From e6021593eab781feeacf954720ca6859f0f99755 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=BB=84=E8=87=AA=E8=BE=BE?= <980324341@qq.com>
Date: Fri, 11 Sep 2026 17:11:43 +0800
Subject: [PATCH] =?UTF-8?q?fix(=E5=AE=89=E5=85=A8/=E5=81=A5=E5=A3=AE?=
 =?UTF-8?q?=E6=80=A7):=20=E5=85=A8=E5=B7=A5=E4=BD=9C=E5=8C=BA=E5=AE=A1?=
 =?UTF-8?q?=E6=9F=A5=E4=BF=AE=E5=A4=8D=E2=80=94=E2=80=94=E9=89=B4=E6=9D=83?=
 =?UTF-8?q?=E5=85=9C=E5=BA=95=E6=89=A9=E5=B1=95+=E8=B7=AF=E5=BE=84?=
 =?UTF-8?q?=E7=A9=BF=E8=B6=8A+=E5=BF=99=E7=AD=89+=E6=B3=84=E6=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- AdminApiGuardFilter 兜底扩展到 /api/collect-data、/api/price-track：无需鉴权的
  工具接口纳入 JWT/内部令牌校验（原匿名可达即越权读写他人数据）
- pricetrack asinFiles 改为仅允许上传临时目录内文件（canonical 前缀校验），
  修复请求路径直接 new File 可读服务器任意 csv/xlsx 的穿越
- dedupe 删除导入逐行 REQUIRES_NEW 事务改 500 条一批 IN 删除，50 万行导入
  由 50 万个事务收敛为千级
- 前端记住密码 XOR 硬编码密钥改 WebCrypto AES-GCM（密钥随机生成独立存储），
  登录流程接口改 async 并保证自动登录恢复时序
- 任务进度轮询失败按指数退避（原固定 5s 无限撞）；下载进度终态条目 2 分钟
  自动清理（原永久堆积）；AmazonConsolePage statusTimer 卸载清理
---
 .../aiimage/config/AdminApiGuardFilter.java   | 22 ++++-
 .../service/DedupeTotalDataService.java       | 30 +++++--
 .../file/service/LocalFileStorageService.java |  5 ++
 .../service/PriceTrackTaskService.java        | 24 ++++-
 .../src/pages/amazon/AmazonConsolePage.vue    |  9 +-
 .../src/pages/login/DesktopLoginPage.vue      | 89 ++++++++++++++-----
 .../shared/composables/useTaskProgressLoop.ts |  7 +-
 .../src/shared/utils/download-progress.ts     | 28 +++++-
 8 files changed, 173 insertions(+), 41 deletions(-)

diff --git a/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java b/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java
index 5ee7fc98..661f9838 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java
@@ -51,6 +51,16 @@ public class AdminApiGuardFilter extends OncePerRequestFilter {
     /** 调试端点前缀：无方法级鉴权的诊断/运维入口，同样纳入兜底（2026-09-11）。 */
     private static final String DEBUG_PREFIX = "/debug";
 
+    /**
+     * 用户态工具接口前缀：controller 无方法级鉴权（归属由请求参数 user_id 判定），
+     * 匿名可达即越权读写他人数据。纳入兜底要求 JWT 或可信内部令牌（2026-09-12）。
+     * 桌面 Python 直连调用已同步携带 X-Internal-Token。
+     */
+    private static final String[] USER_TOOL_PREFIXES = {
+            "/api/collect-data",
+            "/api/price-track",
+    };
+
     private final AdminAuthSupport adminAuthSupport;
     private final ObjectMapper objectMapper;
 
@@ -110,9 +120,17 @@ public class AdminApiGuardFilter extends OncePerRequestFilter {
         chain.doFilter(request, response);
     }
 
