weichen
d4988d04e8
Add P0 negative tests, prod bundle forbidden-string scan, and the Phase 0 security止血 acceptance report with PASS results.
33 lines
722 B
Bash
Executable File
33 lines
722 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Phase 0: scan production web bundle for forbidden identity-switch / seed strings.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
DIST="${1:-$ROOT/web/dist}"
|
|
|
|
echo "Building fresh web dist..."
|
|
(cd "$ROOT/web" && npm run build)
|
|
|
|
FORBIDDEN=(
|
|
'DevRoleSwitcher'
|
|
'DEV 调试切人'
|
|
'切换为此人登录'
|
|
'admin-secret-password-123'
|
|
'allowDevSwitch'
|
|
'dev-token-'
|
|
)
|
|
|
|
failed=0
|
|
for needle in "${FORBIDDEN[@]}"; do
|
|
if grep -rq --include='*.js' --include='*.css' --include='*.html' "$needle" "$DIST" 2>/dev/null; then
|
|
echo "FAIL: forbidden string in bundle: $needle"
|
|
failed=1
|
|
fi
|
|
done
|
|
|
|
if [[ $failed -eq 0 ]]; then
|
|
echo "PASS: prod bundle scan ($DIST)"
|
|
exit 0
|
|
fi
|
|
exit 1
|