Skip to content

fix: 替换配置文件中的硬编码凭据为占位符 #438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saaa99999999 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: 替换配置文件中的硬编码凭据为占位符 #438

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ mysql:
# 用户名
username: root
# 密码
password: 123456
password: your-password
# 数据库名
database: go_ldap_admin
# 主机地址
Expand All @@ -56,7 +56,7 @@ jwt:
# jwt标识
realm: test jwt
# 服务端密钥
key: secret key
key: your-jwt-key
# token过期时间, 小时
timeout: 12000
# 刷新token最大过期时间, 小时
Expand Down Expand Up @@ -100,11 +100,11 @@ ldap:
# ldap管理员DN
admin-dn: "cn=admin,dc=eryajf,dc=net"
# ldap管理员密码
admin-pass: "123456"
admin-pass: "your-ldap-password"
# ldap用户OU
user-dn: "ou=people,dc=eryajf,dc=net"
# ldap用户初始默认密码
user-init-password: "123456"
user-init-password: "your-password"
# 是否允许更改分组DN
group-name-modify: false
# 是否允许更改用户DN
Expand Down
4 changes: 4 additions & 0 deletions config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,10 @@ func InitConfig() {
if mysqlUsername != "" {
Conf.Mysql.Username = mysqlUsername
}
jwtKey := os.Getenv("JWT_KEY")
if jwtKey != "" {
Conf.Jwt.Key = jwtKey
}
Comment on lines +92 to +95

@coderabbitai coderabbitai Bot May 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

热更新路径会丢失 JWT_KEY 覆盖值

当前 JWT_KEY 只在初始化阶段应用一次；viper.OnConfigChange 触发后会重新 Unmarshal 配置并覆盖 Conf.Jwt.Key，导致环境变量覆盖失效。建议把“环境变量覆盖”提取为统一函数，并在初始化与热更新回调中都调用一次。

建议修复（示例） 
 func InitConfig() {
@@
 	viper.OnConfigChange(func(e fsnotify.Event) {
 		if err := viper.Unmarshal(Conf); err != nil {
 			panic(fmt.Errorf("初始化配置文件失败:%s", err))
 		}
 		normalizeConfig()
+		applyEnvOverrides()
 		Conf.System.RSAPublicBytes = pub
 		Conf.System.RSAPrivateBytes = priv
 	})
@@
 	if err := viper.Unmarshal(Conf); err != nil {
 		panic(fmt.Errorf("初始化配置文件失败:%s", err))
 	}
 	normalizeConfig()
+	applyEnvOverrides()
@@
-	// 部分配合通过环境变量加载
-	dbDriver := os.Getenv("DB_DRIVER")
-	...
+}
+
+func applyEnvOverrides() {
+	// 将 InitConfig 里现有的 DB/MYSQL/JWT/LDAP 环境变量覆盖逻辑整体迁移到这里复用
 }
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/config.go` around lines 92 - 95, The JWT_KEY environment override is
only applied once during init and gets lost after viper.OnConfigChange
re-unmarshals Conf; create a small helper (e.g., applyEnvOverrides or
applyEnvOverridesToConf) that reads JWT_KEY and sets Conf.Jwt.Key (and any other
env overrides) and call that helper both where jwtKey is currently read and
inside the viper.OnConfigChange callback so environment overrides persist across
hot reloads.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

缺少对占位符/空 JWT 密钥的启动校验

即使新增了 JWT_KEY 覆盖，未设置环境变量时仍会接受 config.yml 中的占位符密钥（your-jwt-key）。这会让服务在可预测密钥下签发/校验 token，存在认证绕过风险。建议在配置加载完成后做强校验并失败启动。

建议修复（示例） 
 import (
 	_ "embed"
 	"fmt"
 	"os"
 	"strconv"
+	"strings"
@@
 	jwtKey := os.Getenv("JWT_KEY")
 	if jwtKey != "" {
 		Conf.Jwt.Key = jwtKey
 	}
+	if key := strings.TrimSpace(Conf.Jwt.Key); key == "" || key == "your-jwt-key" {
+		panic("jwt.key 未正确配置，请通过 config.yml 或 JWT_KEY 设置强随机密钥")
+	}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/config.go` around lines 92 - 95, 在配置加载并可能用环境变量覆盖后，增加对 Conf.Jwt.Key
的严格校验：如果最终值为空或等于占位符（例如 "your-jwt-key" 或其他默认占位符），应记录明确错误并让进程以失败状态退出（例如使用
processLogger/error + os.Exit(1) 或 log.Fatalf），以避免使用可预测的 JWT
密钥；检查点放在完成环境变量覆盖后（即在当前 jwtKey 覆盖逻辑之后），明确引用 Conf.Jwt.Key 和 环境变量名 JWT_KEY
以便定位修改位置。

mysqlPassword := os.Getenv("MYSQL_PASSWORD")
if mysqlPassword != "" {
Conf.Mysql.Password = mysqlPassword
Expand Down