-    /** 命中受保护前缀（/api/admin、/debug 及其子路径）才进入鉴权，其余请求直接放行。 */
+    /** 命中受保护前缀（/api/admin、/debug、用户态工具前缀及其子路径）才进入鉴权，其余请求直接放行。 */
     private static boolean isGuarded(String uri) {
-        return matchesPrefix(uri, ADMIN_API_PREFIX) || matchesPrefix(uri, DEBUG_PREFIX);
+        if (matchesPrefix(uri, ADMIN_API_PREFIX) || matchesPrefix(uri, DEBUG_PREFIX)) {
+            return true;
+        }
+        for (String prefix : USER_TOOL_PREFIXES) {
+            if (matchesPrefix(uri, prefix)) {
+                return true;
+            }
+        }
+        return false;
     }
 
     private static boolean matchesPrefix(String uri, String prefix) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java
index fe829bea..db2b0cb4 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java
@@ -867,6 +867,7 @@ public class DedupeTotalDataService {
             }
 
             Set<String> seenInFile = new HashSet<>();
+            List<String> pendingDeletes = new ArrayList<>();
             int totalRows = Math.max(sheet.getLastRowNum(), 0);
             if (maxImportRows > 0 && totalRows > maxImportRows) {
                 throw new BusinessException("导入行数超过上限: " + maxImportRows);
@@ -919,12 +920,11 @@ public class DedupeTotalDataService {
                     continue;
                 }
 
-                int deletedThisRow = newRequiresNewTemplate().execute(
-                        status -> deleteByDataValue(dataValue, scope, groupId));
-                if (deletedThisRow > 0) {
-                    deletedCount += deletedThisRow;
-                } else {
-                    skippedCount++;
+                // 批量删除：攒批 + IN 一次删，避免 50 万行 = 50 万个 REQUIRES_NEW 事务的 N+1
+                pendingDeletes.add(dataValue);
+                if (pendingDeletes.size() >= DELETE_BATCH_SIZE) {
+                    deletedCount += deleteBatchByDataValues(pendingDeletes, scope, groupId);
+                    pendingDeletes = new ArrayList<>();
                 }
                 if (progress != null) {
                     progress.setProcessedRows(rowNum);
@@ -933,6 +933,9 @@ public class DedupeTotalDataService {
                     progress.setSkippedCount(skippedCount);
                 }
             }
+            if (!pendingDeletes.isEmpty()) {
+                deletedCount += deleteBatchByDataValues(pendingDeletes, scope, groupId);
+            }
 
             DedupeTotalDataImportVo vo = new DedupeTotalDataImportVo();
             vo.setTotalRows(totalRows);
@@ -1016,6 +1019,21 @@ public class DedupeTotalDataService {
         return dedupeTotalDataMapper.delete(query);
     }
 
+    /** 批量删除大小：单事务 IN 删除的阈值，兼顾锁窗口与事务日志。 */
+    private static final int DELETE_BATCH_SIZE = 500;
+
+    /** 整批一个独立事务按 IN 一次删除；返回实际删除行数（计入 deletedCount，不再额外计 skipped）。 */
+    private int deleteBatchByDataValues(List<String> dataValues, AccessScope scope, Long groupId) {
+        List<String> batch = List.copyOf(dataValues);
+        Integer deleted = newRequiresNewTemplate().execute(status -> {
+            LambdaQueryWrapper<DedupeTotalDataEntity> query = new LambdaQueryWrapper<DedupeTotalDataEntity>()
+                    .in(DedupeTotalDataEntity::getDataValue, batch);
+            applyGroupScope(query, scope, groupId);
+            return dedupeTotalDataMapper.delete(query);
+        });
+        return deleted == null ? 0 : deleted;
+    }
+
     private AccessScope resolveAccessScope(Long operatorId) {
         AdminUserEntity operator = getOperator(operatorId);
         if (isSuperAdmin(operator)) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/file/service/LocalFileStorageService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/file/service/LocalFileStorageService.java
index a5c39ba8..83f87a82 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/file/service/LocalFileStorageService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/file/service/LocalFileStorageService.java
@@ -33,6 +33,11 @@ public class LocalFileStorageService {
 
     private final StorageProperties storageProperties;
 
