From 95ad1adca4249fa177f4f057ce9200bcf1849292 Mon Sep 17 00:00:00 2001 From: qubiaobiao <3294694717@qq.com> Date: Sat, 10 Oct 2026 15:15:37 +0800 Subject: [PATCH] =?UTF-8?q?fix(deps):=20xlsx=20=E2=86=92=20@e965/xlsx@0.20?= =?UTF-8?q?.3=EF=BC=88=E6=B6=88=E9=99=A4=E4=B8=A4=E5=A4=84=E5=B7=B2?= =?UTF-8?q?=E7=9F=A5=20high=20=E4=BE=9B=E5=BA=94=E9=93=BE=E6=BC=8F?= =?UTF-8?q?=E6=B4=9E=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 背景：npm 上的 xlsx 永久冻结在 0.18.5（SheetJS 已停止向 npm 发布），该版本含 CVE-2023-30533（原型污染，0.19.3 修复）与 CVE-2024-22363（ReDoS，0.20.2 修复）两处 high， 而 npm 上**不存在**修复版本——官方修复版只发自家 CDN。 选型判据=CDN 可达性：本机实测 cdn.sheetjs.com 不可达（curl rc=35 schannel 吊销离线； --ssl-no-revoke 后 rc=28 超时），采用官方 CDN tarball 会把「依赖能否装上」变成部署单点。 故改用 npm 上忠实转发官方 CDN 构建的 @e965/xlsx（0.20.3，含上述两处修复、零依赖、 API 与 xlsx 全等）。未选 exceljs：其 API 完全不同，11 个调用点需全量重写且写入变异步， 风险直接落在承载生产导入路径的代码上。 - package.json：xlsx@^0.18.0 → @e965/xlsx@^0.20.3 - app/service/admin.js（成绩导出 / 客观题模板 / 报名表导入 / 客观题导入） app/service/bigQuestion.js（综合大题模板 / 综合大题导入）：仅改 require 包名， 业务逻辑零改动（共 6 条路径 / 11 个调用点） - package-lock.json：移除 xlsx 及其 7 个传递依赖（cfb/codepage/ssf/wmf/word/adler-32/frac）， 净 −7 包 验证：API 面 + 写读往返 PASS；差分测试 24/24（含畸形尺寸样本与 201 行模板）； 真实 HTTP 回归 6 条路径 PASS（写 3/3 均 PK 头、读 3/3 正效应且落库计数吻合）； 跨库往返 6/6；npm audit 中 xlsx 命中【无】（backend high 23 → 22）。 --- app/service/admin.js | 4 +- app/service/bigQuestion.js | 6 ++- package-lock.json | 105 +++++-------------------------------- package.json | 2 +- 4 files changed, 22 insertions(+), 95 deletions(-) diff --git a/app/service/admin.js b/app/service/admin.js index 880d0ee..2ee18c5 100644 --- a/app/service/admin.js +++ b/app/service/admin.js @@ -3,7 +3,9 @@ const Service = require('egg').Service; const path = require('path'); const fs = require('fs'); -const XLSX = require('xlsx'); +// 2026-10-10 换库：理由同 service/bigQuestion.js —— npm 上 `xlsx` 冻结在 0.18.5（两处 high CVE）， +// 官方修复版仅在不可达的 cdn.sheetjs.com ⇒ 改用零依赖、API 一致的 `@e965/xlsx@0.20.3`。 +const XLSX = require('@e965/xlsx'); const { buildAggregationKeyMap, resolveAggregationKeysForContestant, diff --git a/app/service/bigQuestion.js b/app/service/bigQuestion.js index 7a57e2b..f8d2f58 100644 --- a/app/service/bigQuestion.js +++ b/app/service/bigQuestion.js @@ -1,7 +1,11 @@ 'use strict'; const Service = require('egg').Service; -const XLSX = require('xlsx'); +// 2026-10-10 换库：npm 上的 `xlsx` 永久冻结在 0.18.5（含 CVE-2023-30533 原型污染 + +// CVE-2024-22363 ReDoS，且 npm 无修复版本）。SheetJS 官方把修复版只发自家 CDN， +// 而 cdn.sheetjs.com 在部署环境不可达 ⇒ 改用 npm 上忠实转发官方 CDN 构建的 +// `@e965/xlsx`（0.20.3，含两处修复，零依赖，API 与 xlsx 完全一致）。 +const XLSX = require('@e965/xlsx'); /** * 综合大题服务 - BigQuestionService diff --git a/package-lock.json b/package-lock.json index 7897e5c..f4dcb0a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13,6 +13,7 @@ "@alicloud/openapi-client": "^0.4.15", "@alicloud/tea-util": "^1.4.11", "@artus/core": "^2.2.4", + "@e965/xlsx": "^0.20.3", "@eggjs/router": "^3.0.6", "archiver": "^8.0.0", "bcrypt": "^6.0.0", @@ -29,7 +30,6 @@ "mz-modules": "^2.1.0", "svg-captcha": "^1.4.0", "tslib": "^2.8.1", - "xlsx": "^0.18.0", "ylru": "^1.4.0" }, "devDependencies": { @@ -372,6 +372,18 @@ "xml2js": "^0.6.2" } }, + "node_modules/@e965/xlsx": { + "version": "0.20.3", + "resolved": "https://registry.npmmirror.com/@e965/xlsx/-/xlsx-0.20.3.tgz", + "integrity": "sha512-703RN/3OdsRD5mtse2HBX7Um7xwaP9tlswEG6svOtjqokXoX7rJdQj7DyabD2I+xk22RgaIIU+R6BHgkpZGB/w==", + "license": "Apache-2.0", + "bin": { + "xlsx": "bin/xlsx.njs" + }, + "engines": { + "node": ">=0.8" + } + }, "node_modules/@eggjs/ip": { "version": "2.1.0", "resolved": "https://registry.npmmirror.com/@eggjs/ip/-/ip-2.1.0.tgz", @@ -1212,15 +1224,6 @@ "node": ">= 16.0.0" } }, - "node_modules/adler-32": { - "version": "1.3.1", - "resolved": "https://registry.npmmirror.com/adler-32/-/adler-32-1.3.1.tgz", - "integrity": "sha512-ynZ4w/nUUv5rrsR8UUGoe1VC9hZj6V5hU9Qw1HlMDJGEJw5S7TfTErWTjMys6M7vr0YWcPqs3qAr4ss0nDfP+A==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/agent-base": { "version": "6.0.2", "resolved": "https://registry.npmmirror.com/agent-base/-/agent-base-6.0.2.tgz", @@ -1905,19 +1908,6 @@ "node": ">=6" } }, - "node_modules/cfb": { - "version": "1.2.2", - "resolved": "https://registry.npmmirror.com/cfb/-/cfb-1.2.2.tgz", - "integrity": "sha512-KfdUZsSOw19/ObEWasvBP/Ac4reZvAGauZhs6S/gqNhXhI7cKwvlH7ulj+dOEYnca4bm4SGo8C1bTAQvnTjgQA==", - "license": "Apache-2.0", - "dependencies": { - "adler-32": "~1.3.0", - "crc-32": "~1.2.0" - }, - "engines": { - "node": ">=0.8" - } - }, "node_modules/cfork": { "version": "1.11.0", "resolved": "https://registry.npmmirror.com/cfork/-/cfork-1.11.0.tgz", @@ -2209,15 +2199,6 @@ "node": ">= 14.0.0" } }, - "node_modules/codepage": { - "version": "1.15.0", - "resolved": "https://registry.npmmirror.com/codepage/-/codepage-1.15.0.tgz", - "integrity": "sha512-3g6NUTPd/YtuuGrhMnOMRjFc+LJw/bnMp3+0r/Wcz3IXUuCosKRJvMphm5+Q+bvTVGcJJuRvVLuYba+WojaFaA==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/coffee": { "version": "5.5.1", "resolved": "https://registry.npmmirror.com/coffee/-/coffee-5.5.1.tgz", @@ -4756,15 +4737,6 @@ "pause-stream": "~0.0.11" } }, - "node_modules/frac": { - "version": "1.1.2", - "resolved": "https://registry.npmmirror.com/frac/-/frac-1.1.2.tgz", - "integrity": "sha512-w/XBfkibaTl3YDqASwfDUqkna4Z2p9cFSr1aHDt0WoMTECnRfBOv2WArlZILlqgWlmdIlALXGpM2AOhEk5W3IA==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/fresh": { "version": "0.5.2", "resolved": "https://registry.npmmirror.com/fresh/-/fresh-0.5.2.tgz", @@ -9618,18 +9590,6 @@ "url": "https://github.com/mysqljs/sql-escaper?sponsor=1" } }, - "node_modules/ssf": { - "version": "0.11.2", - "resolved": "https://registry.npmmirror.com/ssf/-/ssf-0.11.2.tgz", - "integrity": "sha512-+idbmIXoYET47hH+d7dfm2epdOMUDjqcB4648sTZ+t2JwoyBFL/insLfB/racrDmsKB3diwsDA696pZMieAC5g==", - "license": "Apache-2.0", - "dependencies": { - "frac": "~1.1.2" - }, - "engines": { - "node": ">=0.8" - } - }, "node_modules/stack-trace": { "version": "0.0.10", "resolved": "https://registry.npmmirror.com/stack-trace/-/stack-trace-0.0.10.tgz", @@ -10862,24 +10822,6 @@ "@types/node": "*" } }, - "node_modules/wmf": { - "version": "1.0.2", - "resolved": "https://registry.npmmirror.com/wmf/-/wmf-1.0.2.tgz", - "integrity": "sha512-/p9K7bEh0Dj6WbXg4JG0xvLQmIadrner1bi45VMJTfnbVHsc7yIajZyoSoK60/dtVBs12Fm6WkUI5/3WAVsNMw==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, - "node_modules/word": { - "version": "0.3.0", - "resolved": "https://registry.npmmirror.com/word/-/word-0.3.0.tgz", - "integrity": "sha512-OELeY0Q61OXpdUfTp+oweA/vtLVg5VDOXh+3he3PNzLGG/y0oylSOC1xRVj0+l4vQ3tj/bB1HVHv1ocXkQceFA==", - "license": "Apache-2.0", - "engines": { - "node": ">=0.8" - } - }, "node_modules/wordwrapjs": { "version": "4.0.1", "resolved": "https://registry.npmmirror.com/wordwrapjs/-/wordwrapjs-4.0.1.tgz", @@ -11099,27 +11041,6 @@ "get-ready": "~1.0.0" } }, - "node_modules/xlsx": { - "version": "0.18.5", - "resolved": "https://registry.npmmirror.com/xlsx/-/xlsx-0.18.5.tgz", - "integrity": "sha512-dmg3LCjBPHZnQp5/F/+nnTa+miPJxUXB6vtk42YjBBKayDNagxGEeIdWApkYPOf3Z3pm3k62Knjzp7lMeTEtFQ==", - "license": "Apache-2.0", - "dependencies": { - "adler-32": "~1.3.0", - "cfb": "~1.2.1", - "codepage": "~1.15.0", - "crc-32": "~1.2.1", - "ssf": "~0.11.2", - "wmf": "~1.0.1", - "word": "~0.3.0" - }, - "bin": { - "xlsx": "bin/xlsx.njs" - }, - "engines": { - "node": ">=0.8" - } - }, "node_modules/xml2js": { "version": "0.6.2", "resolved": "https://registry.npmmirror.com/xml2js/-/xml2js-0.6.2.tgz", diff --git a/package.json b/package.json index a63e932..72faedd 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,7 @@ "mz-modules": "^2.1.0", "svg-captcha": "^1.4.0", "tslib": "^2.8.1", - "xlsx": "^0.18.0", + "@e965/xlsx": "^0.20.3", "ylru": "^1.4.0" }, "devDependencies": {