chore: import verified syly2 maintenance baseline without embedded credentials

2026-10-29 22:22:49 +08:00
commit da8224efd8
5265 changed files with 1199963 additions and 0 deletions
@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""Inspect the built WAR without launching the application or reading business data."""
+from pathlib import Path
+import collections
+import hashlib
+import json
+import struct
+import zipfile
+
+root = Path(__file__).resolve().parents[1]
+war = root / 'target/syly.war'
+required = [
+    'WEB-INF/web.xml',
+    'WEB-INF/classes/com/zzc/web/system/controller/core/LoginController.class',
+    'WEB-INF/classes/com/zzc/core/interceptors/AuthInterceptor.class',
+    'WEB-INF/classes/com/zzc/web/htoal/controller/HotelMonthlyController.class',
+    'WEB-INF/classes/com/zzc/core/util/RuntimeSecrets.class',
+]
+with zipfile.ZipFile(war) as archive:
+    assert archive.testzip() is None, 'WAR CRC failure'
+    names = archive.namelist()
+    assert all(name in names for name in required), 'Missing application entry'
+    classes = [n for n in names if n.startswith('WEB-INF/classes/') and n.endswith('.class')]
+    versions = collections.Counter(struct.unpack('>H', archive.read(n)[6:8])[0] for n in classes)
+    assert set(versions) == {52}, versions
+    libs = [n for n in names if n.startswith('WEB-INF/lib/') and n.endswith('.jar')]
+    for name in ['dbconfig.properties', 'sysConfig.properties', 'zzc/zzc_database.properties']:
+        data = archive.read('WEB-INF/classes/' + name).decode('utf-8')
+        for line in data.splitlines():
+            if line.startswith(('jdbc.password=', 'mail.pwd=', 'password=')):
+                assert not line.split('=', 1)[1].strip(), 'Packaged credential in ' + name
+    assert 'druidStatView' not in archive.read('WEB-INF/web.xml').decode('utf-8')
+print(json.dumps({
+    'war_sha256': hashlib.sha256(war.read_bytes()).hexdigest(),
+    'war_bytes': war.stat().st_size,
+    'zip_crc_check': 'passed',
+    'compiled_class_files': len(classes),
+    'class_major_versions': dict(versions),
+    'bundled_jars': len(libs),
+    'required_entries_present': required,
+    'packaged_credential_checks': 'passed',
+}, indent=2))