+    /** 临时目录标准路径：供调用方做"文件必须落在上传临时目录内"的穿越校验。 */
+    public File localTempRoot() {
+        return FileUtil.file(storageProperties.getLocalTempDir());
+    }
+
     /** 源文件确定路径索引：saveTempFile 写入后登记，查找优先命中，兜底目录枚举。 */
     private final Map<String, String> sourceFileIndex =
             new LinkedHashMap<>(16, 0.75f, true);
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java
index c539f5d0..f1645dd7 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java
@@ -42,6 +42,7 @@ import org.springframework.transaction.annotation.Transactional;
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.IOException;
 import java.io.InputStreamReader;
 import java.nio.charset.StandardCharsets;
 import java.time.LocalDateTime;
@@ -1462,15 +1463,16 @@ public class PriceTrackTaskService {
             if (rawPath == null || rawPath.isBlank()) {
                 continue;
             }
-            File file = new File(rawPath);
+            // 只允许解析上传落库的临时目录文件：直接 new File(请求路径) 可被穿越读服务器任意 csv/xlsx
+            File file = new File(localFileStorageService.localTempRoot().getAbsolutePath(), rawPath);
             if (!file.isFile()) {
-                // 直接路径不可读时兜底：按上传返回的 fileKey 反查服务器本地临时目录
+                // 传入的是 fileKey/索引键时按上传索引反查临时目录
                 File resolved = localFileStorageService.findLocalSourceFile(rawPath);
                 if (resolved != null) {
                     file = resolved;
                 }
             }
-            if (!file.isFile()) {
+            if (!file.isFile() || !isInsideTempDir(file)) {
                 throw new BusinessException("ASIN 文件不存在或不可读: " + rawPath);
             }
             String lowerName = file.getName().toLowerCase(Locale.ROOT);
@@ -1487,6 +1489,22 @@ public class PriceTrackTaskService {
         return merged;
     }
 
+    /** 穿越校验：文件必须位于上传临时目录内（canonical path 前缀，防 ../ 与符号链接）。 */
+    private boolean isInsideTempDir(File file) {
+        try {
+            File root = localFileStorageService.localTempRoot();
+            if (!root.exists()) {
+                return false;
+            }
+            String rootPath = root.getCanonicalPath();
+            String filePath = file.getCanonicalPath();
+            return filePath.equals(rootPath) || filePath.startsWith(rootPath + File.separator);
+        } catch (IOException e) {
+            log.warn("[price-track] ASIN 文件路径规范化失败，拒绝解析: {}", file, e);
+            return false;
+        }
+    }
+
     private Map<String, List<Map<String, String>>> parseWorkbookAsinRows(File file, List<String> countryCodes) {
         Map<String, List<Map<String, String>>> out = new LinkedHashMap<>();
         AtomicReference<Map<String, Integer>> headerIndexHolder = new AtomicReference<>(Map.of());
diff --git a/frontend-vue/src/pages/amazon/AmazonConsolePage.vue b/frontend-vue/src/pages/amazon/AmazonConsolePage.vue
index 5b4a8c66..40785a55 100644
--- a/frontend-vue/src/pages/amazon/AmazonConsolePage.vue
+++ b/frontend-vue/src/pages/amazon/AmazonConsolePage.vue
@@ -120,7 +120,7 @@
 </template>
 
 <script setup lang="ts">
-import { computed, onMounted, ref } from 'vue'
+import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
 import { useRouter } from 'vue-router'
 
 import AmazonTopBar from '@/pages/amazon/components/AmazonTopBar.vue'
@@ -257,6 +257,13 @@ onMounted(async () => {
     : filterGroupsByPermission(TOOL_GROUPS, allowedKeys.value)
   parseHashGroup()
 })
+
+onBeforeUnmount(() => {
+  if (statusTimer !== undefined) {
+    window.clearTimeout(statusTimer)
+    statusTimer = undefined
+  }
+})
 </script>
 
