fix(deps): xlsx → @e965/xlsx@0.20.3（消除两处已知 high 供应链漏洞）

背景：npm 上的 xlsx 永久冻结在 0.18.5（SheetJS 已停止向 npm 发布），该版本含 CVE-2023-30533（原型污染，0.19.3 修复）与 CVE-2024-22363（ReDoS，0.20.2 修复）两处 high，而 npm 上**不存在**修复版本——官方修复版只发自家 CDN。选型判据=CDN 可达性：本机实测 cdn.sheetjs.com 不可达（curl rc=35 schannel 吊销离线； --ssl-no-revoke 后 rc=28 超时），采用官方 CDN tarball 会把「依赖能否装上」变成部署单点。故改用 npm 上忠实转发官方 CDN 构建的 @e965/xlsx（0.20.3，含上述两处修复、零依赖、 API 与 xlsx 全等）。未选 exceljs：其 API 完全不同，11 个调用点需全量重写且写入变异步，风险直接落在承载生产导入路径的代码上。 - package.json：xlsx@^0.18.0 → @e965/xlsx@^0.20.3 - app/service/admin.js（成绩导出 / 客观题模板 / 报名表导入 / 客观题导入） app/service/bigQuestion.js（综合大题模板 / 综合大题导入）：仅改 require 包名，业务逻辑零改动（共 6 条路径 / 11 个调用点） - package-lock.json：移除 xlsx 及其 7 个传递依赖（cfb/codepage/ssf/wmf/word/adler-32/frac），净 −7 包验证：API 面 + 写读往返 PASS；差分测试 24/24（含畸形尺寸样本与 201 行模板）；真实 HTTP 回归 6 条路径 PASS（写 3/3 均 PK 头、读 3/3 正效应且落库计数吻合）；跨库往返 6/6；npm audit 中 xlsx 命中【无】（backend high 23 → 22）。
2026-10-10 15:15:37 +08:00
parent 29ce734ffa
commit 95ad1adca4
4 changed files with 22 additions and 95 deletions
--- a/app/service/admin.js
+++ b/app/service/admin.js
@@ -3,7 +3,9 @@
 const Service = require('egg').Service;
 const path = require('path');
 const fs = require('fs');
-const XLSX = require('xlsx');
+// 2026-10-10 换库：理由同 service/bigQuestion.js —— npm 上 `xlsx` 冻结在 0.18.5（两处 high CVE），
+// 官方修复版仅在不可达的 cdn.sheetjs.com ⇒ 改用零依赖、API 一致的 `@e965/xlsx@0.20.3`。
+const XLSX = require('@e965/xlsx');
 const {
  buildAggregationKeyMap,
  resolveAggregationKeysForContestant,
--- a/app/service/bigQuestion.js
+++ b/app/service/bigQuestion.js
@@ -1,7 +1,11 @@
 'use strict';

 const Service = require('egg').Service;
-const XLSX = require('xlsx');
+// 2026-10-10 换库：npm 上的 `xlsx` 永久冻结在 0.18.5（含 CVE-2023-30533 原型污染 +
+// CVE-2024-22363 ReDoS，且 npm 无修复版本）。SheetJS 官方把修复版只发自家 CDN，
+// 而 cdn.sheetjs.com 在部署环境不可达 ⇒ 改用 npm 上忠实转发官方 CDN 构建的
+// `@e965/xlsx`（0.20.3，含两处修复，零依赖，API 与 xlsx 完全一致）。
+const XLSX = require('@e965/xlsx');

