exflower-license-server 1.4.3 → 1.4.4

package/README.md

@@ -135,16 +135,20 @@ docker run -d -p 4001:4001 \
 ```bash
 cd license-server
 npm install
-npm start
+ADMIN_TOKEN=your-secure-token npm start
 ```
 
 ## 管理员 Token 管理
 
-### 默认 Token
+### Token 必须显式配置（S5，2026-09-23 安全加固）
 
-首次启动时，默认管理员 Token 为 **`exflower-admin-2026`**。
+**未设置 `ADMIN_TOKEN`（或使用默认值/占位符）时服务直接拒绝启动。**
 
-**⚠️ 生产环境必须修改默认 Token。**
+```bash
+[FATAL] 未设置有效的 ADMIN_TOKEN（默认值/占位符不允许启动）。
+```
+
+推荐用 `ADMIN_TOKEN_HASH`（sha256 hex）代替明文 `ADMIN_TOKEN`：`echo -n "你的token" | shasum -a 256`。
 
 ### 临时修改（当前会话）
 
@@ -218,7 +222,7 @@ sudo systemctl enable --now exflower-license-server
 | 变量 | 默认值 | 说明 |
 |------|--------|------|
 | `PORT` | `4001` | 服务端口 |
-| `ADMIN_TOKEN` | `exflower-admin-2026` | 管理后台鉴权 Token |
+| `ADMIN_TOKEN` | **必填** | 管理后台鉴权 Token（默认值/占位符拒绝启动） |
 | `ADMIN_TOKEN_HASH` | — | 管理 Token 的 sha256(hex)。设置后忽略 `ADMIN_TOKEN`，明文不落环境变量（`echo -n "你的token" \| shasum -a 256` 生成） |
 | `LICENSE_DATA_DIR` | 见下方 | 数据库持久化目录 |
 | `NODE_ENV` | `production` | 运行环境 |
@@ -285,7 +289,7 @@ sudo systemctl enable --now exflower-license-server
 - 登录时真实校验 Token，错误 Token 无法进入后台
 - 管理接口限速 60 次/分/IP，license 验证接口 120 次/分/IP（超限 429）
 - Token 比较使用 timing-safe 方式；支持 `ADMIN_TOKEN_HASH` 哈希配置（明文不落环境变量）
-- 使用默认 Token 启动时打印醒目警告；非 localhost 的 HTTP 访问显示明文传输警示 banner
+- 未设置有效 `ADMIN_TOKEN` 时拒绝启动（默认值/占位符一律视为未设置）；非 localhost 的 HTTP 访问显示明文传输警示 banner
 
 ## 白标品牌名
 

package/admin/index.html

@@ -475,6 +475,14 @@
   <script>
     let ADMIN_TOKEN = '';
 
+    // S1（2026-09-23 审查）：动态值进 innerHTML 前一律 esc；onclick 只传服务端生成的
+    // id、展示名从缓存查——JS 字符串上下文 esc 救不了（双引号断属性、单引号断串）
+    function esc(s) {
+      return String(s ?? '')
+        .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+    }
+
     // 登录真校验：token 必须能通过一次真实 admin 请求，否则拒绝进入
     async function ensureLogin() {
       while (true) {
@@ -622,16 +630,16 @@
       const fmt = fmtTime;
       const rows = [
         ['状态', `<span class="badge ${cls}">${label}</span>`],
-        ['客户', a.customer || '—'],
-        ['Key 前缀', a.key_prefix ? `<code>${a.key_prefix}</code>` : '—'],
-        ['服务器指纹', a.fingerprint ? `<code>${a.fingerprint.slice(0, 13)}…</code>` : '—'],
+        ['客户', esc(a.customer) || '—'],
+        ['Key 前缀', a.key_prefix ? `<code>${esc(a.key_prefix)}</code>` : '—'],
+        ['服务器指纹', a.fingerprint ? `<code>${esc(String(a.fingerprint).slice(0, 13))}…</code>` : '—'],
         ['合同到期', a.expires_at ? `${fmtDate(a.expires_at)}（剩 ${a.days_remaining} 天）` : '—'],
         ['凭证有效期至', fmt(a.token_expires_at)],
         ['实例配额（中央）', a.instance_quota ? `总额度 ${a.instance_quota.limit}，已分配 ${a.instance_quota.used}，剩余 ${a.instance_quota.remaining}` : ((a.limits && a.limits.max_instances) || '—')],
-        ['主端点', `<code>${a.endpoints ? a.endpoints.primary : ''}</code>`],
-        ['备端点', a.endpoints && a.endpoints.backup ? `<code>${a.endpoints.backup}</code>` : '—'],
+        ['主端点', `<code>${esc(a.endpoints ? a.endpoints.primary : '')}</code>`],
+        ['备端点', a.endpoints && a.endpoints.backup ? `<code>${esc(a.endpoints.backup)}</code>` : '—'],
         ['最近复核', fmt(a.last_revalidate)],
-        ['最近错误', a.last_error ? `<span style="color:#c62828">${a.last_error}</span>` : '—'],
+        ['最近错误', a.last_error ? `<span style="color:#c62828">${esc(a.last_error)}</span>` : '—'],
       ];
       document.getElementById('act-status').innerHTML =
         '<table><tbody>' + rows.map(r => `<tr><th style="width:140px;text-align:left">${r[0]}</th><td>${r[1]}</td></tr>`).join('') + '</tbody></table>';
@@ -668,9 +676,11 @@
     }
 
