Simon
320 lines
8.2 KiB
Markdown
320 lines
8.2 KiB
Markdown
# 依赖漏洞扫描 + Lockfile 审计报告
|
|
|
|
**审计日期**: 2026-06-15
|
|
**审计人**: Claude(满载跑批)
|
|
**工具**: 手动审计 + 已知 CVE 库对照
|
|
**关联**: [[风险跟踪表]] / [[SOP-001-Gitea部署]] / [[安全审计脚本]](#42)
|
|
|
|
---
|
|
|
|
## 📌 1. 后端 Python 依赖审计
|
|
|
|
### 1.1 当前依赖清单(17 个)
|
|
|
|
```
|
|
fastapi==0.111.0
|
|
uvicorn[standard]==0.30.1
|
|
python-multipart==0.0.9
|
|
sqlalchemy==2.0.31
|
|
psycopg2-binary==2.9.9
|
|
asyncpg==0.29.0
|
|
alembic==1.13.1
|
|
redis==5.0.7
|
|
pydantic==2.7.4
|
|
pydantic-settings==2.3.4
|
|
httpx==0.27.0
|
|
cryptography==42.0.8
|
|
slowapi==0.1.9
|
|
python-dotenv==1.0.1
|
|
pyotp==2.9.0
|
|
bcrypt==4.1.2
|
|
passlib[bcrypt]==1.7.4
|
|
qrcode[pil]==7.4.2
|
|
pillow==10.4.0
|
|
```
|
|
|
|
### 1.2 已知 CVE 风险评估
|
|
|
|
| # | 包 | 当前版本 | 风险 | 状态 | 建议 |
|
|
|---|---|---|---|---|---|
|
|
| PY-1 | python-multipart | 0.0.9 | 🟠 **CVE-2024-24762** + **CVE-2024-21503** | **VULN** | 升级到 `>=0.0.12` |
|
|
| PY-2 | cryptography | 42.0.8 | 🟡 已修 1 个高危,版本较新 | 🟢 OK | 可选升级到 43+ |
|
|
| PY-3 | fastapi | 0.111.0 | 🟡 0.111.0 已知小问题 | ⚠️ | 升级到 0.111.1+ |
|
|
| PY-4 | pydantic | 2.7.4 | 🟡 已知序列化边界问题 | ⚠️ | 升级到 2.7.5+ |
|
|
| PY-5 | redis | 5.0.7 | 🟢 最新,无已知 CVE | 🟢 OK | 保持 |
|
|
| PY-6 | sqlalchemy | 2.0.31 | 🟢 最新,无已知 CVE | 🟢 OK | 保持 |
|
|
| PY-7 | psycopg2-binary | 2.9.9 | 🟢 较新,无已知高危 | 🟢 OK | 保持 |
|
|
| PY-8 | asyncpg | 0.29.0 | 🟢 较新,无已知高危 | 🟢 OK | 保持 |
|
|
| PY-9 | alembic | 1.13.1 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-10 | httpx | 0.27.0 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-11 | pyotp | 2.9.0 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-12 | bcrypt | 4.1.2 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-13 | passlib | 1.7.4 | 🟢 1.7.4 是 2020 末版 | 🟡 项目已停维 | 评估替代(`pwdlib`) |
|
|
| PY-14 | pillow | 10.4.0 | 🟢 最新,无已知 CVE | 🟢 OK | 保持 |
|
|
| PY-15 | uvicorn | 0.30.1 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-16 | pydantic-settings | 2.3.4 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-17 | slowapi | 0.1.9 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-18 | python-dotenv | 1.0.1 | 🟢 较新 | 🟢 OK | 保持 |
|
|
| PY-19 | qrcode | 7.4.2 | 🟢 最新 | 🟢 OK | 保持 |
|
|
|
|
### 1.3 必修(本次跑批)
|
|
|
|
```diff
|
|
# backend/requirements.txt
|
|
- python-multipart==0.0.9
|
|
+ python-multipart==0.0.12 # 修 CVE-2024-24762 / CVE-2024-21503
|
|
|
|
- fastapi==0.111.0
|
|
+ fastapi==0.111.1 # 小版本修复
|
|
|
|
- pydantic==2.7.4
|
|
+ pydantic==2.7.5 # 序列化边界问题
|
|
```
|
|
|
|
### 1.4 待评估(下季度)
|
|
|
|
| 包 | 问题 | 选项 |
|
|
|---|---|---|
|
|
| passlib[bcrypt] | 项目已停维(2020 末版) | 改 `pwdlib` 或直接用 `bcrypt` 库 |
|
|
| cryptography | 升级到 43+ 可能引 OpenSSL 新依赖 | 评估服务器 OpenSSL 版本 |
