H2u8s
Results
1
issues of
H2u8s
## 版本信息(Version) ≤4.2511.0 ## 问题描述(Describe) sqle 存在硬编码的JWT鉴权密钥以及合法有效的JWT凭证 sqle contains a hard-coded JWT authentication key and a valid JWT credential. ## 截图或日志(Log) https://github.com/actiontech/sqle/blob/main/sqle/utils/jwt.go#L9 https://github.com/actiontech/sqle/blob/main/vendor/github.com/actiontech/dms/internal/dms/pkg/constant/const.go#L53 https://github.com/actiontech/sqle/blob/main/vendor/github.com/actiontech/dms/pkg/dms-common/pkg/http/http.go#L18 ## 如何复现(To Reproduce) 1. 对于默认JWT密钥的问题,该系统只要部署之后,这里的JWT加密密钥就是[]byte("secret"),我们可以通过在线资源来验证这一点 Regarding...
bug