     async function loadStats() {
-      const res = await api('GET', '/health');
-      document.getElementById('stat-companies').textContent = res.total_companies || 0;
-      document.getElementById('stat-instances').textContent = res.active_instances || 0;
+      // S12（2026-09-23 审查）：/health 不再对外回运营计数，统计改走 admin 实例接口
+      const res = await api('GET', '/api/admin/instances');
+      const st = res.stats || {};
+      document.getElementById('stat-companies').textContent = st.total_companies ?? 0;
+      document.getElementById('stat-instances').textContent = st.active_instances ?? 0;
     }
 
     // ── License 管理 ──
@@ -701,7 +711,7 @@
 
         let expiresHtml = '永久';
         if (c.expires_at) {
-          const dateStr = String(c.expires_at).slice(0, 10); // 纯日期串（管理员录入），不做时区换算
+          const dateStr = esc(String(c.expires_at).slice(0, 10)); // 纯日期串（管理员录入），不做时区换算
           // 到期日按本地当日 23:59:59 算剩余天数，避免 UTC 午夜解析差一天
           const [ey, em, ed] = dateStr.split('-').map(Number);
           const daysLeft = Math.ceil((new Date(ey, em - 1, ed, 23, 59, 59) - Date.now()) / 86400000);
@@ -715,8 +725,8 @@
         }
 
         tr.innerHTML = `
-          <td><strong>${c.name}</strong></td>
-          <td><span class="license-key">${c.license_key}</span></td>
+          <td><strong>${esc(c.name)}</strong></td>
+          <td><span class="license-key">${esc(c.license_key)}</span></td>
           <td>${c.max_instances}实例 / ${c.max_agents}Agent / ${c.max_crews}项目组</td>
           <td><span class="badge ${finalClass}">${finalStatus}</span></td>
           <td>${expiresHtml}</td>
@@ -726,7 +736,7 @@
             <button class="btn-sm ${c.status === 'active' ? 'btn-plain' : ''}" onclick="toggleStatus('${c.id}', '${c.status}')">
               ${c.status === 'active' ? '暂停' : '恢复'}
             </button>
-            <button class="btn-sm btn-plain" onclick="resetKey('${c.id}', '${c.name}')">重置 Key</button>
+            <button class="btn-sm btn-plain" onclick="resetKey('${c.id}')">重置 Key</button>
             <button class="btn-sm btn-danger" onclick="deleteCompany('${c.id}')">删除</button>
           </td>
         `;
@@ -746,10 +756,10 @@
         const hbColor = daysSince > 3 ? '#d32f2f' : daysSince > 1 ? '#ef6c00' : '#2e7d32';
 
         tr.innerHTML = `
-          <td>${i.company_name}</td>
-          <td><code>${i.instance_id}</code></td>
-          <td>${i.hostname || '-'}</td>
-          <td>${i.version || '-'}</td>
+          <td>${esc(i.company_name)}</td>
+          <td><code>${esc(i.instance_id)}</code></td>
+          <td>${esc(i.hostname) || '-'}</td>
+          <td>${esc(i.version) || '-'}</td>
           <td>${i.first_seen ? fmtDate(i.first_seen) : '-'}</td>
           <td style="color:${hbColor}">${i.last_heartbeat ? fmtTime(i.last_heartbeat) : '-'}</td>
           <td><button class="btn-sm btn-danger" onclick="deleteInstance('${i.id}')">删除</button></td>
@@ -801,7 +811,8 @@
       document.getElementById('key-modal').classList.add('show');
     }
 
-    async function resetKey(id, name) {
+    async function resetKey(id) {
+      const name = companiesCache.find(x => x.id === id)?.name || id;
       if (!confirm(`确定重置「${name}」的激活码？\n\n旧激活码将立即失效，使用该激活码的客户端会失去授权，需要重新激活。`)) return;
       const res = await api('POST', `/api/admin/companies/${id}/reset-key`);
       if (res.success && res.license_key) {
@@ -975,13 +986,13 @@
         const c = categoriesCache[i];
         const tr = document.createElement('tr');
         tr.innerHTML = `
-          <td><strong>${c.name}</strong></td>
+          <td><strong>${esc(c.name)}</strong></td>
           <td>${c.template_count}</td>
           <td>
             <button class="btn-sm btn-plain" ${i === 0 ? 'disabled' : ''} onclick="moveCategory('${c.id}', -1)" title="上移">↑</button>
             <button class="btn-sm btn-plain" ${i === categoriesCache.length - 1 ? 'disabled' : ''} onclick="moveCategory('${c.id}', 1)" title="下移">↓</button>
             <button class="btn-sm btn-plain" onclick="renameCategory('${c.id}')">改名</button>
-            <button class="btn-sm btn-danger" onclick="deleteCategory('${c.id}', '${c.name.replace(/'/g, "\\'")}')">删除</button>
+            <button class="btn-sm btn-danger" onclick="deleteCategory('${c.id}')">删除</button>
           </td>
         `;
         tbody.appendChild(tr);
@@ -1025,7 +1036,8 @@
       renderCategoryList();
     }
 