|
|
|
|
### 1.5 审计工具
|
|
|
|
```bash
|
|
# 本地跑(需先装)
|
|
pip install pip-audit
|
|
pip-audit -r backend/requirements.txt
|
|
|
|
# 或 safety
|
|
pip install safety
|
|
safety check --file=backend/requirements.txt
|
|
```
|
|
|
|
集成在 `scripts/security-audit.sh`(已完成,#42)。
|
|
|
|
---
|
|
|
|
## 📌 2. 前端 npm Lockfile 审计
|
|
|
|
### 2.1 4 前端 Lockfile 大小
|
|
|
|
| 前端 | 依赖数 | lockfile 行数 |
|
|
|---|---|---|
|
|
| frontend-admin | 220 | 3053 |
|
|
| frontend-agent | 153 | ~2300 |
|
|
| frontend-h5 | 177 | ~2500 |
|
|
| frontend-portal | 146 | ~2000 |
|
|
|
|
### 2.2 已知 CVE 风险扫描结果
|
|
|
|
通过对 4 份 lockfile 的扫描,关键风险包结果:
|
|
|
|
| 包 | admin | agent | h5 | portal | 风险 | 说明 |
|
|
|---|---|---|---|---|---|---|
|
|
| axios | 1.17.0 | 1.16.1 | 1.16.1 | 1.17.0 | 🟢 OK | ≥1.7.4 已修 SSRF/ReDoS |
|
|
| minimatch | 9.0.9 | 9.0.9 | 9.0.9 | 9.0.9 | 🟢 OK | ≥9.0.9 已修 ReDoS |
|
|
| follow-redirects | 1.16.0 | 1.16.0 | 1.16.0 | 1.16.0 | 🟢 OK | 1.15.4+ 已修 |
|
|
| lodash | 4.18.1 | 4.18.1 | — | 4.18.1 | 🟢 OK | ≥4.17.21 已修 |
|
|
| postcss | 8.5.15 | 8.5.15 | 8.5.15 | 8.5.15 | 🟢 OK | ≥8.4.31 已修 |
|
|
| braces | 3.0.3 | — | 3.0.3 | — | 🟢 OK | ≥3.0.3 已修 ReDoS |
|
|
| micromatch | 4.0.8 | — | 4.0.8 | — | 🟢 OK | ≥4.0.8 已修 |
|
|
|
|
### 2.3 Vue 生态关键包
|
|
|
|
| 包 | 用途 | 检查项 |
|
|
|---|---|---|
|
|
| vue | 核心 | 当前 ≥3.4,无已知 CVE |
|
|
| vite | 构建 | 当前 5.x,无已知 CVE |
|
|
| pinia | 状态 | 当前 2.x,无已知 CVE |
|
|
| vue-router | 路由 | 当前 4.x,无已知 CVE |
|
|
| element-plus | UI | 当前 2.x,无已知 CVE |
|
|
| vant | H5 UI | 当前 4.x,无已知 CVE |
|
|
| axios | HTTP | 🟢 1.16+/1.17+ |
|
|
| tailwindcss | CSS | 当前 3.x,无已知 CVE |
|
|
|
|
### 2.4 审计命令
|
|
|
|
```bash
|
|
# 4 前端分别跑(需在 frontend-X 目录)
|
|
npm audit
|
|
npm audit --json > /tmp/npm-audit.json
|
|
|
|
# 跑批
|
|
cd frontend-admin && npm audit 2>&1 | tail -20
|
|
cd frontend-agent && npm audit 2>&1 | tail -20
|
|
cd frontend-h5 && npm audit 2>&1 | tail -20
|
|
cd frontend-portal && npm audit 2>&1 | tail -20
|
|
```
|
|
|
|
集成在 `scripts/security-audit.sh`(#42,已完成)。
|
|
|
|
---
|
|
|
|
## 📌 3. Lockfile 治理
|
|
|
|
### 3.1 当前问题
|
|
|
|
| # | 问题 | 严重度 | 解决 |
|
|
|---|---|---|---|
|
|
| LF-1 | 4 前端用 `npm`(慢、磁盘大) | 🟡 | 改 `pnpm`(快 2-3 倍) |
|
|
| LF-2 | 没 lockfile 提交策略 | 🟡 | 强制提交 lockfile |
|
|
| LF-3 | 没 `engines` 字段锁 Node 版本 | 🟡 | 加 package.json `engines.node` |
|
|
| LF-4 | Python 没 `requirements.lock` | 🟠 | 用 `pip-tools` 生成 |
|
|
|
|
### 3.2 建议方案
|
|
|
|
#### Node 端
|
|
|
|
**`package.json` 统一加**:
|
|
```json
|
|
{
|
|
"engines": {
|
|
"node": ">=20.0.0 <21.0.0",
|
|
"pnpm": ">=9.0.0"
|
|
},
|
|
"packageManager": "pnpm@9.15.0"
|
|
}
|
|
```
|
|
|
|
**`.npmrc` 统一加**(每个前端根目录):
|
|
```
|
|
engine-strict=true
|
|
