更新: 178 个文件 - 2026-03-18 07:47:37
这个提交包含在：
hao
@@ -87,7 +87,7 @@
|
||||
<h1>当前架构库镜像</h1>
|
||||
<div class="meta">工作台内置镜像页：当前架构库结构化数据镜像。</div>
|
||||
<pre>{
|
||||
"generated_at": "2026-03-18T14:22:56+00:00",
|
||||
"generated_at": "2026-03-18T14:45:55+00:00",
|
||||
"title": "当前架构库",
|
||||
"summary": "工作台、控制面、数据层、授权边界与系统覆盖的当前真值视图。",
|
||||
"sections": [
|
||||
@@ -119,7 +119,7 @@
|
||||
},
|
||||
{
|
||||
"label": "当前漏洞条目",
|
||||
"value": "89"
|
||||
"value": "5"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
@@ -137,7 +137,7 @@
|
||||
},
|
||||
{
|
||||
"label": "生成时间",
|
||||
"value": "2026-03-18T14:22:56+00:00"
|
||||
"value": "2026-03-18T14:45:55+00:00"
|
||||
}
|
||||
],
|
||||
"links": [
|
||||
@@ -5945,7 +5945,7 @@
|
||||
},
|
||||
{
|
||||
"label": "Advisory 数",
|
||||
"value": "89"
|
||||
"value": "5"
|
||||
},
|
||||
{
|
||||
"label": "状态类型",
|
||||
@@ -5953,7 +5953,7 @@
|
||||
},
|
||||
{
|
||||
"label": "最近失败",
|
||||
"value": "0"
|
||||
"value": "5"
|
||||
}
|
||||
],
|
||||
"items": [
|
||||
@@ -5963,17 +5963,17 @@
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "真实版本已实证",
|
||||
"summary": "当前累计 89 条。",
|
||||
"title": "人工分诊",
|
||||
"summary": "当前累计 5 条。",
|
||||
"open": false,
|
||||
"fields": [
|
||||
{
|
||||
"label": "状态编码",
|
||||
"value": "verified-real"
|
||||
"value": "triage-manual"
|
||||
},
|
||||
{
|
||||
"label": "数量",
|
||||
"value": "89"
|
||||
"value": "5"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -5985,9 +5985,134 @@
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "暂无失败样本",
|
||||
"summary": "当前 summary.json 中没有 recent_failures。",
|
||||
"open": false
|
||||
"title": "Next.js: Unbounded postponed resume buffering can lead to DoS",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27979"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: Unbounded next/image disk cache growth can exhaust storage",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27980"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: HTTP request smuggling in rewrites",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-29057"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: null origin can bypass Server Actions CSRF checks",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27978"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: null origin can bypass dev HMR websocket CSRF checks",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27977"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -109,7 +109,7 @@
|
||||
| Flask | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Ghost | `cms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Gin | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Gitea | `platforms` | `rolling-24m` | `-` | `yes` | `37` | `37` | `3` | `seeded` | `real:37/synthetic:0/blocked:0` | `33` | `37` | `0` | `2026-03-03T04:57:57.697708Z` |
|
||||
| Gitea | `platforms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| GitLab CE | `platforms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Grafana | `platforms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Hapi | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
@@ -125,7 +125,7 @@
|
||||
| Medusa | `ecommerce` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Moodle | `cms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| NestJS | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `26` | `26` | `3` | `seeded` | `real:26/synthetic:0/blocked:0` | `21` | `26` | `0` | `2026-03-13T22:14:13.665535Z` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `5` | `5` | `3` | `seeded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `2026-03-17T16:31:34.160932Z` |
|
||||
| Nginx | `servers` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Node.js | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Nuxt | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
@@ -145,8 +145,8 @@
|
||||
