兰一民 lan

1 Followers · 5 Following

• Joined on 2025-11-27
• • 

Repositories

6

Projects Packages Public Activity Starred Repositories

3

lan closed issue carrot_bbs/backend#13 2026-04-30 12:23:20 +08:00

[MEDIUM] Email TLS 证书校验可被禁用：InsecureSkipVerify 配置风险

lan closed issue carrot_bbs/backend#11 2026-04-30 12:23:20 +08:00

[MEDIUM] HTTP Server 缺少超时配置：Slowloris DoS 攻击风险

lan closed issue carrot_bbs/backend#10 2026-04-30 12:23:20 +08:00

[HIGH] SSRF 漏洞：用户可控 URL 未验证即发起 HTTP 请求

lan closed issue carrot_bbs/backend#9 2026-04-30 12:23:20 +08:00

[LOW] JWT 载荷含敏感信息 + 缺少安全响应头

lan closed issue carrot_bbs/backend#8 2026-04-30 12:23:20 +08:00

[MEDIUM] 缺失全局速率限制：登录、注册、密码重置接口可被爆破

lan closed issue carrot_bbs/backend#5 2026-04-30 12:23:20 +08:00

[CRITICAL] 大规模 IDOR 漏洞：Delete/Update 操作缺失所有权检查

lan closed issue carrot_bbs/backend#6 2026-04-30 12:23:20 +08:00

[HIGH] SetupSuperAdmin 接口暴露：无速率限制，可被爆破

lan opened issue carrot_bbs/backend#14 2026-04-30 03:56:58 +08:00

[LOW] SQL LIKE 查询未转义通配符：用户输入可导致全表扫描/数据泄露

lan opened issue carrot_bbs/backend#13 2026-04-30 03:56:36 +08:00

[MEDIUM] Email TLS 证书校验可被禁用：InsecureSkipVerify 配置风险

lan opened issue carrot_bbs/backend#12 2026-04-30 03:56:18 +08:00

[LOW] fmt.Sscanf 返回值未检查：可能导致逻辑错误

lan opened issue carrot_bbs/backend#11 2026-04-30 03:55:59 +08:00

[MEDIUM] HTTP Server 缺少超时配置：Slowloris DoS 攻击风险

lan opened issue carrot_bbs/backend#10 2026-04-30 03:55:40 +08:00

[HIGH] SSRF 漏洞：用户可控 URL 未验证即发起 HTTP 请求

lan opened issue carrot_bbs/backend#9 2026-04-30 03:49:01 +08:00

[LOW] JWT 载荷含敏感信息 + 缺少安全响应头

lan opened issue carrot_bbs/backend#8 2026-04-30 03:48:43 +08:00

[MEDIUM] 缺失全局速率限制：登录、注册、密码重置接口可被爆破

lan opened issue carrot_bbs/backend#7 2026-04-30 03:45:06 +08:00

[MEDIUM] CORS 配置过于宽松：子域名通配 + localhost 任意端口

lan opened issue carrot_bbs/backend#6 2026-04-30 03:44:39 +08:00

[HIGH] SetupSuperAdmin 接口暴露：无速率限制，可被爆破

lan opened issue carrot_bbs/backend#5 2026-04-30 03:44:14 +08:00

[CRITICAL] 大规模 IDOR 漏洞：Delete/Update 操作缺失所有权检查

lan synced commits to master at lan/JKVideo from mirror 2026-04-29 21:37:33 +08:00

4706845f44 chore: bump version to v1.0.17 [skip ci]

05fc42659e chore: final release - 停止维护公告

d05e03418f docs: 收到哔哩哔哩律师函，停止后续维护 [skip ci]

04fea94fbe Merge branch 'master' of https://github.com/tiajinsha/JKVideo

fc88907ede 1

Compare 167 commits »

lan synced commits to refs/tags/v1.0.17 at lan/JKVideo from mirror 2026-04-29 21:37:33 +08:00

lan synced commits to refs/tags/v1.0.19 at lan/JKVideo from mirror 2026-04-29 21:37:33 +08:00