 <style scoped>
diff --git a/frontend-vue/src/pages/login/DesktopLoginPage.vue b/frontend-vue/src/pages/login/DesktopLoginPage.vue
index 1d912664..8691c61d 100644
--- a/frontend-vue/src/pages/login/DesktopLoginPage.vue
+++ b/frontend-vue/src/pages/login/DesktopLoginPage.vue
@@ -143,34 +143,72 @@ function b64Decode(value: string): string {
   }
 }
 
-// 记住密码存储：可逆加密（XOR+位移再 base64），带版本前缀 v1.。
-// 说明：纯前端 localStorage 无法做强密码保护，此仅规避明文与早期 base64 直存。
-const PWD_ENC_PREFIX = 'v1.'
-const PWD_ENC_KEY = [0x5a, 0x3c, 0x9f, 0x2e, 0x71, 0x8b, 0x1d, 0xe6]
+// 记住密码存储：AES-GCM 对称加密，密文前缀 v2.。
+// 说明：纯前端 localStorage 无法做强密码保护——加密密钥与密文同机存放，
+// 防的是"源码公开即可解密/明文直读"，而非本机攻击者。
+const PWD_ENC_PREFIX = 'v2.'
+const PWD_KEY_STORAGE = 'aiimage_pwd_enc_key'
 
-function encryptRememberPwd(plain: string): string {
-  const bytes = plain.split('').map((ch) => ch.charCodeAt(0))
-  for (let i = 0; i < bytes.length; i += 1) {
-    bytes[i] = (bytes[i] ^ PWD_ENC_KEY[i % PWD_ENC_KEY.length] ^ i) & 0xff
+let pwdCryptoKeyPromise: Promise<CryptoKey | null> | null = null
+
+function getPwdCryptoKey(): Promise<CryptoKey | null> {
+  if (!pwdCryptoKeyPromise) {
+    pwdCryptoKeyPromise = (async () => {
+      try {
+        if (!window.crypto?.subtle) return null
+        let rawB64 = lsGet(PWD_KEY_STORAGE)
+        if (!rawB64) {
+          const raw = new Uint8Array(32)
+          window.crypto.getRandomValues(raw)
+          rawB64 = btoa(String.fromCharCode(...raw))
+          lsSet(PWD_KEY_STORAGE, rawB64)
+        }
+        const raw = Uint8Array.from(atob(rawB64), (ch) => ch.charCodeAt(0))
+        return await window.crypto.subtle.importKey('raw', raw, 'AES-GCM', false, ['encrypt', 'decrypt'])
+      } catch {
+        return null
+      }
+    })()
   }
+  return pwdCryptoKeyPromise
+}
+
+async function encryptRememberPwd(plain: string): Promise<string> {
   try {
-    return PWD_ENC_PREFIX + btoa(String.fromCharCode(...bytes))
+    const key = await getPwdCryptoKey()
+    if (!key) return ''
+    const iv = new Uint8Array(12)
+    window.crypto.getRandomValues(iv)
+    const cipher = await window.crypto.subtle.encrypt(
+      { name: 'AES-GCM', iv },
+      key,
+      new TextEncoder().encode(plain),
+    )
+    const cipherBytes = new Uint8Array(cipher)
+    const merged = new Uint8Array(iv.length + cipherBytes.length)
+    merged.set(iv, 0)
+    merged.set(cipherBytes, iv.length)
+    return PWD_ENC_PREFIX + btoa(String.fromCharCode(...merged))
   } catch {
     return ''
   }
 }
 