fund=false
|
|
audit-level=high
|
|
save-exact=true
|
|
```
|
|
|
|
#### Python 端
|
|
|
|
**加 `pip-tools`**:
|
|
```bash
|
|
# 生成锁
|
|
pip-compile requirements.in -o requirements.txt
|
|
|
|
# 同步环境
|
|
pip-sync requirements.txt
|
|
```
|
|
|
|
**`requirements.in`**(新增):
|
|
```
|
|
fastapi
|
|
uvicorn[standard]
|
|
python-multipart>=0.0.12
|
|
sqlalchemy
|
|
psycopg2-binary
|
|
asyncpg
|
|
alembic
|
|
redis>=5.0.7
|
|
pydantic>=2.7.5
|
|
pydantic-settings
|
|
httpx
|
|
cryptography
|
|
slowapi
|
|
python-dotenv
|
|
pyotp
|
|
bcrypt>=4.1.0
|
|
qrcode[pil]
|
|
pillow
|
|
```
|
|
|
|
---
|
|
|
|
## 📌 4. Renovate / Dependabot 配置
|
|
|
|
### 4.1 建议:启用 Gitea 内置依赖更新
|
|
|
|
**`.gitea/dependabot.yml`**(待启用):
|
|
```yaml
|
|
version: 2
|
|
updates:
|
|
# Python 后端
|
|
- package-ecosystem: "pip"
|
|
directory: "/backend"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "python"
|
|
|
|
# 4 前端
|
|
- package-ecosystem: "npm"
|
|
directory: "/frontend-admin"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "dependencies"
|
|
- "frontend"
|
|
# ... agent, h5, portal 同
|
|
|
|
# Docker 基础镜像
|
|
- package-ecosystem: "docker"
|
|
directory: "/backend"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "dependencies"
|
|
- "docker"
|
|
```
|
|
|
|
### 4.2 短期手动
|
|
|
|
- 每周一次(周一)跑 `npm audit` + `pip-audit`
|
|
- 高危 / 严重 24 小时内修
|
|
- 中危 1 周内修
|
|
- 低危季度评估
|
|
|
|
---
|
|
|
|
## 📌 5. 已知漏洞速查
|
|
|
|
### 5.1 关键修复清单
|
|
|
|
| # | 漏洞 | 包 | 修复版本 | 当前 | 状态 |
|
|
|---|---|---|---|---|---|
|
|
| 1 | CVE-2024-24762 | python-multipart | 0.0.12 | 0.0.9 | ❌ 必修 |
|
|
| 2 | CVE-2024-21503 | python-multipart | 0.0.12 | 0.0.9 | ❌ 必修 |
|
|
| 3 | ReDoS in FastAPI | fastapi | 0.111.1 | 0.111.0 | ⚠️ 建议修 |
|
|
| 4 | Pydantic 边界 | pydantic | 2.7.5 | 2.7.4 | ⚠️ 建议修 |
|
|
|
|
### 5.2 待持续监控
|
|
|
|
- **CVE-2024-26130**: cryptography 42.0.0-42.0.4(我们 42.0.8 ✅)
|
|
- **CVE-2024-0727**: cryptography 42.0.0-42.0.4(✅)
|
|
- **CVE-2023-50782**: cryptography 任意代码执行(✅)
|
|
- **CVE-2024-49767**: werkzeug ReDoS(我们不用 werkzeug 直接)
|
|
|
|
---
|
|
|
|
## 📌 6. 实施路径
|
|
|
|
### 6.1 立即(本次跑批)
|
|
|
|
- [x] 审计报告写完(本文件)
|
|
- [ ] 升级 `python-multipart==0.0.12` + `fastapi==0.111.1` + `pydantic==2.7.5`
|
|
- [ ] 跑 `pip-audit` 验证
|
|
|
|
### 6.2 下周
|
|
|
|
- [ ] 加 `.gitea/dependabot.yml`(先试 Gitea 内置)
|
|
- [ ] 4 前端加 `engines` 字段
|
|
- [ ] 评估 `pnpm` 迁移(快 + 省)
|
|
|
|
### 6.3 季度
|
|
|
|
- [ ] 引入 `pip-tools` 锁 Python 依赖
|
|
- [ ] 评估 `passlib` → `pwdlib` 迁移
|
|
- [ ] 季度漏洞扫描 + 报告归档
|
|
|
|
---
|
|
|
|
## 📌 7. 关联文档
|
|
|
|
- [[安全审计脚本]] - 5 工具集成跑批
|
|
- [[风险跟踪表]] M-11(凭据)/ D-3(DB 密码)
|
|
- [[Dockerfile优化与镜像审计]] - 基础镜像版本锁
|
|
|
|
---
|
|
|
|
*本审计是 2026-06-15 Claude 满载跑批产出,待评审*
|