安全加固：CORS白名单、JWT密钥自动生成、SSRF防护、路径遍历与错误信息泄露修复

backend-java/src/main/java/com/nanri/aiimage/common/security/ShopCredentialCryptoService.java

@@ -2,6 +2,7 @@ package com.nanri.aiimage.common.security;
 
 import com.nanri.aiimage.common.exception.BusinessException;
 import jakarta.annotation.PostConstruct;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
@@ -12,8 +13,11 @@ import java.security.MessageDigest;
 import java.util.Base64;
 
 @Service
+@Slf4j
 public class ShopCredentialCryptoService {
 
+    private static final String INSECURE_DEFAULT_KEY = "change-me-shop-credential-key";
+
     @Value("${aiimage.security.shop-credential-key:change-me-shop-credential-key}")
     private String rawKey;
 
@@ -22,6 +26,10 @@ public class ShopCredentialCryptoService {
     @PostConstruct
     public void init() {
         try {
+            if (rawKey == null || rawKey.isBlank() || INSECURE_DEFAULT_KEY.equals(rawKey.trim())) {
+                log.warn("[security] AIIMAGE_SHOP_CREDENTIAL_KEY 未配置或仍为默认值，店铺凭据加密强度不足，"
+                        + "请通过环境变量 AIIMAGE_SHOP_CREDENTIAL_KEY 配置固定密钥");
+            }
             MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
             byte[] full = sha256.digest(rawKey.getBytes(StandardCharsets.UTF_8));
             byte[] key16 = new byte[16];