-    async function deleteCategory(id, name) {
+    async function deleteCategory(id) {
+      const name = categoriesCache.find(c => c.id === id)?.name || id;
       if (!confirm(`确定删除分类「${name}」？挂在该分类下的模板将回落为未分类。`)) return;
       await api('DELETE', `/api/admin/template-categories/${id}`);
       toast('已删除');
@@ -1067,19 +1079,19 @@
         card.title = `创建于 ${t.created_at || '-'}`;
         card.innerHTML = `
           <div class="card-head">
-            <h3>${t.name}</h3>
-            <span class="ver">v${t.version || '1.0'}</span>
+            <h3>${esc(t.name)}</h3>
+            <span class="ver">v${esc(t.version || '1.0')}</span>
           </div>
-          <p class="desc">${t.description || ''}</p>
+          <p class="desc">${esc(t.description)}</p>
           <div class="chips">
-            ${t.category ? `<span class="chip">${t.category}</span>` : ''}
-            ${companiesChip(t) ? `<span class="chip chip-neutral">${companiesChip(t)}</span>` : ''}
+            ${t.category ? `<span class="chip">${esc(t.category)}</span>` : ''}
+            ${companiesChip(t) ? `<span class="chip chip-neutral">${esc(companiesChip(t))}</span>` : ''}
           </div>
           <div class="card-foot">
             <span class="foot-meta">导入 ${importCount} 次</span>
             <div class="actions">
               <button class="act" onclick="editTemplate('${t.id}')">编辑</button>
-              <button class="act" onclick="showImportDetails('${t.id}', '${t.name.replace(/'/g, "\\'")}')">导入记录</button>
+              <button class="act" onclick="showImportDetails('${t.id}')">导入记录</button>
               <button class="act act-danger" onclick="deleteTemplate('${t.id}')">删除</button>
             </div>
           </div>
@@ -1099,7 +1111,7 @@
         box.appendChild(all);
         for (const c of res.companies || []) {
           const label = document.createElement('label');
-          label.innerHTML = `<input type="checkbox" value="${c.id}" checked><span>${c.name}</span>`;
+          label.innerHTML = `<input type="checkbox" value="${c.id}" checked><span>${esc(c.name)}</span>`;
           box.appendChild(label);
         }
         // 联动：全选 ↔ 单项
@@ -1440,7 +1452,7 @@
       loadTemplates();
     }
 
-    async function showImportDetails(templateId, templateName) {
+    async function showImportDetails(templateId) {
       const res = await api('GET', `/api/admin/imports?template_id=${encodeURIComponent(templateId)}`);
       const tbody = document.getElementById('import-detail-body');
       tbody.innerHTML = '';
@@ -1452,16 +1464,16 @@
         for (const imp of imports) {
           const tr = document.createElement('tr');
           tr.innerHTML = `
-            <td>${imp.company_name || '-'}</td>
-            <td><code>${imp.instance_id || '-'}</code></td>
-            <td>${imp.template_name || '-'}</td>
+            <td>${esc(imp.company_name) || '-'}</td>
+            <td><code>${esc(imp.instance_id) || '-'}</code></td>
+            <td>${esc(imp.template_name) || '-'}</td>
             <td>${imp.imported_at ? fmtTime(imp.imported_at) : '-'}</td>
           `;
           tbody.appendChild(tr);
         }
       }
 
-      document.getElementById('import-detail-title').textContent = `「${templateName}」导入记录 (${imports.length}次)`;
+      document.getElementById('import-detail-title').textContent = `「${imports[0]?.template_name || templateId}」导入记录 (${imports.length}次)`;
       document.getElementById('import-detail-modal').classList.add('show');
     }
 
