P3;P4(git filter-repo 改写 历史)明确不做。 P1 database/config.json(dev/test 两段明文口令) - 加入 .gitignore - 新增 database/config.json.example(口令为 CHANGE_ME 占位符) - git rm --cached(保留磁盘文件,本地 sequelize-cli 不受影响) - 注意:这是对共享仓库的文件移除。push 后其他克隆需 cp database/config.json.example database/config.json 并填入口令。 P2 五个脚本口令环境变量化(去明文兜底) - add_word_cols.js / add_wx_link.js / show_tables.js / seed-carousel.js 内联 '74191221' 改为 process.env.DB_PASSWORD(另支持 DB_HOST/DB_USER/DB_NAME) - scripts/diagnose_upload_download.cjs:process.env.DB_PASS || '74191221' 改为 process.env.DB_PASS;用法注释中的示例口令改为占位符 - 有意的行为变更:未注入 DB_PASSWORD 时明确失败,不再静默使用公开口令 P3 config/config.default.js 消除「生产静默回退公开口令」 - sequelize.password 去掉 || '74191221' - redis.client.password 去掉 || '74191221' - 生产安全守卫新增 DB_PASSWORD 缺失阻断(与 JWT_SECRET/APP_KEYS 同源同形) - deploy/.env.production 本就含 DB_PASSWORD ⇒ 现网零影响 验证(全部实测): - git grep 74191221 工作树零命中(HEAD 仍有,属 P4 不做范围) - 裸启动(无任何 DB 变量)成功:本地口令由 config.local.js 提供 - 端到端:health db:ok + admin-login code=0 - MySQL 侧独立取证:processlist = root @ competition_db - 变异测试(改坏 config.local.js 口令)⇒ 报 1045 且用户名仍为 root ⇒ 同证 P3 兜底确已移除 + R18 的生产账号过滤仍生效 - P2 双向验证:无 DB_PASSWORD 失败 / 注入后正常列 27 张表 - 门禁四连:verify_scoring_e2e 17/0、verify_exam_submit_integrity 46/0、 verify_big_question --cleanup(清理+窗口还原)、check_no_proxy_guard 5 变异全检出
2026-09-23 16:34:08 +08:00
// 🔴 口令不再内置明文(2026-09-23 入库口令处置 P2)。运行前请注入 DB_PASSWORD:
// DB_PASSWORD='<本机 DB 口令>' node seed-carousel.js
const sequelize = new Sequelize(
process.env.DB_NAME || 'competition_db',
process.env.DB_USER || 'root',
process.env.DB_PASSWORD,
{
host: process.env.DB_HOST || 'localhost',
port: parseInt(process.env.DB_PORT, 10) || 3306,
dialect: 'mysql',
logging: false,
}
);
(async () => {
try {
await sequelize.authenticate();
console.log('DB connected');
// MariaDB 5.5 compatible: only one TIMESTAMP can have DEFAULT CURRENT_TIMESTAMP
await sequelize.query(`
CREATE TABLE IF NOT EXISTS carousel (
id INT UNSIGNED NOT NULL AUTO_INCREMENT,
image_url VARCHAR(500) NOT NULL,
sort_order INT NOT NULL DEFAULT 0,
link_url VARCHAR(500) NULL,
enabled TINYINT(1) NOT NULL DEFAULT 1,
created_at DATETIME NOT NULL,
updated_at DATETIME NOT NULL,
PRIMARY KEY (id),
KEY idx_sort_order (sort_order),
KEY idx_enabled (enabled)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
`);
const [rows] = await sequelize.query('SELECT COUNT(*) as cnt FROM carousel');
console.log('Existing:', rows[0].cnt);
if (rows[0].cnt === 0) {
await sequelize.query("INSERT INTO carousel (image_url, sort_order, enabled, created_at, updated_at) VALUES ('https://images.unsplash.com/photo-1446776811953-b23d57bd21aa?w=1200', 1, 1, NOW(), NOW())");
await sequelize.query("INSERT INTO carousel (image_url, sort_order, enabled, created_at, updated_at) VALUES ('https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200', 2, 1, NOW(), NOW())");
await sequelize.query("INSERT INTO carousel (image_url, sort_order, enabled, created_at, updated_at) VALUES ('https://images.unsplash.com/photo-1614728263952-84ea256f9679?w=1200', 3, 1, NOW(), NOW())");
console.log('Inserted 3 carousel slides');
}
console.log('Done');
} catch(e) { console.error(e.message); }
finally { await sequelize.close(); }
})();