diff --git a/app/service/admin.js b/app/service/admin.js index 880d0ee..2ee18c5 100644 --- a/app/service/admin.js +++ b/app/service/admin.js @@ -3,7 +3,9 @@ const Service = require('egg').Service; const path = require('path'); const fs = require('fs'); -const XLSX = require('xlsx'); +// 2026-10-10 换库：理由同 service/bigQuestion.js —— npm 上 `xlsx` 冻结在 0.18.5（两处 high CVE）， +// 官方修复版仅在不可达的 cdn.sheetjs.com ⇒ 改用零依赖、API 一致的 `@e965/xlsx@0.20.3`。 +const XLSX = require('@e965/xlsx'); const { buildAggregationKeyMap, resolveAggregationKeysForContestant, diff --git a/app/service/bigQuestion.js b/app/service/bigQuestion.js index 7a57e2b..f8d2f58 100644 --- a/app/service/bigQuestion.js +++ b/app/service/bigQuestion.js @@ -1,7 +1,11 @@ 'use strict'; const Service = require('egg').Service; -const XLSX = require('xlsx'); +// 2026-10-10 换库：npm 上的 `xlsx` 永久冻结在 0.18.5（含 CVE-2023-30533 原型污染 + +// CVE-2024-22363 ReDoS，且 npm 无修复版本）。SheetJS 官方把修复版只发自家 CDN， +// 而 cdn.sheetjs.com 在部署环境不可达 ⇒ 改用 npm 上忠实转发官方 CDN 构建的 +// `@e965/xlsx`（0.20.3，含两处修复，零依赖，API 与 xlsx 完全一致）。 +const XLSX = require('@e965/xlsx'); /** * 综合大题服务 - BigQuestionService diff --git a/package-lock.json b/package-lock.json index 7897e5c..f4dcb0a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13,6 +13,7 @@ "@alicloud/openapi-client": "^0.4.15", "@alicloud/tea-util": "^1.4.11", "@artus/core": "^2.2.4", + "@e965/xlsx": "^0.20.3", "@eggjs/router": "^3.0.6", "archiver": "^8.0.0", "bcrypt": "^6.0.0", @@ -29,7 +30,6 @@ "mz-modules": "^2.1.0", "svg-captcha": "^1.4.0", "tslib": "^2.8.1", - "xlsx": "^0.18.0", "ylru": "^1.4.0" }, "devDependencies": { @@ -372,6 +372,18 @@ "xml2js": "^0.6.2" } }, + "node_modules/@e965/xlsx": { + "version": "0.20.3", + "resolved": "https://registry.npmmirror.com/@e965/xlsx/-/xlsx-0.20.3.tgz", + "integrity": "sha512-703RN/3OdsRD5mtse2HBX7Um7xwaP9tlswEG6svOtjqokXoX7rJdQj7DyabD2I+xk22RgaIIU+R6BHgkpZGB/w==", + "license": "Apache-2.0", + "bin": { + "xlsx": "bin/xlsx.njs" + }, + "engines": { + "node": ">=0.8" + } + }, "node_modules/@eggjs/ip": { "version": "2.1.0", "resolved": "https://registry.npmmirror.com/@eggjs/ip/-/ip-2.1.0.tgz", @@ -1212,15 +1224,6 @@ "node": ">= 16.0.0" } }, - "node_modules/adler-32": { - "version": "1.3.1", - "resolved": "https://registry.npmmirror.com/adler-32/-/adler-32-1.3.1.tgz", - "integrity": "sha512-ynZ4w/nUUv5rrsR8UUGoe1VC9hZj6V5hU9Qw1HlMDJGEJw5S7TfTErWTjMys6M7vr0YWcPqs3qAr4ss0nDfP+A==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/agent-base": { "version": "6.0.2", "resolved": "https://registry.npmmirror.com/agent-base/-/agent-base-6.0.2.tgz", @@ -1905,19 +1908,6 @@ "node": ">=6" } }, - "node_modules/cfb": { - "version": "1.2.2", - "resolved": "https://registry.npmmirror.com/cfb/-/cfb-1.2.2.tgz", - "integrity": "sha512-KfdUZsSOw19/ObEWasvBP/Ac4reZvAGauZhs6S/gqNhXhI7cKwvlH7ulj+dOEYnca4bm4SGo8C1bTAQvnTjgQA==", - "license": "Apache-2.0", - "dependencies": { - "adler-32": "~1.3.0", - "crc-32": "~1.2.0" - }, - "engines": { - "node": ">=0.8" - } - }, "node_modules/cfork": { "version": "1.11.0", "resolved": "https://registry.npmmirror.com/cfork/-/cfork-1.11.0.tgz", @@ -2209,15 +2199,6 @@ "node": ">= 14.0.0" } }, - "node_modules/codepage": { - "version": "1.15.0", - "resolved": "https://registry.npmmirror.com/codepage/-/codepage-1.15.0.tgz", - "integrity": "sha512-3g6NUTPd/YtuuGrhMnOMRjFc+LJw/bnMp3+0r/Wcz3IXUuCosKRJvMphm5+Q+bvTVGcJJuRvVLuYba+WojaFaA==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/coffee": { "version": "5.5.1", "resolved": "https://registry.npmmirror.com/coffee/-/coffee-5.5.1.tgz", @@ -4756,15 +4737,6 @@ "pause-stream": "~0.0.11" } }, - "node_modules/frac": { - "version": "1.1.2", - "resolved": "https://registry.npmmirror.com/frac/-/frac-1.1.2.tgz", - "integrity": "sha512-w/XBfkibaTl3YDqASwfDUqkna4Z2p9cFSr1aHDt0WoMTECnRfBOv2WArlZILlqgWlmdIlALXGpM2AOhEk5W3IA==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/fresh": { "version": "0.5.2", "resolved": "https://registry.npmmirror.com/fresh/-/fresh-0.5.2.tgz", @@ -9618,18 +9590,6 @@ "url": "https://github.com/mysqljs/sql-escaper?sponsor=1" } }, - "node_modules/ssf": { - "version": "0.11.2", - "resolved": "https://registry.npmmirror.com/ssf/-/ssf-0.11.2.tgz", - "integrity": "sha512-+idbmIXoYET47hH+d7dfm2epdOMUDjqcB4648sTZ+t2JwoyBFL/insLfB/racrDmsKB3diwsDA696pZMieAC5g==", - "license": "Apache-2.0", - "dependencies": { - "frac": "~1.1.2" - }, - "engines": { - "node": ">=0.8" - } - }, "node_modules/stack-trace": { "version": "0.0.10", "resolved": "https://registry.npmmirror.com/stack-trace/-/stack-trace-0.0.10.tgz", @@ -10862,24 +10822,6 @@ "@types/node": "*" } }, - "node_modules/wmf": { - "version": "1.0.2", - "resolved": "https://registry.npmmirror.com/wmf/-/wmf-1.0.2.tgz", - "integrity": "sha512-/p9K7bEh0Dj6WbXg4JG0xvLQmIadrner1bi45VMJTfnbVHsc7yIajZyoSoK60/dtVBs12Fm6WkUI5/3WAVsNMw==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, - "node_modules/word": { - "version": "0.3.0", - "resolved": "https://registry.npmmirror.com/word/-/word-0.3.0.tgz", - "integrity": "sha512-OELeY0Q61OXpdUfTp+oweA/vtLVg5VDOXh+3he3PNzLGG/y0oylSOC1xRVj0+l4vQ3tj/bB1HVHv1ocXkQceFA==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/wordwrapjs": { "version": "4.0.1", "resolved": "https://registry.npmmirror.com/wordwrapjs/-/wordwrapjs-4.0.1.tgz", @@ -11099,27 +11041,6 @@ "get-ready": "~1.0.0" } }, - "node_modules/xlsx": { - "version": "0.18.5", - "resolved": "https://registry.npmmirror.com/xlsx/-/xlsx-0.18.5.tgz", - "integrity": "sha512-dmg3LCjBPHZnQp5/F/+nnTa+miPJxUXB6vtk42YjBBKayDNagxGEeIdWApkYPOf3Z3pm3k62Knjzp7lMeTEtFQ==", - "license": "Apache-2.0", - "dependencies": { - "adler-32": "~1.3.0", - "cfb": "~1.2.1", - "codepage": "~1.15.0", - "crc-32": "~1.2.1", - "ssf": "~0.11.2", - "wmf": "~1.0.1", - "word": "~0.3.0" - }, - "bin": { - "xlsx": "bin/xlsx.njs" - }, - "engines": { - "node": ">=0.8" - } - }, "node_modules/xml2js": { "version": "0.6.2", "resolved": "https://registry.npmmirror.com/xml2js/-/xml2js-0.6.2.tgz", diff --git a/package.json b/package.json index a63e932..72faedd 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,7 @@ "mz-modules": "^2.1.0", "svg-captcha": "^1.4.0", "tslib": "^2.8.1", - "xlsx": "^0.18.0", + "@e965/xlsx": "^0.20.3", "ylru": "^1.4.0" }, "devDependencies": {