From 69c2c62be3e9ffaa571764b54cba287af9dcfdfb Mon Sep 17 00:00:00 2001 From: chenpei Date: Thu, 30 Jul 2026 22:49:09 +0800 Subject: [PATCH] =?UTF-8?q?chore(security):=20=E6=94=B6=E7=B4=A7=E5=AE=B9?= =?UTF-8?q?=E5=99=A8=E8=BF=90=E8=A1=8C=E6=96=87=E4=BB=B6=E6=9D=83=E9=99=90?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Dockerfile | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index a38b610..caa3a43 100644 --- a/Dockerfile +++ b/Dockerfile @@ -103,15 +103,19 @@ COPY --from=builder --chown=nextjs:nodejs /app/lib ./lib COPY --from=builder --chown=nextjs:nodejs /app/scripts/public-traffic-rollup-from-nginx.py ./scripts/public-traffic-rollup-from-nginx.py COPY --from=builder --chown=nextjs:nodejs /app/scripts/collapse-performance-survey-template-versions.mjs ./scripts/collapse-performance-survey-template-versions.mjs -# 创建必要目录并设置权限 +# 创建必要目录并收紧权限。 +# 应用代码归 root 所有，运行账号只能写上传目录和 Next.js 运行时缓存； +# 即使上层文件路径校验再次出现缺陷，也不能覆盖 server.js 或业务源码。 RUN mkdir -p /app/public /app/uploads && \ mkdir -p /app/scripts && \ + mkdir -p /app/.next/cache && \ mkdir -p /app/uploads/temp && \ mkdir -p /app/uploads/assembled && \ mkdir -p /app/uploads/materials && \ mkdir -p /app/uploads/cleanup && \ - chown -R nextjs:nodejs /app/public /app/uploads && \ - chmod -R 777 /app/uploads + chown -R root:root /app && \ + chown -R nextjs:nodejs /app/.next/cache /app/uploads && \ + chmod 0750 /app/uploads /app/uploads/temp /app/uploads/assembled /app/uploads/materials /app/uploads/cleanup USER nextjs