@@ -1493,15 +1505,16 @@
         return;
       }
       const platformLabel = { 'mac-arm64': 'macOS arm64', 'mac-x64': 'macOS Intel', 'win': 'Windows' };
+      updatesCache = rows;
       body.innerHTML = rows.map(u => `
         <tr>
-          <td>${platformLabel[u.platform] || u.platform}</td>
-          <td>${u.version}</td>
-          <td style="font-family:monospace;font-size:12px;">${u.file_name}</td>
+          <td>${esc(platformLabel[u.platform] || u.platform)}</td>
+          <td>${esc(u.version)}</td>
+          <td style="font-family:monospace;font-size:12px;">${esc(u.file_name)}</td>
           <td>${fmtPkgSize(u.file_size)}</td>
           <td>${u.is_latest ? '✅' : ''}</td>
           <td>${u.created_at ? fmtDate(u.created_at) : '-'}</td>
-          <td><button class="btn-sm btn-danger" onclick="deleteUpdate('${u.id}', '${u.version} (${u.platform})')">删除</button></td>
+          <td><button class="btn-sm btn-danger" onclick="deleteUpdate('${u.id}')">删除</button></td>
         </tr>
       `).join('');
     }
@@ -1539,7 +1552,11 @@
       }
     }
 
-    async function deleteUpdate(id, label) {
+    let updatesCache = [];
+
+    async function deleteUpdate(id) {
+      const u = updatesCache.find(x => x.id === id);
+      const label = u ? `${u.version} (${u.platform})` : id;
       if (!confirm(`确定删除更新包「${label}」？`)) return;
       await api('DELETE', `/api/admin/updates/${id}`);
       toast('已删除');
@@ -1574,22 +1591,22 @@
         return;
       }
       grid.innerHTML = pkgs.map(p => `
-        <div class="tpl-card" title="上传于 ${p.created_at || '-'}">
+        <div class="tpl-card" title="上传于 ${esc(p.created_at) || '-'}">
           <div class="card-head">
-            <h3>${p.name}</h3>
-            <span class="ver">v${p.version || '1.0'}</span>
+            <h3>${esc(p.name)}</h3>
+            <span class="ver">v${esc(p.version || '1.0')}</span>
           </div>
-          <p class="desc">${p.description || ''}</p>
+          <p class="desc">${esc(p.description)}</p>
           <div class="chips">
-            ${p.category ? `<span class="chip">${p.category}</span>` : ''}
-            ${companiesChip(p) ? `<span class="chip chip-neutral">${companiesChip(p)}</span>` : ''}
+            ${p.category ? `<span class="chip">${esc(p.category)}</span>` : ''}
+            ${companiesChip(p) ? `<span class="chip chip-neutral">${esc(companiesChip(p))}</span>` : ''}
           </div>
           <div class="card-foot">
             <span class="foot-meta">${fmtPkgSize(p.file_size)} · 导入 ${importCounts[p.id] || 0} 次</span>
             <div class="actions">
               <button class="act" onclick="editPackage('${p.id}')">编辑</button>
-              <button class="act" onclick="showImportDetails('${p.id}', '${p.name.replace(/'/g, "\\'")}')">导入记录</button>
-              <button class="act act-danger" onclick="deletePackage('${p.id}', '${p.name.replace(/'/g, "\\'")}')">删除</button>
+              <button class="act" onclick="showImportDetails('${p.id}')">导入记录</button>
+              <button class="act act-danger" onclick="deletePackage('${p.id}')">删除</button>
             </div>
           </div>
         </div>
@@ -1680,7 +1697,8 @@
       }
     }
 
-    async function deletePackage(id, name) {
+    async function deletePackage(id) {
+      const name = packagesCache.find(x => x.id === id)?.name || id;
       if (!confirm(`确定删除轻应用「${name}」？客户端将无法再下载。`)) return;
       await api('DELETE', `/api/admin/packages/${id}`);
       toast('已删除');

package/index.js

@@ -5,7 +5,7 @@
  *
  * 环境变量:
  *   PORT              - 服务端口 (默认 4001)
- *   ADMIN_TOKEN       - 管理后台鉴权 Token (默认 exflower-admin-2026)
+ *   ADMIN_TOKEN       - 管理后台鉴权 Token（必设；默认值/占位符拒绝启动）
  *   ADMIN_TOKEN_HASH  - 管理 Token 的 sha256(hex)，设置后忽略 ADMIN_TOKEN（不落明文）
  *
  * 启动:
@@ -31,9 +31,31 @@ const PORT = process.env.PORT || 4001;
 const DEFAULT_ADMIN_TOKEN = 'exflower-admin-2026';
 const ADMIN_TOKEN_HASH = (process.env.ADMIN_TOKEN_HASH || '').trim();
 const ADMIN_TOKEN = process.env.ADMIN_TOKEN || DEFAULT_ADMIN_TOKEN;
-const usingDefaultToken = !ADMIN_TOKEN_HASH && ADMIN_TOKEN === DEFAULT_ADMIN_TOKEN;
 