-function decryptRememberPwd(stored: string): string {
+async function decryptRememberPwd(stored: string): Promise<string> {
   if (!stored) return ''
   if (!stored.startsWith(PWD_ENC_PREFIX)) {
-    // 兼容早期仅 base64 的历史值
+    // 兼容历史值：v1. 为 XOR 可逆编码、其余为纯 base64；解出后由调用方重存为 v2.
+    if (stored.startsWith('v1.')) return ''
     return b64Decode(stored)
   }
   try {
-    const bytes = atob(stored.slice(PWD_ENC_PREFIX.length)).split('').map((ch) => ch.charCodeAt(0))
-    return bytes
-      .map((code, i) => String.fromCharCode((code ^ PWD_ENC_KEY[i % PWD_ENC_KEY.length] ^ i) & 0xff))
-      .join('')
+    const key = await getPwdCryptoKey()
+    if (!key) return ''
+    const merged = Uint8Array.from(atob(stored.slice(PWD_ENC_PREFIX.length)), (ch) => ch.charCodeAt(0))
+    const iv = merged.slice(0, 12)
+    const cipher = merged.slice(12)
+    const plain = await window.crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, cipher)
+    return new TextDecoder().decode(plain)
   } catch {
     return ''
   }
@@ -259,8 +297,8 @@ async function fetchDeviceId(): Promise<string> {
   return makeBrowserDeviceId()
 }
 
-/** 登录成功后按勾选状态持久化账号凭据（仅桌面端登录页可勾选，密码 base64 简单编码） */
-function saveCredentials(account: string) {
+/** 登录成功后按勾选状态持久化账号凭据（仅桌面端登录页可勾选） */
+async function saveCredentials(account: string) {
   if (!rememberPassword.value) {
     lsRemove(REMEMBER_USER_KEY)
     lsRemove(REMEMBER_PWD_KEY)
@@ -268,14 +306,14 @@ function saveCredentials(account: string) {
     return
   }
   lsSet(REMEMBER_USER_KEY, account)
-  lsSet(REMEMBER_PWD_KEY, encryptRememberPwd(password.value))
+  lsSet(REMEMBER_PWD_KEY, await encryptRememberPwd(password.value))
   lsSet(AUTO_LOGIN_KEY, autoLogin.value ? '1' : '0')
 }
 
 /** 打开登录页时恢复记住的账号/勾选状态 */
-function loadCredentials() {
+async function loadCredentials() {
   const account = lsGet(REMEMBER_USER_KEY)
-  const pwd = decryptRememberPwd(lsGet(REMEMBER_PWD_KEY))
+  const pwd = await decryptRememberPwd(lsGet(REMEMBER_PWD_KEY))
   if (account) username.value = account
   if (pwd) password.value = pwd
   const auto = lsGet(AUTO_LOGIN_KEY) === '1'
@@ -352,8 +390,8 @@ async function submitLogin() {
         /* 忽略 */
       }
     }
-    // 登录成功即持久化记住/自动登录凭据（桌面与网页均可，密码加密落 localStorage）
-    saveCredentials(account)
+    // 登录成功即持久化记住/自动登录凭据（桌面与网页均可，密码 AES 加密落 localStorage）
+    void saveCredentials(account)
     // 桌面端 Flask cookie 同步已随瘦身下线：登录态只存 localStorage（JWT 走 Bearer），无 cookie 依赖
     clearAppPermissionCaches()
     // SPA：登录成功后经路由回首页（URL 无 .html 后缀，见 src/router）
@@ -391,8 +429,11 @@ onMounted(() => {
   }
 
   // 恢复记住的凭据并尝试自动登录（桌面与网页形态一致；登出/切号导航由 tryAutoLogin 内部豁免）
-  loadCredentials()
-  tryAutoLogin()
+  // loadCredentials 现为异步（AES 解密），须先恢复密码再触发自动登录
+  void (async () => {
+    await loadCredentials()
+    tryAutoLogin()
+  })()
 })
 
