tamakyi
11d6e701ee
三处都属于「故障时才发现」的运维缺口，一起改。
1) 访问日志泄露凭证
flamego.Classic() 内部 Use(Logger())，而 Logger 记的是 RequestURI —— 含 query。
实测日志出现 path=/_/tblocal/4?t=SECRETTOKEN123：?t= 是私密提问钥匙，
?code= 是一次性改密凭证，?q= 是搜索词，全都会被明文落盘，凡是能看日志的人
都能直接读私密提问或重置密码。internal/tracing 早就为同一原因只取 URL.Path
并留了注释，漏的是框架自带那层。
→ 改 flamego.New() + accessLogMiddleware，只记 Method/Path/Status/Duration/IP；
静态资源成功请求不记（噪音），4xx/5xx 照记（排查裂图靠它）。
2) 没有优雅关闭
直接 ListenAndServe，Go 对 SIGTERM 是立即退出，每次部署都会把正在写库的 POST
就地处死，留下「提问已 INSERT、图片没传完」这类半成品。
→ signal.NotifyContext(SIGTERM/SIGINT) + srv.Shutdown(15s)，超时才 Close；
退出前关连接池。实测 8 个并发分享图请求中发 SIGTERM，8/8 全部成功。
3) Redis 单点
session 建在 Redis 上，load 失败 flamego/session 会 panic → 每请求 500（含匿名访客）；
而 cache.Cacher 没判空 Addr，go-redis 会回退 localhost:6379，于是「不配 Redis」
这种被允许的部署里找回密码整体不可用、私信邮件节流失效，且启动零提示。
→ cache 跟随开关（未配则 MemoryIniter）；启动 PingRedis fail-fast，显式 2s 超时。
实测停掉 Redis 后启动立即失败并明确指出是 Redis。
验证：单测 2 项（query 永不入日志 / 静态资源过滤口径）；重启日志出现
「收到退出信号」→「HTTP 服务已关闭」；启动打「Redis 连接正常」。
169 lines
8.2 KiB
AMPL
169 lines
8.2 KiB
AMPL
module github.com/tamakyi/TamaBox
|
|
|
|
go 1.27.3
|
|
|
|
replace golang.org/x/image => golang.org/x/image v0.13.0
|
|
|
|
require (
|
|
github.com/alibabacloud-go/darabonba-openapi/v2 v2.2.4
|
|
github.com/alibabacloud-go/green-20220302/v3 v3.5.4
|
|
github.com/alibabacloud-go/tea v1.5.2
|
|
github.com/aliyun/aliyun-oss-go-sdk v2.2.4+incompatible
|
|
github.com/aws/aws-sdk-go-v2 v1.24.0
|
|
github.com/aws/aws-sdk-go-v2/config v1.26.1
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.16.12
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5
|
|
github.com/chai2010/webp v1.4.0
|
|
github.com/disintegration/imaging v1.6.2
|
|
github.com/flamego/cache v1.1.0
|
|
github.com/flamego/csrf v1.3.0
|
|
github.com/flamego/flamego v1.9.4
|
|
github.com/flamego/recaptcha v1.2.0
|
|
github.com/flamego/session v1.6.5
|
|
github.com/flamego/template v1.2.2
|
|
github.com/go-sql-driver/mysql v1.8.1
|
|
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0
|
|
github.com/jackc/pgconn v1.13.0
|
|
github.com/pkg/errors v0.9.1
|
|
github.com/projectdiscovery/cdncheck v1.3.0
|
|
github.com/qiniu/go-sdk/v7 v7.13.0
|
|
github.com/rs/xid v1.5.0
|
|
github.com/russross/blackfriday/v2 v2.1.0
|
|
github.com/samber/lo v1.34.0
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/tdewolff/minify/v2 v2.12.4
|
|
github.com/thanhpk/randstr v1.0.4
|
|
github.com/unknwon/com v1.0.1
|
|
github.com/uptrace/opentelemetry-go-extra/otelgorm v0.1.16
|
|
github.com/uptrace/opentelemetry-go-extra/otellogrus v0.1.16
|
|
github.com/uptrace/uptrace-go v1.9.0
|
|
github.com/urfave/cli/v2 v2.26.0
|
|
github.com/wuhan005/gadget v0.0.0-20221206194113-7619e407f1a0
|
|
github.com/wuhan005/govalid v0.0.0-20230216091828-820aa255fd21
|
|
github.com/xuri/excelize/v2 v2.6.0
|
|
go.opentelemetry.io/otel v1.10.0
|
|
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.9.0
|
|
go.opentelemetry.io/otel/sdk v1.9.0
|
|
go.opentelemetry.io/otel/trace v1.10.0
|
|
golang.org/x/crypto v0.54.0
|
|
golang.org/x/image v0.13.0
|
|
golang.org/x/net v0.56.0
|
|
gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
|
|
gopkg.in/ini.v1 v1.67.0
|
|
gorm.io/datatypes v1.0.7
|
|
gorm.io/driver/mysql v1.3.6
|
|
gorm.io/driver/postgres v1.4.5
|
|
gorm.io/gorm v1.24.1-0.20221019064659-5dd2bb482755
|
|
)
|
|
|
|
require (
|
|
filippo.io/edwards25519 v1.1.0 // indirect
|
|
github.com/alecthomas/participle/v2 v2.0.0 // indirect
|
|
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.5 // indirect
|
|
github.com/alibabacloud-go/debug v1.0.1 // indirect
|
|
github.com/alibabacloud-go/tea-utils/v2 v2.0.9 // indirect
|
|
github.com/aliyun/credentials-go v1.4.5 // indirect
|
|
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 // indirect
|
|