-app.use(cors());
+// S2（2026-09-23 审查）：限流键此前在反代后取到 caddy 的 IP，全体流量共享一个桶。
+// trust proxy 1 = 只信第一跳反代（宿主 caddy）的 X-Forwarded-For；
+// 无反代直连形态（AO 类）没有 XFF，req.ip 仍是 socket 地址，行为不变
+app.set('trust proxy', 1);
+
+// S5（2026-09-23 审查）：默认/占位 token 都是仓库内公开字符串，等于无鉴权。
+// 未配置强凭证直接拒绝启动（部署检查单：升级镜像前逐实例核实 env）
+const PLACEHOLDER_TOKENS = [DEFAULT_ADMIN_TOKEN, 'change-me-to-a-secure-token'];
+if (!ADMIN_TOKEN_HASH && (!ADMIN_TOKEN || PLACEHOLDER_TOKENS.includes(ADMIN_TOKEN))) {
+  console.error('[FATAL] 未设置有效的 ADMIN_TOKEN（默认值/占位符不允许启动）。');
+  console.error('       请设置 ADMIN_TOKEN 或 ADMIN_TOKEN_HASH（sha256 hex）环境变量后重启。');
+  process.exit(1);
+}
+
+// S11（2026-09-23 审查）：cors() = 反射任意 origin。消费方是 Electron 客户端
+// （Node fetch，无 Origin 头）+ 同源 admin 页；只放行本机开发 origin，其余不给
+// ACAO 头（浏览器侧读不到响应，非浏览器请求不受影响）
+app.use(cors({
+  origin: (origin, cb) => {
+    if (!origin) return cb(null, true);
+    if (/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) return cb(null, true);
+    cb(null, false);
+  }
+}));
 app.use(express.json());
 
 // Admin dashboard (static HTML)
@@ -58,22 +80,14 @@ require('./activation').startScheduler();
 require('./updateSync').startUpdateSync();
 
 app.listen(PORT, () => {
+  // S6（2026-09-23 审查）：横幅不再打明文 token（容器日志多方可见），只回掩码
   const tokenLine = ADMIN_TOKEN_HASH
     ? 'Admin Token: (hashed via ADMIN_TOKEN_HASH)'
-    : `Admin Token: ${ADMIN_TOKEN}`;
+    : `Admin Token: ${ADMIN_TOKEN.slice(0, 3)}****`;
   console.log(`╔══════════════════════════════════════════════════╗`);
   console.log(`║  ExFlower License Server                         ║`);
   console.log(`║  Port: ${PORT.toString().padEnd(42)} ║`);
   console.log(`║  Admin Dashboard: http://localhost:${PORT}/admin  ║`);
   console.log(`║  ${tokenLine.padEnd(48)} ║`);
   console.log(`╚══════════════════════════════════════════════════╝`);
-  if (usingDefaultToken) {
-    console.warn('');
-    console.warn('╔══════════════════════════════════════════════════╗');
-    console.warn('║  ⚠️  警告：正在使用默认 ADMIN_TOKEN！             ║');
-    console.warn('║  生产环境必须设置 ADMIN_TOKEN 或 ADMIN_TOKEN_HASH ║');
-    console.warn('║  WARNING: default admin token in use!            ║');
-    console.warn('╚══════════════════════════════════════════════════╝');
-    console.warn('');
-  }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "exflower-license-server",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "ExFlower License Server - 在线授权验证服务",
   "main": "index.js",
   "bin": {

package/routes.js

@@ -13,6 +13,15 @@ const activation = require('./activation');
 const { ensureFresh } = require('./updateSync');
 
 const DEFAULT_ADMIN_TOKEN = 'exflower-admin-2026';
+
+// S1（2026-09-23 审查）：客户端上报的 hostname/version/instance_id 直接落库且
+// admin 页 innerHTML 直出，恶意值即存储型 XSS（毒 hostname → admin 浏览器执行 →
+// 窃 ADMIN_TOKEN → 传带毒更新包给全部客户）。入库白名单净化，非法整体置 '-'
+const _SAFE_REPORT = /^[A-Za-z0-9._-]+$/;
+function sanitizeReport(v, max = 64) {
+  const s = String(v == null ? '' : v).trim();
+  return (s && s.length <= max && _SAFE_REPORT.test(s)) ? s : '-';
+}
 // ADMIN_TOKEN_HASH（sha256 hex）优先；否则用明文 ADMIN_TOKEN。二选一。
 const ADMIN_TOKEN_HASH = (process.env.ADMIN_TOKEN_HASH || '').trim().toLowerCase();
 const ADMIN_TOKEN = process.env.ADMIN_TOKEN || DEFAULT_ADMIN_TOKEN;
@@ -48,17 +57,27 @@ function rateLimit({ windowMs, max }) {
 }
 