 /**
 * 综合大题服务 - BigQuestionService
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,6 +13,7 @@
        "@alicloud/openapi-client": "^0.4.15",
        "@alicloud/tea-util": "^1.4.11",
        "@artus/core": "^2.2.4",
+        "@e965/xlsx": "^0.20.3",
        "@eggjs/router": "^3.0.6",
        "archiver": "^8.0.0",
        "bcrypt": "^6.0.0",
@@ -29,7 +30,6 @@
        "mz-modules": "^2.1.0",
        "svg-captcha": "^1.4.0",
        "tslib": "^2.8.1",
-        "xlsx": "^0.18.0",
        "ylru": "^1.4.0"
      },
      "devDependencies": {
@@ -372,6 +372,18 @@
        "xml2js": "^0.6.2"
      }
    },
+    "node_modules/@e965/xlsx": {
+      "version": "0.20.3",
+      "resolved": "https://registry.npmmirror.com/@e965/xlsx/-/xlsx-0.20.3.tgz",
+      "integrity": "sha512-703RN/3OdsRD5mtse2HBX7Um7xwaP9tlswEG6svOtjqokXoX7rJdQj7DyabD2I+xk22RgaIIU+R6BHgkpZGB/w==",
+      "license": "Apache-2.0",
+      "bin": {
+        "xlsx": "bin/xlsx.njs"
+      },
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
    "node_modules/@eggjs/ip": {
      "version": "2.1.0",
      "resolved": "https://registry.npmmirror.com/@eggjs/ip/-/ip-2.1.0.tgz",
@@ -1212,15 +1224,6 @@
        "node": ">= 16.0.0"
      }
    },
-    "node_modules/adler-32": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmmirror.com/adler-32/-/adler-32-1.3.1.tgz",
-      "integrity": "sha512-ynZ4w/nUUv5rrsR8UUGoe1VC9hZj6V5hU9Qw1HlMDJGEJw5S7TfTErWTjMys6M7vr0YWcPqs3qAr4ss0nDfP+A==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
    "node_modules/agent-base": {
      "version": "6.0.2",
      "resolved": "https://registry.npmmirror.com/agent-base/-/agent-base-6.0.2.tgz",
@@ -1905,19 +1908,6 @@
        "node": ">=6"
      }
    },
-    "node_modules/cfb": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmmirror.com/cfb/-/cfb-1.2.2.tgz",
-      "integrity": "sha512-KfdUZsSOw19/ObEWasvBP/Ac4reZvAGauZhs6S/gqNhXhI7cKwvlH7ulj+dOEYnca4bm4SGo8C1bTAQvnTjgQA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "adler-32": "~1.3.0",
-        "crc-32": "~1.2.0"
-      },
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
    "node_modules/cfork": {
      "version": "1.11.0",
      "resolved": "https://registry.npmmirror.com/cfork/-/cfork-1.11.0.tgz",
@@ -2209,15 +2199,6 @@
        "node": ">= 14.0.0"
      }
    },
-    "node_modules/codepage": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmmirror.com/codepage/-/codepage-1.15.0.tgz",
-      "integrity": "sha512-3g6NUTPd/YtuuGrhMnOMRjFc+LJw/bnMp3+0r/Wcz3IXUuCosKRJvMphm5+Q+bvTVGcJJuRvVLuYba+WojaFaA==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
    "node_modules/coffee": {
      "version": "5.5.1",
      "resolved": "https://registry.npmmirror.com/coffee/-/coffee-5.5.1.tgz",
@@ -4756,15 +4737,6 @@
        "pause-stream": "~0.0.11"
      }
    },
-    "node_modules/frac": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmmirror.com/frac/-/frac-1.1.2.tgz",
-      "integrity": "sha512-w/XBfkibaTl3YDqASwfDUqkna4Z2p9cFSr1aHDt0WoMTECnRfBOv2WArlZILlqgWlmdIlALXGpM2AOhEk5W3IA==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
    "node_modules/fresh": {
      "version": "0.5.2",
      "resolved": "https://registry.npmmirror.com/fresh/-/fresh-0.5.2.tgz",
@@ -9618,18 +9590,6 @@
        "url": "https://github.com/mysqljs/sql-escaper?sponsor=1"
      }
    },
-    "node_modules/ssf": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmmirror.com/ssf/-/ssf-0.11.2.tgz",
-      "integrity": "sha512-+idbmIXoYET47hH+d7dfm2epdOMUDjqcB4648sTZ+t2JwoyBFL/insLfB/racrDmsKB3diwsDA696pZMieAC5g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "frac": "~1.1.2"
-      },
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
    "node_modules/stack-trace": {
      "version": "0.0.10",
      "resolved": "https://registry.npmmirror.com/stack-trace/-/stack-trace-0.0.10.tgz",
@@ -10862,24 +10822,6 @@
        "@types/node": "*"
      }
    },
-    "node_modules/wmf": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmmirror.com/wmf/-/wmf-1.0.2.tgz",
-      "integrity": "sha512-/p9K7bEh0Dj6WbXg4JG0xvLQmIadrner1bi45VMJTfnbVHsc7yIajZyoSoK60/dtVBs12Fm6WkUI5/3WAVsNMw==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
-    "node_modules/word": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmmirror.com/word/-/word-0.3.0.tgz",
-      "integrity": "sha512-OELeY0Q61OXpdUfTp+oweA/vtLVg5VDOXh+3he3PNzLGG/y0oylSOC1xRVj0+l4vQ3tj/bB1HVHv1ocXkQceFA==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
    "node_modules/wordwrapjs": {
      "version": "4.0.1",
      "resolved": "https://registry.npmmirror.com/wordwrapjs/-/wordwrapjs-4.0.1.tgz",
@@ -11099,27 +11041,6 @@
        "get-ready": "~1.0.0"
      }
    },
-    "node_modules/xlsx": {
-      "version": "0.18.5",
-      "resolved": "https://registry.npmmirror.com/xlsx/-/xlsx-0.18.5.tgz",
-      "integrity": "sha512-dmg3LCjBPHZnQp5/F/+nnTa+miPJxUXB6vtk42YjBBKayDNagxGEeIdWApkYPOf3Z3pm3k62Knjzp7lMeTEtFQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "adler-32": "~1.3.0",
-        "cfb": "~1.2.1",
-        "codepage": "~1.15.0",
-        "crc-32": "~1.2.1",
-        "ssf": "~0.11.2",
-        "wmf": "~1.0.1",
-        "word": "~0.3.0"
-      },
-      "bin": {
-        "xlsx": "bin/xlsx.njs"
-      },
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
    "node_modules/xml2js": {
      "version": "0.6.2",
      "resolved": "https://registry.npmmirror.com/xml2js/-/xml2js-0.6.2.tgz",
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
    "mz-modules": "^2.1.0",
    "svg-captcha": "^1.4.0",
    "tslib": "^2.8.1",
-    "xlsx": "^0.18.0",
+    "@e965/xlsx": "^0.20.3",
    "ylru": "^1.4.0"
  },
  "devDependencies": {