github.com/aws/smithy-go v1.19.0 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f // indirect
|
|
github.com/cenkalti/backoff/v4 v4.1.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.2.0 // indirect
|
|
github.com/charmbracelet/lipgloss v0.13.0 // indirect
|
|
github.com/charmbracelet/log v0.2.3 // indirect
|
|
github.com/charmbracelet/x/ansi v0.3.2 // indirect
|
|
github.com/clbanning/mxj/v2 v2.7.0 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
github.com/gaissmai/bart v0.26.1 // indirect
|
|
github.com/go-logfmt/logfmt v0.6.0 // indirect
|
|
github.com/go-logr/logr v1.3.0 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-redis/redis/v8 v8.11.5 // indirect
|
|
github.com/golang/protobuf v1.5.3 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/gorilla/websocket v1.5.3 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
|
|
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
|
|
github.com/jackc/pgio v1.0.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgproto3/v2 v2.3.1 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
|
|
github.com/jackc/pgtype v1.12.0 // indirect
|
|
github.com/jackc/pgx/v4 v4.17.2 // indirect
|
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
|
github.com/jinzhu/now v1.1.5 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/kr/pretty v0.3.1 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
|
|
github.com/miekg/dns v1.1.72 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
|
|
github.com/muesli/termenv v0.15.3-0.20240618155329-98d742f6907a // indirect
|
|
github.com/onsi/gomega v1.29.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/projectdiscovery/blackrock v0.0.2 // indirect
|
|
github.com/projectdiscovery/retryabledns v1.0.115 // indirect
|
|
github.com/projectdiscovery/utils v0.11.1 // indirect
|
|
github.com/redis/go-redis/v9 v9.5.1
|
|
github.com/richardlehane/mscfb v1.0.4 // indirect
|
|
github.com/richardlehane/msoleps v1.0.1 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect
|
|
github.com/tdewolff/parse/v2 v2.6.4 // indirect
|
|
github.com/tidwall/gjson v1.18.0 // indirect
|
|
github.com/tidwall/match v1.2.0 // indirect
|
|
github.com/tidwall/pretty v1.2.1 // indirect
|
|
github.com/tjfoc/gmsm v1.4.1 // indirect
|
|
github.com/uptrace/opentelemetry-go-extra/otelsql v0.1.16 // indirect
|
|
github.com/uptrace/opentelemetry-go-extra/otelutil v0.1.16 // indirect
|
|
github.com/weppos/publicsuffix-go v0.50.3-0.20260104170930-90713dec78f2 // indirect
|
|
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
|
|
github.com/xuri/efp v0.0.0-20220407160117-ad0f7a785be8 // indirect
|
|
github.com/xuri/nfp v0.0.0-20220409054826-5e722a1d9e22 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/runtime v0.34.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.9.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.31.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.31.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.9.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.9.0 // indirect
|
|
go.opentelemetry.io/otel/metric v0.32.1 // indirect
|
|
go.opentelemetry.io/otel/sdk/metric v0.31.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v0.19.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
golang.org/x/exp v0.0.0-20260112195511-716be5621a96 // indirect
|
|
golang.org/x/mod v0.37.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
|
|
golang.org/x/tools v0.47.0 // indirect
|
|
google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20231127180814-3a041ad873d4 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 // indirect
|
|
google.golang.org/grpc v1.59.0 // indirect
|
|
google.golang.org/protobuf v1.33.0 // indirect
|
|
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|