| SvelteKit | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Symfony | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Traefik | `servers` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Undici | `frameworks` | `rolling-24m` | `-` | `yes` | `14` | `14` | `2` | `seeded` | `real:14/synthetic:0/blocked:0` | `0` | `14` | `0` | `2026-03-14T09:19:54.772219Z` |
|
||||
| Vite | `frameworks` | `history-full` | `yes` | `yes` | `12` | `12` | `3` | `seeded` | `real:12/synthetic:0/blocked:0` | `12` | `12` | `0` | `2026-02-04T04:37:24.129476Z` |
|
||||
| Undici | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Vite | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Vue | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| webpack | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Werkzeug | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
|
||||
@@ -88,21 +88,18 @@
|
||||
<div class="meta">工作台内置镜像页：89 条 advisory 最新完整度、family 矩阵与 ingest 健康度。</div>
|
||||
<pre># 全库 Advisory 完整度报告
|
||||
|
||||
- 生成时间: `2026-03-18T14:22:56+00:00`
|
||||
- 最新 advisory 完整度: `89/89` `verified-real`
|
||||
- 生成时间: `2026-03-18T14:45:55+00:00`
|
||||
- 最新 advisory 完整度: `0/5` `verified-real`
|
||||
- 合成验证数量: `0`
|
||||
- 阻塞数量: `0`
|
||||
- 人工/待补证据数量: `0`
|
||||
- 完整度百分比: `100.0%`
|
||||
- 人工/待补证据数量: `5`
|
||||
- 完整度百分比: `0.0%`
|
||||
|
||||
## 系统覆盖矩阵
|
||||
|
||||
| 系统 | 总数 | verified-real | verified-synthetic | blocked | manual | family 覆盖 |
|
||||
| --- | ---: | ---: | ---: | ---: | ---: | --- |
|
||||
| gitea | 37 | 37 | 0 | 0 | 0 | authz-bypass(3/3), file-upload(2/2), proxy-boundary(26/26), ssrf(1/1), xss(5/5) |
|
||||
| nextjs | 26 | 26 | 0 | 0 | 0 | authz-bypass(2/2), deserialization(1/1), proxy-boundary(19/19), ssrf(2/2), xss(2/2) |
|
||||
| undici | 14 | 14 | 0 | 0 | 0 | ssrf(14/14) |
|
||||
| vite | 12 | 12 | 0 | 0 | 0 | proxy-boundary(11/11), xss(1/1) |
|
||||
| nextjs | 5 | 0 | 0 | 0 | 5 | proxy-boundary(0/4), request-smuggling(0/1) |
|
||||
|
||||
## 历史阻塞项修复纪要
|
||||
|
||||
@@ -113,12 +110,36 @@
|
||||
|
||||
## Ingest / Source 健康度
|
||||
|
||||
- source failures: `5`
|
||||
- source failures: `29`
|
||||
- drupal::Drupal Security Advisories Site::HTTPError
|
||||
- django::Django Security RSS::HTTPError
|
||||
- haproxy::HAProxy Security Advisories::HTTPError
|
||||
- discourse::Discourse Meta Security::HTTPError
|
||||
- adobe-commerce::Adobe Security Bulletins::SSLError
|
||||
- adobe-commerce::Adobe Security Bulletins::ConnectionError
|
||||
- react::GitHub Global Advisories::TypeError
|
||||
- nextjs::GitHub Global Advisories::AttributeError
|
||||
- vue::GitHub Global Advisories::HTTPError
|
||||
- nuxt::GitHub Global Advisories::HTTPError
|
||||
- vite::GitHub Global Advisories::HTTPError
|
||||
- angular::GitHub Global Advisories::HTTPError
|
||||
- sveltekit::GitHub Global Advisories::HTTPError
|
||||
- astro::GitHub Global Advisories::HTTPError
|
||||
- express::GitHub Global Advisories::HTTPError
|
||||
- nestjs::GitHub Global Advisories::HTTPError
|
||||
- koa::GitHub Global Advisories::HTTPError
|
||||
- fastify::GitHub Global Advisories::HTTPError
|
||||
- hapi::GitHub Global Advisories::HTTPError
|
||||
- undici::GitHub Global Advisories::HTTPError
|
||||
- webpack::GitHub Global Advisories::HTTPError
|
||||
- esbuild::GitHub Global Advisories::HTTPError
|
||||
- spring-framework::GitHub Global Advisories::HTTPError
|
||||
- spring-security::GitHub Global Advisories::HTTPError
|
||||
- spring-boot::GitHub Global Advisories::HTTPError
|
||||
- laravel::GitHub Global Advisories::HTTPError
|
||||
- symfony::GitHub Global Advisories::HTTPError
|
||||
- django::Django Security RSS::HTTPError
|
||||
- flask::GitHub Global Advisories::HTTPError
|
||||
- werkzeug::GitHub Global Advisories::HTTPError
|
||||
- rails::GitHub Global Advisories::HTTPError
|
||||
- haproxy::HAProxy Security Advisories::HTTPError
|
||||
|
||||
## 剩余风险说明
|
||||
|
||||
|
||||
在新工单中引用
屏蔽一个用户