 // x-license-key → company（客户端端点共用）
+// S3（2026-09-23 审查）：被暂停/已过期的激活码此前仍可拉模板、轻应用包和客户端
+// 更新——补齐与 verify/heartbeat 相同的拒绝语义
 function companyByLicenseKey(req, res) {
   const licenseKey = req.headers['x-license-key'];
   if (!licenseKey) {
     res.status(401).json({ success: false, message: 'Missing x-license-key header' });
     return null;
   }
-  const company = queryGet('SELECT id FROM companies WHERE license_key = ?', [licenseKey]);
+  const company = queryGet('SELECT id, status, expires_at FROM companies WHERE license_key = ?', [licenseKey]);
   if (!company) {
     res.status(404).json({ success: false, message: 'Invalid license key' });
     return null;
   }
+  if (company.status === 'suspended') {
+    res.status(403).json({ success: false, message: 'License suspended' });
+    return null;
+  }
+  if (company.expires_at && new Date(company.expires_at) < new Date()) {
+    res.status(403).json({ success: false, message: 'License expired' });
+    return null;
+  }
   return company;
 }
 
@@ -113,6 +132,18 @@ async function readExfappManifest(filePath) {
   return JSON.parse(buf.toString('utf8'));
 }
 
+// S9（2026-09-23 审查）：上传包哈希此前 readFileSync 整读进内存——GB 级包在弱机
+// OOM、>4GB 超 Buffer 上限直接 500。改流式分块哈希，算法/编码由调用方指定
+function hashFile(filePath, algo, encoding) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash(algo);
+    fs.createReadStream(filePath)
+      .on('data', (chunk) => hash.update(chunk))
+      .on('error', reject)
+      .on('end', () => resolve(hash.digest(encoding)));
+  });
+}
+
 // 资料图谱模板上传（.exflib zip：manifest.json{format:'exflower-library'} + libraries/ + libraries-dbrows.json）
 const LIBTPL_DIR = path.join(DATA_DIR, 'library-templates');
 const libraryUpload = multer({
@@ -160,10 +191,12 @@ function buildLatestYml(mac) {
   // 多实例的关键防线）；本地文件仅作无 remote_url 时的兜底（离线/气隙场景）。
   // 服务器仍后台拉包，本地副本是 CDN 不可达时的最终兜底（files/ 路由 302 已覆盖）。
   const fileUrl = (r) => {
-    if (r.remote_url) return r.remote_url;
+    if (r.remote_url) return esc(r.remote_url);
     return `files/${r.platform}/${esc(r.file_name)}`;
   };
-  const lines = [`version: ${rows[0].version}`, 'files:'];
+  // S14（2026-09-23 审查）：version 原样裸插值——值里带换行/引号可注入 YAML 改写
+  // 客户端升级目标。统一引号包裹+单引号转义（入口另有 semver 校验，这里兜底存量行）
+  const lines = [`version: '${esc(rows[0].version)}'`, 'files:'];
   for (const r of rows) {
     lines.push(`  - url: '${fileUrl(r)}'`);
     lines.push(`    sha512: '${r.sha512}'`);
@@ -187,6 +220,10 @@ function setupRoutes(app) {
   // 防爆破限速：admin 接口与 license 验证接口按 IP 限速
   app.use('/api/admin', rateLimit({ windowMs: 60_000, max: 60 }));
   app.use('/api/license', rateLimit({ windowMs: 60_000, max: 120 }));
+  // S4（2026-09-23 审查）：内容三棵树此前完全无限流——持 key 者可无限探测 id、
+  // 打满带宽。常规树 120/min（正常客户端低频），下载路由更严 30/min
+  app.use(['/api/templates', '/api/packages', '/api/updates'], rateLimit({ windowMs: 60_000, max: 120 }));
+  app.use(['/api/templates/:id/download', '/api/packages/:id/download', '/api/updates/files'], rateLimit({ windowMs: 60_000, max: 30 }));
 
   // ── 中央激活门禁：未激活/被顶替/过期 = 拒绝全部客户端服务（admin 端点不受影响） ──
   app.use(['/api/license', '/api/templates', '/api/packages', '/api/updates'], (req, res, next) => {
@@ -216,7 +253,9 @@ function setupRoutes(app) {
       }
       res.json({ success: true, activation: st });
     } catch (e) {
-      res.status(500).json({ success: false, message: e.message });
+      // S13（2026-09-23 审查）：500 不直出内部错误细节，统一文案，详情进日志
+      console.error('[LicenseServer] Activation configure failed:', e.message);
+      res.status(500).json({ success: false, message: '服务器内部错误' });
     }
   });
 
@@ -225,7 +264,8 @@ function setupRoutes(app) {
       const r = await activation.revalidateNow();
       res.json({ success: !!r.ok, message: r.ok ? '复核成功' : (r.message || r.error), activation: activation.getStatus() });
     } catch (e) {
-      res.status(500).json({ success: false, message: e.message });
+      console.error('[LicenseServer] Activation retry failed:', e.message);
+      res.status(500).json({ success: false, message: '服务器内部错误' });
     }
   });
 
