Your Name
aa65f10c52
Audit docs:
- docs/reports/audit-phase-2{a-j}-line-walk.md: per-file line walk findings
- docs/reports/audit-phase-2-findings-matrix.md: 63 findings (52 fixed, 3 partial, 7 accepted)
- docs/reports/2026-05-23-full-audit-report.md: full audit consolidation
- docs/reports/audit-full-vs-phase2-reconciliation.md: cross-reference
- docs/reports/audit-phase-2-walk-closure.md: closure sign-off
Project docs:
- docs/project/phase-2-audit-remediation.md: SSOT for all fixes
- docs/project/alert-push-policy.md: dashboard alert design decisions
- docs/project/production-verification-checklist.md: first-deploy checklist
- docs/project/script-execution.md: script platform design
- docs/project/wsl-integration-test.md: WSL code-only verification guide
- docs/project/line-walk-audit-standard.md: audit methodology
- docs/project/mysql-mcp-setup.md: MCP config guide
Changelogs: 18 entries (2026-05-22 to 2026-05-23)
Project memory: CLAUDE.md, AGENTS.md updated to reflect current state
Deploy: nginx_https.conf template updated
Co-authored-by: Cursor <cursoragent@cursor.com>
924 B
924 B
Changelog — P0 安全修复（审计先行修复）
日期: 2026-05-22
修复项
| ID | 问题 | 修复 |
|---|---|---|
| F2a-01 | WebSSH IDOR：普通 JWT 可连任意 server_id | POST /api/auth/webssh-token 签发 purpose=webssh + server_id；webssh.py 强制匹配 |
| F2a-02 | 中心机 /api/agent/exec 本机 RCE |
删除该路由；远程执行仅 web/agent/agent.py /exec |
| F2c-01 | 解密失败返回密文当密码 | decrypt_value 失败抛 ValueError |
| F2b-06 | batch_push 缺 nonlocal |
sync_service.py 添加 nonlocal completed |
| — | Agent 调用 URL 错误 | script_service 改为 http://host:port/exec |
涉及文件
server/api/webssh.py,server/api/auth.py,server/api/agent.pyserver/application/services/auth_service.py,sync_service.py,script_service.pyserver/infrastructure/database/crypto.pyweb/app/terminal.html