qubiaobiao
a2e24aba2a
背景（R61 实测）：浏览器密码管理器在「设置密码」页预填 123456，考生若直接提交，该口令即成为其账号真实口令；而后端此前仅由 validate 校验「长度 >= 6」，弱口令完全合法。R62 已从前端修掉预填，本次补齐后端这道闸门。 - app/lib/passwordPolicy.js + password_blacklist.json：口令策略唯一事实来源。黑名单刻意做成纯 JSON，供 Node 运行时与运维脚本共用，避免两份清单漂移。 - controller/auth.js：activate() 与 resetPassword() 接入策略（错误码 2001 / 7001），位置在 validate 之后、短信校验之前（纯本地计算、无副作用、快速失败）。 - validate/index.js：补 max:20，与前端 el-form 规则对齐（此前只有前端限制长度上限）。 - scripts/_db.cjs：DB 配置解析唯一入口；scan_weak_password_accounts.cjs：存量弱口令只读扫描器；verify_password_policy_api.cjs：真接口验证（含「强口令通过」正向对照臂，防假绿）。
87 lines
1.1 KiB
JSON
87 lines
1.1 KiB
JSON
[
|
|
"123456",
|
|
"1234567",
|
|
"12345678",
|
|
"123456789",
|
|
"1234567890",
|
|
"654321",
|
|
"0987654321",
|
|
"111111",
|
|
"000000",
|
|
"222222",
|
|
"333333",
|
|
"444444",
|
|
"555555",
|
|
"666666",
|
|
"777777",
|
|
"888888",
|
|
"999999",
|
|
"123123",
|
|
"112233",
|
|
"121212",
|
|
"123321",
|
|
"159357",
|
|
"5201314",
|
|
"1314520",
|
|
"666888",
|
|
"168168",
|
|
"a123456",
|
|
"123456a",
|
|
"123456789a",
|
|
"password",
|
|
"passw0rd",
|
|
"password1",
|
|
"password123",
|
|
"p@ssw0rd",
|
|
"admin",
|
|
"admin123",
|
|
"admin888",
|
|
"administrator",
|
|
"root",
|
|
"root123",
|
|
"qwerty",
|
|
"qwertyuiop",
|
|
"qwerty123",
|
|
"abc123",
|
|
"abcd1234",
|
|
"abcabc",
|
|
"aa123456",
|
|
"iloveyou",
|
|
"letmein",
|
|
"welcome",
|
|
"monkey",
|
|
"dragon",
|
|
"master",
|
|
"sunshine",
|
|
"princess",
|
|
"football",
|
|
"baseball",
|
|
"superman",
|
|
"hello123",
|
|
"test123",
|
|
"test1234",
|
|
"zxcvbnm",
|
|
"asdfgh",
|
|
"asdfghjkl",
|
|
"qazwsx",
|
|
"1qaz2wsx",
|
|
"1qazxsw2",
|
|
"qwe123",
|
|
"qweasd",
|
|
"q1w2e3",
|
|
"pass123",
|
|
"p123456",
|
|
"123abc",
|
|
"abcd123",
|
|
"a1b2c3",
|
|
"beidou",
|
|
"beidouin",
|
|
"brskills",
|
|
"competition",
|
|
"competition123",
|
|
"contest",
|
|
"contest2026",
|
|
"hwasmart",
|
|
"hwasmart123"
|
|
]
|