@@ -236,7 +276,11 @@ function setupRoutes(app) {
 
   // ── License Verification ──
   app.post('/api/license/verify', (req, res) => {
-    const { license_key, instance_id, hostname, ip, version } = req.body;
+    const { license_key, ip } = req.body;
+    // S1：上报字段净化要放在查表/落库之前（instance_id 也是查键，先净化保证 upsert 两端一致）
+    const instance_id = sanitizeReport(req.body?.instance_id);
+    const hostname = sanitizeReport(req.body?.hostname, 128);
+    const version = sanitizeReport(req.body?.version, 32);
 
     if (!license_key || !instance_id) {
       return res.status(400).json({
@@ -523,7 +567,13 @@ function setupRoutes(app) {
       JOIN companies c ON i.company_id = c.id
       ORDER BY i.last_heartbeat DESC
     `);
-    res.json({ success: true, instances });
+    // S12（2026-09-23 审查）：原 /health 无认证公开的运营计数挪到这里（admin 鉴权后）
+    const stats = queryGet(`
+      SELECT
+        (SELECT COUNT(*) FROM companies) as total_companies,
+        (SELECT COUNT(*) FROM instances WHERE status = 'active' AND last_heartbeat > datetime('now', '-7 days')) as active_instances
+    `);
+    res.json({ success: true, instances, stats });
   });
 
   app.delete('/api/admin/instances/:id', requireAdmin, (req, res) => {
@@ -559,15 +609,8 @@ function setupRoutes(app) {
   const setPackageCompanies = (id, ids) => setShareCompanies('package_companies', 'package_id', id, ids);
 
   app.get('/api/templates', (req, res) => {
-    const licenseKey = req.headers['x-license-key'];
-    if (!licenseKey) {
-      return res.status(401).json({ success: false, message: 'Missing x-license-key header' });
-    }
-
-    const company = queryGet('SELECT id FROM companies WHERE license_key = ?', [licenseKey]);
-    if (!company) {
-      return res.status(404).json({ success: false, message: 'Invalid license key' });
-    }
+    const company = companyByLicenseKey(req, res);
+    if (!company) return;
 
     const { type } = req.query;
     let sql = `
@@ -593,14 +636,8 @@ function setupRoutes(app) {
 
   // Import summary (must come before /:id to avoid matching 'import-summary' as an id)
   app.get('/api/templates/import-summary', (req, res) => {
-    const licenseKey = req.headers['x-license-key'];
-    if (!licenseKey) {
-      return res.status(401).json({ success: false, message: 'Missing x-license-key header' });
-    }
-    const company = queryGet('SELECT id FROM companies WHERE license_key = ?', [licenseKey]);
-    if (!company) {
-      return res.status(404).json({ success: false, message: 'Invalid license key' });
-    }
+    const company = companyByLicenseKey(req, res);
+    if (!company) return;
 
     // 按设备过滤：导入状态跟着设备（instance_id）走，而非激活码；
     // 未传 instance_id 的旧版客户端保持 company 级聚合（向后兼容）
@@ -623,15 +660,8 @@ function setupRoutes(app) {
 
   // Get a single template (full content)
   app.get('/api/templates/:id', (req, res) => {
-    const licenseKey = req.headers['x-license-key'];
-    if (!licenseKey) {
-      return res.status(401).json({ success: false, message: 'Missing x-license-key header' });
-    }
-
-    const company = queryGet('SELECT id FROM companies WHERE license_key = ?', [licenseKey]);
-    if (!company) {
-      return res.status(404).json({ success: false, message: 'Invalid license key' });
-    }
+    const company = companyByLicenseKey(req, res);
+    if (!company) return;
 
     const template = queryGet(
       `SELECT * FROM templates WHERE id = ? AND ${TEMPLATE_VISIBLE}`,
@@ -981,7 +1011,7 @@ function setupRoutes(app) {
       fs.mkdirSync(LIBTPL_DIR, { recursive: true });
       fs.renameSync(req.file.path, dest);
 
-      const sha256 = crypto.createHash('sha256').update(fs.readFileSync(dest)).digest('hex');
+      const sha256 = await hashFile(dest, 'sha256', 'hex');
       const name = (req.body?.name || '').trim() || manifest.library?.name || '未命名图谱';
       queryRun(
         `INSERT INTO templates (id, company_id, type, name, description, content_json, category, file_path, version, created_at, updated_at)
@@ -1008,7 +1038,8 @@ function setupRoutes(app) {
       res.json({ success: true, template: { id, name } });
     } catch (err) {
       cleanup();
-      res.status(500).json({ success: false, message: err.message });
+      console.error('[LicenseServer] Library upload failed:', err.message);
+      res.status(500).json({ success: false, message: '服务器内部错误' });
     }
   });
 
@@ -1087,22 +1118,30 @@ function setupRoutes(app) {
       }
       res.json({ success: true, template: { id, name, assets: assets.length } });
     } catch (err) {
-      res.status(500).json({ success: false, message: err.message });
+      console.error('[LicenseServer] Doc upload failed:', err.message);
+      res.status(500).json({ success: false, message: '服务器内部错误' });
     }
   });
 
