fix(security): 优化 CsrfTokenInterceptor 校验逻辑 - #13
Open
a19920714liou wants to merge 1 commit into
Open
Conversation
a19920714liou
commented
Jun 11, 2026
a19920714liou
commented
Contributor
- 未登录用户（无 sessionId）直接放行，由 LoginInterceptor 处理
- 服务重启后旧 session（内存无 CSRF token）放行，避免误拦
- token 不匹配返回 401 替代 403，统一由前端 401 处理跳转登录页
- 未登录用户（无 sessionId）直接放行，由 LoginInterceptor 处理 - 服务重启后旧 session（内存无 CSRF token）放行，避免误拦 - token 不匹配返回 401 替代 403，统一由前端 401 处理跳转登录页 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
88fantasy
added a commit
that referenced
this pull request
Jun 13, 2026
- JschUtils.execForStr 轮询加 10 分钟超时上限,远端命令不结束时 不再永久阻塞调用线程(消除 H2 的放大器) - K8sServiceImpl 的 nexus-registry-secret 改为命名静态常量 - 暂缓项已在审计报告标注理由:return null 改 Optional 涉及公共 API 契约;Vos 改名 93 处含 bean 名字符串引用;#14 ProblemDetail 属 架构选择(报告自评优先级最低) - 勘误:decideEnableKerberos 仍被 8 个 strategy 引用,非死代码 验证:全量单测与前两批基线一致(仅既有端口互抢测试失败,单跑通过)
88fantasy
added a commit
that referenced
this pull request
Jun 13, 2026
7 个历史 Vos 命名的类改名(行为不变,仅 Java 内部标识符): - VosDdLServiceMeta → PhysicalDdlServiceMeta(并修正 DdL 大小写畸形) - VosProductService/Impl → PhysicalProductService/Impl - ExtRepoVosInstallController → ExtRepoPhysicalInstallController - VosProductDeployDAGBuildContext → ProductDeployDAGBuildContext - VosProductCmdSrvMappingContext → ProductCmdSrvMappingContext - bean 名 vosProductService → physicalProductService - bean 名 vosProductInstallService → physicalProductInstallService 外部契约保持不变:@RequestMapping path、SQL、meta、前端均未动。 编译 + 37 测试通过。
88fantasy
added a commit
that referenced
this pull request
Jun 13, 2026
方法名(Java 标识符,外部 path/契约不变): - getServiceVosDdl/updateServiceVosDdl → getServicePhysicalDdl/updateServicePhysicalDdl - validVosDdlDependency/parseVosDdlServiceMeta/addVosService → Physical 对应名 - getVosDdlServices(Lombok getter)→ getPhysicalDdlServices(字段 vosDdlServices → physicalDdlServices) - getVosServiceRoleRuntimeLog → getPhysicalServiceRoleRuntimeLog(@PostMapping path 保留) - MetaStorage.removeVosMeta → removePhysicalMeta(worker 零引用,已核查) 字段/局部变量: - vosProductActionService → physicalProductActionService(4 文件) - vosProductService/vosExtRepoInstallService → physical 对应名 - MetaUtils 局部变量 vosDdlDir → physicalDdlDir;同名 vosDdLServiceMeta 按分支拆为 physicalDdlServiceMetas / k8sDdlServiceMetas 白名单保留:${ROOT.VosManager.*} 占位符、x-vos-* 鉴权头、vos_ddl 目录、 NAMESPACE="vos"、Swagger @Tag/title、用户文案、URL path、VOS DDL javadoc 术语。 编译 + 37 测试通过。
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.