qubiaobiao
95ad1adca4
背景：npm 上的 xlsx 永久冻结在 0.18.5（SheetJS 已停止向 npm 发布），该版本含 CVE-2023-30533（原型污染，0.19.3 修复）与 CVE-2024-22363（ReDoS，0.20.2 修复）两处 high， 而 npm 上**不存在**修复版本——官方修复版只发自家 CDN。 选型判据=CDN 可达性：本机实测 cdn.sheetjs.com 不可达（curl rc=35 schannel 吊销离线； --ssl-no-revoke 后 rc=28 超时），采用官方 CDN tarball 会把「依赖能否装上」变成部署单点。 故改用 npm 上忠实转发官方 CDN 构建的 @e965/xlsx（0.20.3，含上述两处修复、零依赖、 API 与 xlsx 全等）。未选 exceljs：其 API 完全不同，11 个调用点需全量重写且写入变异步， 风险直接落在承载生产导入路径的代码上。 - package.json：xlsx@^0.18.0 → @e965/xlsx@^0.20.3 - app/service/admin.js（成绩导出 / 客观题模板 / 报名表导入 / 客观题导入） app/service/bigQuestion.js（综合大题模板 / 综合大题导入）：仅改 require 包名， 业务逻辑零改动（共 6 条路径 / 11 个调用点） - package-lock.json：移除 xlsx 及其 7 个传递依赖（cfb/codepage/ssf/wmf/word/adler-32/frac）， 净 −7 包 验证：API 面 + 写读往返 PASS；差分测试 24/24（含畸形尺寸样本与 201 行模板）； 真实 HTTP 回归 6 条路径 PASS（写 3/3 均 PK 头、读 3/3 正效应且落库计数吻合）； 跨库往返 6/6；npm audit 中 xlsx 命中【无】（backend high 23 → 22）。
71 lines
1.7 KiB
JSON
71 lines
1.7 KiB
JSON
{
|
|
"name": "competition-website-backend",
|
|
"version": "1.0.0",
|
|
"description": "通信与导航应用技术创新赛线上选拔赛网站后端",
|
|
"private": true,
|
|
"egg": {
|
|
"declarations": false,
|
|
"typescript": false
|
|
},
|
|
"dependencies": {
|
|
"@alicloud/dysmsapi20170525": "^4.6.0",
|
|
"@alicloud/openapi-client": "^0.4.15",
|
|
"@alicloud/tea-util": "^1.4.11",
|
|
"@artus/core": "^2.2.4",
|
|
"@eggjs/router": "^3.0.6",
|
|
"archiver": "^8.0.0",
|
|
"bcrypt": "^6.0.0",
|
|
"cliui": "^9.0.1",
|
|
"egg": "^3.34.0",
|
|
"egg-cors": "^2.2.4",
|
|
"egg-scripts": "^2.17.0",
|
|
"egg-sequelize": "^6.0.0",
|
|
"egg-validate": "^2.0.2",
|
|
"get-ready": "^2.0.1",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"multer": "^1.4.5-lts.1",
|
|
"mysql2": "^3.6.5",
|
|
"mz-modules": "^2.1.0",
|
|
"svg-captcha": "^1.4.0",
|
|
"tslib": "^2.8.1",
|
|
"@e965/xlsx": "^0.20.3",
|
|
"ylru": "^1.4.0"
|
|
},
|
|
"devDependencies": {
|
|
"egg-bin": "^6.3.0",
|
|
"egg-mock": "^5.0.0",
|
|
"sequelize-cli": "^6.6.2",
|
|
"string-width": "^4.2.3",
|
|
"wt": "^1.2.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=16.0.0"
|
|
},
|
|
"scripts": {
|
|
"start": "egg-scripts start --daemon --title=competition-website-backend",
|
|
"stop": "egg-scripts stop --title=competition-website-backend",
|
|
"dev": "egg-bin dev",
|
|
"debug": "egg-bin debug",
|
|
"test": "npm run lint -- --fix && npm run test-local",
|
|
"test-local": "egg-bin test",
|
|
"cov": "egg-bin cov",
|
|
"lint": "eslint .",
|
|
"ci": "npm run cov"
|
|
},
|
|
"ci": {
|
|
"version": "14, 16",
|
|
"type": "github"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": ""
|
|
},
|
|
"keywords": [
|
|
"egg",
|
|
"competition",
|
|
"backend"
|
|
],
|
|
"author": "",
|
|
"license": "MIT"
|
|
}
|