kevin
c9f858b626
- #9 CDN 本地化：marked/DOMPurify/highlight.js/cropperjs/easymde 入 static/vendor（go:embed），Tailwind 改静态构建（scripts/build_tailwind.sh），CSP 收紧为 default-src 'self' - #10 登录限速：IP+用户名维度 5 次失败锁 15 分钟，内存实现有界（handlers/login_ratelimit.go） - #25 计时侧信道：用户不存在时执行 dummy bcrypt 抹平时间差（随 #10 实施） - #11 配置文件权限 0640 - #12 首启随机一次性密码（弃用 admin/admin） - #13 unix socket 660 + 代理用户加组提示 - #22 storage_dir 路径穿越校验（单安全路径段） - #23 密码最小长度统一（改密/建号/重置），#24 邮箱格式统一校验 - 新增 13 个单元测试；go test ./... 含 -race 全绿
30 lines
1.2 KiB
Bash
Executable File
30 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build Tailwind CSS from the HTML templates into static/css/app.css.
|
|
#
|
|
# The production build does NOT use cdn.tailwindcss.com (the dev runtime):
|
|
# it is a JS script executed in the browser, which browsers cannot pin with
|
|
# SRI and which would keep a third-party origin in our CSP
|
|
# (SECURITY_TODO #9). This script produces a static stylesheet instead.
|
|
#
|
|
# Running it requires Node >= 18 with npx available. The generated
|
|
# static/css/app.css MUST be committed so deployments need no toolchain
|
|
# (static assets are go:embed'd into the binary).
|
|
#
|
|
# Usage: ./scripts/build_tailwind.sh [version]
|
|
set -euo pipefail
|
|
|
|
VERSION="${1:-3.4.17}"
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ROOT="$(dirname "${HERE}")"
|
|
|
|
echo "==> Building Tailwind CSS ${VERSION} (offline static build)"
|
|
cd "${ROOT}"
|
|
# Content sources: templates for static markup, Go sources for class strings
|
|
# assembled in handlers (e.g. status/role badges), plus the embedding main.
|
|
npx --yes "tailwindcss@${VERSION}" \
|
|
-i ./static/css/input.css \
|
|
-o ./static/css/app.css \
|
|
--content "./templates/**/*.html" "./handlers/**/*.go" "./middleware/**/*.go" "./main.go"
|
|
echo "==> Done: static/css/app.css"
|
|
echo " (commit this file; it is embedded into the binary via go:embed)"
|