   // ── Template Import Log (client-facing) ──
   app.post('/api/templates/:id/import-log', (req, res) => {
-    const licenseKey = req.headers['x-license-key'];
-    if (!licenseKey) {
-      return res.status(401).json({ success: false, message: 'Missing x-license-key header' });
-    }
-    const company = queryGet('SELECT id FROM companies WHERE license_key = ?', [licenseKey]);
-    if (!company) {
-      return res.status(404).json({ success: false, message: 'Invalid license key' });
-    }
+    const company = companyByLicenseKey(req, res);
+    if (!company) return;
 
     const { instance_id, template_name, template_type } = req.body;
+    // S8（2026-09-23 审查）：任意 id 可无限刷导入记录（伪造统计 + 表膨胀），
+    // 只允许记录该公司可见的模板或轻应用包 id
+    const tpl = queryGet(
+      `SELECT id FROM templates WHERE id = ? AND ${TEMPLATE_VISIBLE}`,
+      [req.params.id, company.id, company.id]
+    );
+    const pkg = tpl ? null : queryGet(
+      `SELECT id FROM app_packages WHERE id = ? AND ${PACKAGE_VISIBLE}`,
+      [req.params.id, company.id, company.id]
+    );
+    if (!tpl && !pkg) {
+      return res.status(404).json({ success: false, message: 'Template not found' });
+    }
     const id = generateId();
     queryRun(
       `INSERT INTO template_imports (id, template_id, company_id, instance_id, template_name, template_type)
@@ -1251,7 +1290,7 @@ function setupRoutes(app) {
       req.file = null; // 已落位，禁止 cleanup
 
       const stat = fs.statSync(finalPath);
-      const sha256 = crypto.createHash('sha256').update(fs.readFileSync(finalPath)).digest('hex');
+      const sha256 = await hashFile(finalPath, 'sha256', 'hex');
       const finalName = (name || '').trim() || manifest.app?.title || id;
 
       queryRun(
@@ -1271,7 +1310,7 @@ function setupRoutes(app) {
     } catch (err) {
       cleanup();
       console.error('[LicenseServer] Package upload failed:', err.message);
-      res.status(500).json({ success: false, message: err.message });
+      res.status(500).json({ success: false, message: '服务器内部错误' });
     }
   });
 
@@ -1360,7 +1399,7 @@ function setupRoutes(app) {
     res.json({ success: true, updates });
   });
 
-  app.post('/api/admin/updates', requireAdmin, updateUpload.single('file'), (req, res) => {
+  app.post('/api/admin/updates', requireAdmin, updateUpload.single('file'), async (req, res) => {
     const cleanup = () => { if (req.file) fs.unlink(req.file.path, () => {}); };
     try {
       if (!req.file) return res.status(400).json({ success: false, message: 'file is required' });
@@ -1373,6 +1412,12 @@ function setupRoutes(app) {
         cleanup();
         return res.status(400).json({ success: false, message: 'version is required' });
       }
+      // S14（2026-09-23 审查）：version 会插值进 latest.yml，非法值 = YAML 注入面；
+      // 入口限 semver（buildLatestYml 侧还有引号+转义双保险）
+      if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(version)) {
+        cleanup();
+        return res.status(400).json({ success: false, message: 'version must be semver, e.g. 2.1.8' });
+      }
       // 文件名净化：空格等 URL 不友好字符替换（yml 里按此名寻址）
       const safeName = (req.file.originalname || `${platform}-${version}`).replace(/[^\w.()-]+/g, '-');
 
@@ -1384,7 +1429,7 @@ function setupRoutes(app) {
       req.file = null;
 
       const stat = fs.statSync(finalPath);
-      const sha512 = crypto.createHash('sha512').update(fs.readFileSync(finalPath)).digest('base64');
+      const sha512 = await hashFile(finalPath, 'sha512', 'base64');
 
       const isLatest = set_latest !== '0' && set_latest !== 'false';
       if (isLatest) {
@@ -1399,7 +1444,7 @@ function setupRoutes(app) {
     } catch (err) {
       cleanup();
       console.error('[LicenseServer] Update upload failed:', err.message);
-      res.status(500).json({ success: false, message: err.message });
+      res.status(500).json({ success: false, message: '服务器内部错误' });
     }
   });
 
@@ -1412,13 +1457,10 @@ function setupRoutes(app) {
   });
 
   // ── Health ──
+  // S12（2026-09-23 审查）：/health 无认证，total_companies/active_instances 属运营
+  // 数据不再对外（计数在 /api/admin/instances）；compose healthcheck 只看状态码
   app.get('/health', (req, res) => {
-    const stats = queryGet(`
-      SELECT
-        (SELECT COUNT(*) FROM companies) as total_companies,
-        (SELECT COUNT(*) FROM instances WHERE status = 'active' AND last_heartbeat > datetime('now', '-7 days')) as active_instances
-    `);
-    res.json({ status: 'ok', ...stats });
+    res.json({ status: 'ok' });
   });
 }