fix(industry): 审计修复 — 4 CRITICAL + 5 HIGH 全部解决
Some checks failed
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled

C1: SaaS industry/service.rs SQL 注入风险 → 参数化查询 ($N 绑定)
C2: INDUSTRY_CONFIGS 死链 → Kernel 共享 Arc 接通 ButlerRouter
C3: IndustryListItem 缺 keywords_count → SQL 查询 + 类型补全
C4: set_account_industries 非事务性 → batch 验证 + 事务 DELETE+INSERT
H8: Accounts.tsx mutate 竞态 → mutateAsync 顺序等待
H9: XML 注入未转义 → xml_escape() 辅助函数
H10: update_industry 覆盖 source → 保留原始值
H11: 面包屑缺少 /industries → 添加行业配置映射
This commit is contained in:
iven
2026-04-12 19:06:19 +08:00
parent c3593d3438
commit fbc8c9fdde
7 changed files with 119 additions and 73 deletions

View File

@@ -221,6 +221,7 @@ const breadcrumbMap: Record<string, string> = {
'/knowledge': '知识库',
'/billing': '计费管理',
'/config': '系统配置',
'/industries': '行业配置',
'/prompts': '提示词管理',
'/logs': '操作日志',
'/config-sync': '同步日志',