Página inicial Explorar Ajuda
Registrar Entrar
wuzilong
/
zkxw
1
0
Fork 0
Arquivos Issues 0 Pull Requests 0 Wiki
Tree: 6a9a8bddd6
Branches Tags
zkxw
/
docs
/
superpowers
/
plans
/
2026-10-16-security-scan-and-weak-password.md

2026-10-16-security-scan-and-weak-password.md 4.5 KB
Histórico Raw

Security Scan and Weak Password Reset Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Deliver a static security scan report (SQLi/XSS etc., no business code fixes) and a script to reset sys_user passwords that verify as 111111 to Zkxw@123.

Architecture: Static grep/read audit of backend/app and frontend src trees; findings written to Markdown. Weak-password reset uses bcrypt verify in a one-off Python script; SQL file documents why pure SQL cannot match hashes and points to the script.

Tech Stack: Python 3.9, bcrypt, SQLAlchemy/pymysql via existing backend settings; Markdown reports under docs/.

Spec: docs/superpowers/specs/2026-10-16-security-scan-and-weak-password-design.md

Task 1: Static security audit and report

Files:

  • Create: docs/testing/2026-10-16-security-scan-report.md

  • [x] Step 1: Search backend for SQL injection patterns

Run from repo root:

rg -n "text\(|execute\(|f[\"'].*(SELECT|INSERT|UPDATE|DELETE)|%\s*\(.*SELECT|\.format\(" backend/app --glob '*.py'
rg -n "sql_template|strategy.*sql|_FORBIDDEN_SQL" backend/app --glob '*.py'

Read each hit that builds or runs SQL with possible user/config input (especially workflow_engine.py SQL approver strategy). Note file:line, risk, suggestion.

  • Step 2: Search frontends for XSS patterns
rg -n "v-html|innerHTML|document\.write|eval\(|new Function" web-admin/src mobile-oa-h5/src mobile-h5 miniprogram --glob '*.{vue,js,ts}'

For each v-html, check whether content passes sanitizeHtml / DOMPurify. Exclude vendor noise.

  • Step 3: Spot-check auth / weak-password related info items

Confirm password hashing (backend/app/core/security.py), default admin/111111 docs (AGENTS.md, backend/README.md). Record as 信息 if relevant.

  • Step 4: Write the report

Create docs/testing/2026-10-16-security-scan-report.md with:

  • Summary (counts by severity)
  • Findings table/sections: 标题、风险、位置、简述、建议
  • Method, scope, limitations
  • Explicit “未发现” for categories with clean results after search

Do not modify business application code.

Task 2: Weak-password reset script

Files:

  • Create: backend/scripts/reset_weak_password_111111.py

  • Create: docs/sql/2026-10-16-reset-weak-password-111111.sql

  • [x] Step 1: Implement Python script

Create backend/scripts/reset_weak_password_111111.py that:

  1. Adds repo backend to sys.path and loads settings like other scripts (reuse app.core.database / app.core.config / app.core.security).
  2. Queries SysUser where del_flag == 0.
  3. For each row, verify_password("111111", password); if true and not --dry-run, set password via get_password_hash("Zkxw@123") and update update_time if present.
  4. Supports --dry-run (list only) and optional --commit or default commit with clear print of counts.
  5. Prints user_no, id, status for each hit.

Follow patterns in existing backend/scripts/*.py for DB session bootstrap.

  • Step 2: Write SQL companion doc

Create docs/sql/2026-10-16-reset-weak-password-111111.sql explaining bcrypt limitation; include example:

-- 说明：无法用 WHERE password='111111' 命中弱密码。
-- 请使用: python backend/scripts/reset_weak_password_111111.py [--dry-run]
-- 以下仅为「已知单用户」手工更新模板（哈希需现场生成）:
-- UPDATE sys_user SET password = '<bcrypt of Zkxw@123>', update_time = NOW()
-- WHERE id = '<user_id>' AND del_flag = 0;

Generate one real bcrypt hash of Zkxw@123 in comments for operators who must UPDATE a known id manually.

  • Step 3: Dry-run verification
cd backend && source venv/bin/activate && python scripts/reset_weak_password_111111.py --dry-run

Expected: script starts, lists matching users or “0 matches”, does not write. If DB unavailable, document in report/script README comment how to run when DB is up; do not invent failures as bugs.

Task 3: Spec checklist

  • [x] Step 1: Confirm deliverables exist

  • [x] docs/testing/2026-10-16-security-scan-report.md

  • [x] backend/scripts/reset_weak_password_111111.py

  • [x] docs/sql/2026-10-16-reset-weak-password-111111.sql

  • [x] No unrelated business code changes

  • [x] Step 2: Stop for human review (no auto-commit unless user asks)