 // 勾选自动登录时隐含记住密码（自动登录依赖已存密码）；反之取消记住密码则取消自动登录
diff --git a/frontend-vue/src/shared/composables/useTaskProgressLoop.ts b/frontend-vue/src/shared/composables/useTaskProgressLoop.ts
index 7d8f85d4..14c623bf 100644
--- a/frontend-vue/src/shared/composables/useTaskProgressLoop.ts
+++ b/frontend-vue/src/shared/composables/useTaskProgressLoop.ts
@@ -252,7 +252,9 @@ export function useTaskProgressLoop<TDetail>(
       }
       await refreshOnce()
       if (!disposed && taskIds.value.length > 0) {
-        pollTimer = timers.setTimeout('task-poll', run, intervalMs())
+        // 连续失败时按指数退避拉长间隔，避免后端故障时每 5s 撞一次（成功即复位）
+        const delay = failureCount > 0 ? getTaskPollBackoffMs(failureCount) : intervalMs()
+        pollTimer = timers.setTimeout('task-poll', run, delay)
       }
     }
 
@@ -322,7 +324,8 @@ export function useTaskProgressLoop<TDetail>(
       }
       void refreshOnce()
       if (!disposed && taskIds.value.length > 0) {
-        pollTimer = timers.setTimeout('task-poll', run, intervalMs())
+        const delay = failureCount > 0 ? getTaskPollBackoffMs(failureCount) : intervalMs()
+        pollTimer = timers.setTimeout('task-poll', run, delay)
       }
     }
     pollTimer = timers.setTimeout('task-poll', run, delayMs)
diff --git a/frontend-vue/src/shared/utils/download-progress.ts b/frontend-vue/src/shared/utils/download-progress.ts
index b6d02586..57687962 100644
--- a/frontend-vue/src/shared/utils/download-progress.ts
+++ b/frontend-vue/src/shared/utils/download-progress.ts
@@ -30,6 +30,29 @@ type PywebviewDownloadProgressEvent = {
 const progressItems = reactive<Record<string, DownloadProgressItem>>({})
 let progressListenerBound = false
 
+/** 终态条目自动清理延迟：success/failed 未手动关闭也只保留 2 分钟，防长驻累积 */
+const TERMINAL_RETENTION_MS = 2 * 60 * 1000
+let sweepTimer: ReturnType<typeof setInterval> | null = null
+
+function sweepTerminalItems() {
+  const cutoff = now() - TERMINAL_RETENTION_MS
+  for (const id of Object.keys(progressItems)) {
+    const item = progressItems[id]
+    if ((item.status === 'success' || item.status === 'failed') && item.updatedAt <= cutoff) {
+      delete progressItems[id]
+    }
+  }
+  if (Object.keys(progressItems).length === 0 && sweepTimer) {
+    clearInterval(sweepTimer)
+    sweepTimer = null
+  }
+}
+
+function ensureSweepTimer() {
+  if (sweepTimer || typeof window === 'undefined') return
+  sweepTimer = setInterval(sweepTerminalItems, 30 * 1000)
+}
+
 function normalizePercent(value: number) {
   if (!Number.isFinite(value)) return 0
   return Math.max(0, Math.min(100, Math.round(value)))
@@ -40,6 +63,7 @@ function now() {
 }
 
 function upsertProgress(partial: Omit<Partial<DownloadProgressItem>, 'id'> & { id: string }) {
+  ensureSweepTimer()
   const existing = progressItems[partial.id]
   const timestamp = now()
   progressItems[partial.id] = {
@@ -74,9 +98,7 @@ export function ensureDownloadProgressListener() {
   if (progressListenerBound || typeof window === 'undefined') return
   progressListenerBound = true
   window.addEventListener('pywebview-download-progress', handlePywebviewProgress)
-}
-
-export function useDownloadProgress() {
+}export function useDownloadProgress() {
   ensureDownloadProgressListener()
   const items = computed(() =>
     Object.values(progressItems)