fix: 全仓库深度安全审查与优化修复（30 文件，Critical/High/Medium 级缺陷） - #16

Merged

ClassTechStar merged 35 commits into

Project-MethodBox:mainfrom

ClassTechStar:fix/comprehensive-bugfix-and-optimization

Aug 9, 2026

Commits on Aug 9, 2026

fix(docker): non-root user and healthcheck for AuthService
ClassTechStar
committed
21da535
fix(docker): non-root user and healthcheck for FileService
ClassTechStar
committed
f7687ae
fix(docker): non-root user for OCRService
ClassTechStar
committed
0319a35
fix(docker): non-root user and healthcheck for PracticeService
ClassTechStar
committed
924ab42
fix(frontend): prevent interval leakage in poll utility
ClassTechStar
committed
462dfcc
fix(frontend): add localStorage overflow fallback in workflow
ClassTechStar
committed
f43a3f0
fix(frontend): fix polling cleanup in KnowledgePointsPage
ClassTechStar
committed
cd64b47
fix(gateway): align @types/express, add engines field
ClassTechStar
committed
89aafa7
fix(gateway): handle empty env vars, fix envInt parsing, add trustProxy
ClassTechStar
committed
723af61
fix(gateway): use || for host fallback, graceful shutdown, error handling
ClassTechStar
committed
1d23c50
fix(gateway): delegate to Express default handler when headers sent
ClassTechStar
committed
6ca6935
fix(gateway): strip trailing slash, fix timer cleanup in health probe
ClassTechStar
committed
29e8f2e
fix(galgame): sanitize exception details in CreditBillingClient
ClassTechStar
committed
3be5947
fix(galgame): add OOM protection in MongoGameStore
ClassTechStar
committed
89a2d17
fix(galgame): harden GalGameService Program.cs
ClassTechStar
committed
f5e3429
fix(ci): add NuGet cache and missing service tests
ClassTechStar
committed
724d211
fix(infra): default CHANGE_ME passwords, log rotation, 127.0.0.1 bind
ClassTechStar
committed
6e5e296
fix(deploy): replace root credentials, require SSL, disable AI by default
ClassTechStar
committed
9b0285a
fix(nginx): add security HTTP headers and gzip compression
ClassTechStar
committed
964368f
fix(frontend): SPA 404 routing, security headers, drain on early reject
ClassTechStar
committed
4dafaee
fix(config): disable AI features by default
ClassTechStar
committed
292fc0d
fix(security): replace hardcoded credentials with CHANGE_ME
ClassTechStar
committed
6a2d64b
fix(config): replace weak gateway key, add missing readiness services
ClassTechStar
committed
b0a1178
fix(docker): add ASPNETCORE_URLS to KnowledgeService Dockerfile
ClassTechStar
committed
a50b0d3
fix(docker): add HEALTHCHECK and non-root user to CreditService
ClassTechStar
committed
1a8dab1
fix(credit): harden CreditService Program.cs
ClassTechStar
committed
592427b
fix(fileservice): harden FileService Program.cs
ClassTechStar
committed
581626a
fix(ocr): sanitize error responses, add request size limit
ClassTechStar
committed
2e1c9f8
fix(practice): fix timing attack in ModelScoring
ClassTechStar
committed
c4e56c9
fix(practice): fix race condition in SharedPracticePackageStore
ClassTechStar
committed
fedda14
fix(render): harden RenderService adapter
ClassTechStar
committed
5267011
fix(render): fix session cleanup in RenderService
ClassTechStar
committed
6187cc1
fix(practice): add null-check in NormalizeOptionId to prevent IndexOutOfRange on empty option IDs
ClassTechStar
committed
05e51b3
fix(ci): resolve CI failures in Gateway and .NET services
ClassTechStar
committed
fd87c6f
fix(gateway): handle empty CORS_ORIGINS correctly — return actual value even when empty string
ClassTechStar
committed
271ab3e

Navigation Menu

Uh oh!

fix: 全仓库深度安全审查与优化修复（30 文件，Critical/High/Medium 级缺陷） - #16

fix: 全仓库深度安全审查与优化修复（30 文件，Critical/High/Medium 级缺陷）#16
ClassTechStar merged 35 commits into
Project-MethodBox:mainfrom
ClassTechStar:fix/comprehensive-bugfix-and-optimization

Commits on Aug 9, 2026

fix(docker): non-root user and healthcheck for AuthService

fix(docker): non-root user and healthcheck for FileService

fix(docker): non-root user for OCRService

fix(docker): non-root user and healthcheck for PracticeService

fix(frontend): prevent interval leakage in poll utility

fix(frontend): add localStorage overflow fallback in workflow

fix(frontend): fix polling cleanup in KnowledgePointsPage

fix(gateway): align @types/express, add engines field

fix(gateway): handle empty env vars, fix envInt parsing, add trustProxy

fix(gateway): use || for host fallback, graceful shutdown, error handling

fix(gateway): delegate to Express default handler when headers sent

fix(gateway): strip trailing slash, fix timer cleanup in health probe

fix(galgame): sanitize exception details in CreditBillingClient

fix(galgame): add OOM protection in MongoGameStore

fix(galgame): harden GalGameService Program.cs

fix(ci): add NuGet cache and missing service tests

fix(infra): default CHANGE_ME passwords, log rotation, 127.0.0.1 bind

fix(deploy): replace root credentials, require SSL, disable AI by default

fix(nginx): add security HTTP headers and gzip compression

fix(frontend): SPA 404 routing, security headers, drain on early reject

fix(config): disable AI features by default

fix(security): replace hardcoded credentials with CHANGE_ME

fix(config): replace weak gateway key, add missing readiness services

fix(docker): add ASPNETCORE_URLS to KnowledgeService Dockerfile

fix(docker): add HEALTHCHECK and non-root user to CreditService

fix(credit): harden CreditService Program.cs

fix(fileservice): harden FileService Program.cs

fix(ocr): sanitize error responses, add request size limit

fix(practice): fix timing attack in ModelScoring

fix(practice): fix race condition in SharedPracticePackageStore

fix(render): harden RenderService adapter

fix(render): fix session cleanup in RenderService

fix(practice): add null-check in NormalizeOptionId to prevent IndexOutOfRange on empty option IDs

fix(ci): resolve CI failures in Gateway and .NET services

fix(gateway): handle empty CORS_ORIGINS correctly — return actual value even when empty string