From a5aae5db9a4fbe8000f07ff200bbab42bcd3da82 Mon Sep 17 00:00:00 2001 From: shaw Date: Sat, 25 Jul 2026 11:45:42 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E5=8D=87=20postcss=20?= =?UTF-8?q?=E5=88=B0=20>=3D8.5.18=20=E4=BF=AE=E5=A4=8D=20frontend-security?= =?UTF-8?q?=20=E7=BA=A2=E7=81=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 新披露两条 high 级公告命中锁文件里的 postcss@8.5.6，frontend-security 的 audit exception 检查失败： - GHSA-6g55-p6wh-862q（2026-07-23 披露，修复版 8.5.12） CSS 注释中攻击者可控的 sourceMappingURL 导致任意文件读取与信息泄露 - GHSA-r28c-9q8g-f849（2026-07-24 披露，修复版 8.5.18） Previous Source Map 自动加载存在路径穿越，导致任意 .map 文件泄露 postcss 不只是 devDependency —— 它经 vue → @vue/compiler-sfc 进入生产依赖树， 因此 `pnpm audit --prod` 会命中。用 pnpm.overrides 而非只升直接依赖，可保证 所有引入路径的实例都被抬到修复版（沿用本仓 form-data@<4.0.6 的既有写法）。 锁文件用 pnpm 10 重新解析以匹配现有锁文件的生成工具，避免 pnpm 9 误删 11 处 libc: [glibc|musl] 平台门控字段；lockfileVersion 保持 9.0。 实际解析到 postcss 8.5.23，nanoid 3.3.11→3.3.16 是 postcss 自身依赖的 补丁级跟随，diff 无其他无关变动。 验证：复现 CI 失败步骤（pnpm audit --prod --audit-level=high + tools/check_pnpm_audit_exceptions.py）已通过；CI 所用 pnpm 9 的 --frozen-lockfile 接受该锁文件；vue-tsc --noEmit、pnpm build、vitest 均通过。 --- frontend/package.json | 3 +- frontend/pnpm-lock.yaml | 65 +++++++++++++++++++++-------------------- 2 files changed, 35 insertions(+), 33 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index b3c3450a3..1d4aaf3ae 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -62,7 +62,8 @@ "pnpm": { "overrides": { "js-cookie": "3.0.7", - "form-data@<4.0.6": ">=4.0.6" + "form-data@<4.0.6": ">=4.0.6", + "postcss@<8.5.18": ">=8.5.18" } } } diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml index 4bc3d2fee..afd53708f 100644 --- a/frontend/pnpm-lock.yaml +++ b/frontend/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: js-cookie: 3.0.7 form-data@<4.0.6: '>=4.0.6' + postcss@<8.5.18: '>=8.5.18' importers: @@ -105,7 +106,7 @@ importers: version: 2.4.6 autoprefixer: specifier: ^10.4.16 - version: 10.4.23(postcss@8.5.6) + version: 10.4.23(postcss@8.5.23) eslint: specifier: ^8.57.0 version: 8.57.1 @@ -116,8 +117,8 @@ importers: specifier: ^24.1.3 version: 24.1.3 postcss: - specifier: ^8.4.32 - version: 8.5.6 + specifier: '>=8.5.18' + version: 8.5.23 tailwindcss: specifier: ^3.4.0 version: 3.4.19 @@ -1876,7 +1877,7 @@ packages: engines: {node: ^10 || ^12 || >=14} hasBin: true peerDependencies: - postcss: ^8.1.0 + postcss: '>=8.5.18' axios@1.18.1: resolution: {integrity: sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==} @@ -3321,8 +3322,8 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.11: - resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -3511,20 +3512,20 @@ packages: resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==} engines: {node: '>=14.0.0'} peerDependencies: - postcss: ^8.0.0 + postcss: '>=8.5.18' postcss-js@4.1.0: resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==} engines: {node: ^12 || ^14 || >= 16} peerDependencies: - postcss: ^8.4.21 + postcss: '>=8.5.18' postcss-load-config@6.0.1: resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==} engines: {node: '>= 18'} peerDependencies: jiti: '>=1.21.0' - postcss: '>=8.0.9' + postcss: '>=8.5.18' tsx: ^4.8.1 yaml: ^2.4.2 peerDependenciesMeta: @@ -3541,7 +3542,7 @@ packages: resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==} engines: {node: '>=12.0'} peerDependencies: - postcss: ^8.2.14 + postcss: '>=8.5.18' postcss-selector-parser@6.1.2: resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==} @@ -3550,8 +3551,8 @@ packages: postcss-value-parser@4.2.0: resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==} - postcss@8.5.6: - resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==} + postcss@8.5.23: + resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -6284,7 +6285,7 @@ snapshots: '@vue/shared': 3.5.26 estree-walker: 2.0.2 magic-string: 0.30.21 - postcss: 8.5.6 + postcss: 8.5.23 source-map-js: 1.2.1 '@vue/compiler-ssr@3.5.26': @@ -6515,13 +6516,13 @@ snapshots: attr-accept@2.2.5: {} - autoprefixer@10.4.23(postcss@8.5.6): + autoprefixer@10.4.23(postcss@8.5.23): dependencies: browserslist: 4.28.1 caniuse-lite: 1.0.30001761 fraction.js: 5.3.4 picocolors: 1.1.1 - postcss: 8.5.6 + postcss: 8.5.23 postcss-value-parser: 4.2.0 axios@1.18.1: @@ -8442,7 +8443,7 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.11: {} + nanoid@3.3.16: {} natural-compare@1.4.0: {} @@ -8607,28 +8608,28 @@ snapshots: dependencies: '@babel/runtime': 7.28.4 - postcss-import@15.1.0(postcss@8.5.6): + postcss-import@15.1.0(postcss@8.5.23): dependencies: - postcss: 8.5.6 + postcss: 8.5.23 postcss-value-parser: 4.2.0 read-cache: 1.0.0 resolve: 1.22.11 - postcss-js@4.1.0(postcss@8.5.6): + postcss-js@4.1.0(postcss@8.5.23): dependencies: camelcase-css: 2.0.1 - postcss: 8.5.6 + postcss: 8.5.23 - postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.6): + postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.23): dependencies: lilconfig: 3.1.3 optionalDependencies: jiti: 1.21.7 - postcss: 8.5.6 + postcss: 8.5.23 - postcss-nested@6.2.0(postcss@8.5.6): + postcss-nested@6.2.0(postcss@8.5.23): dependencies: - postcss: 8.5.6 + postcss: 8.5.23 postcss-selector-parser: 6.1.2 postcss-selector-parser@6.1.2: @@ -8638,9 +8639,9 @@ snapshots: postcss-value-parser@4.2.0: {} - postcss@8.5.6: + postcss@8.5.23: dependencies: - nanoid: 3.3.11 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -9253,11 +9254,11 @@ snapshots: normalize-path: 3.0.0 object-hash: 3.0.0 picocolors: 1.1.1 - postcss: 8.5.6 - postcss-import: 15.1.0(postcss@8.5.6) - postcss-js: 4.1.0(postcss@8.5.6) - postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.6) - postcss-nested: 6.2.0(postcss@8.5.6) + postcss: 8.5.23 + postcss-import: 15.1.0(postcss@8.5.23) + postcss-js: 4.1.0(postcss@8.5.23) + postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.23) + postcss-nested: 6.2.0(postcss@8.5.23) postcss-selector-parser: 6.1.2 resolve: 1.22.11 sucrase: 3.35.1 @@ -9489,7 +9490,7 @@ snapshots: vite@5.4.21(@types/node@20.19.27): dependencies: esbuild: 0.21.5 - postcss: 8.5.6 + postcss: 8.5.23 rollup: 4.54.0 optionalDependencies: '@types/node': 20.19.27