系统升级

app.py

@@ -1,5 +1,5 @@
 # ⚙️ 后端逻辑/核心服务端.py (Hugging Face Spaces app.py)
-from fastapi import FastAPI, File, UploadFile, Form, Depends, HTTPException
+from fastapi import FastAPI, File, UploadFile, Form, Depends, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import Response, JSONResponse, FileResponse 
 from sqlalchemy.orm import Session
@@ -385,10 +385,11 @@ def sanitize_audio_content(content: bytes, ext: str) -> bytes:
 
 
 @app.post("/api/upload")
-def upload_file(file: UploadFile = File(...), file_type: str = Form(...), current_user: str = Depends(require_auth)):
-    content = file.file.read() 
-    
+@limiter.limit("30/minute")  # 🔒 安全限流：防止刷存储（单次发布最多 9 图 + 1 JSON，阈值留足余量）
+def upload_file(request: Request, file: UploadFile = File(...), file_type: str = Form(...), current_user: str = Depends(require_auth)):
     # 🟢 动态文件大小风控
+    # 🔒 安全修复：上限必须先算出来。原实现是先把整个文件 read() 进内存再判大小，
+    # 超大文件会直接吃满容器内存（可被用于打挂服务），现改为分块读取、超限立即中止。
     max_size = 10 * 1024 * 1024  
     if file_type == "avatar":
         max_size = 2 * 1024 * 1024   
@@ -408,9 +409,20 @@ def upload_file(file: UploadFile = File(...), file_type: str = Form(...), curren
         max_size = 100 * 1024 * 1024
     elif file_type == "post_audio":
         max_size = 30 * 1024 * 1024   # 音乐提示词音频：30MB
-        
-    if len(content) > max_size:
-        raise HTTPException(status_code=400, detail=f"文件过大，{file_type} 类型请限制在 {max_size // (1024*1024)}MB 以内")
+
+    # 分块读取（1MB / 块），累计超限则马上报错，不再继续消耗内存与带宽
+    _CHUNK_SIZE = 1024 * 1024
+    _chunks = []
+    _received = 0
+    while True:
+        _chunk = file.file.read(_CHUNK_SIZE)
+        if not _chunk:
+            break
+        _received += len(_chunk)
+        if _received > max_size:
+            raise HTTPException(status_code=400, detail=f"文件过大，{file_type} 类型请限制在 {max_size // (1024*1024)}MB 以内")
+        _chunks.append(_chunk)
+    content = b"".join(_chunks)
         
     if not file.filename:
         raise HTTPException(status_code=400, detail="文件名不能为空")

router_comments.py

@@ -1,5 +1,5 @@
 # router_comments.py
-from fastapi import APIRouter, HTTPException, Depends
+from fastapi import APIRouter, HTTPException, Depends, Request
 import time
 import uuid
 from html import escape
@@ -8,6 +8,11 @@ from notifications import add_notification
 from models import InteractionToggle, CommentCreate
 from 安全认证 import require_auth, is_admin
 
+# 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+limiter = Limiter(key_func=get_remote_address)
+
 router = APIRouter()
 
 @router.post("/api/interactions/toggle")
@@ -57,7 +62,8 @@ async def toggle_interaction(interaction: InteractionToggle, current_user: str =
     return {"status": "success", "new_count": result_container["count"]}
 
 @router.post("/api/comments")
-async def post_comment(comment: CommentCreate, current_user: str = Depends(require_auth)):
+@limiter.limit("10/minute")  # 🔒 安全限流：防止刷评论洗版（正常用户不会一分钟发 10 条以上）
+async def post_comment(request: Request, comment: CommentCreate, current_user: str = Depends(require_auth)):
     comment.author = current_user  # 强制使用认证用户身份，防止伪造
     # 评论内容长度校验
     if not comment.content or len(comment.content) > 5000:

router_items.py

@@ -557,26 +557,33 @@ async def check_github_updates():
                 headers["Authorization"] = f"Bearer {active_token}"
             
             req = urllib.request.Request(api_url, headers=headers)
-            with urllib.request.urlopen(req, timeout=10) as response:
-                commits = json.loads(response.read().decode("utf-8"))
-                if commits and len(commits) > 0:
-                    latest_sha = commits[0].get("sha", "")[:7]  # 取前7位作为版本标识
-                    
-                    # 如果版本有变化，更新 versions.json
-                    # 🧹 P2修复（格式统一）：统一以新格式 dict 读写，保留 cached_at/zip_size 等缓存元字段；
-                    # 旧逻辑拿字符串与 dict 比较会把 dict 条目永远判为"有更新"并覆盖成字符串丢失元信息
-                    entry = versions_db.get(item_id)
-                    if isinstance(entry, str):
-                        entry = {"hash": entry}
-                    elif not isinstance(entry, dict):
-                        entry = {}
-                    old_version = entry.get("hash", "")
-                    if latest_sha and latest_sha != old_version:
-                        entry["hash"] = latest_sha
-                        versions_db[item_id] = entry
-                        updated_count += 1
-                        print(f"[版本更新] {item['title']}: {old_version} -> {latest_sha}")
-                        
+
+            # ⚡ 性能修复：urlopen 是同步阻塞调用（timeout=10），在 async 处理器里
+            # 逐个 item 串行等待会占死唯一的事件循环（N 个仓库最坏 N×10 秒全站无响应）；
+            # 抽成同步小函数交给线程池执行，异常仍由下方 except 分支按原样捕获。
+            def _fetch_commits():
+                with urllib.request.urlopen(req, timeout=10) as response:
+                    return json.loads(response.read().decode("utf-8"))
+
+            commits = await asyncio.to_thread(_fetch_commits)
+            if commits and len(commits) > 0:
+                latest_sha = commits[0].get("sha", "")[:7]  # 取前7位作为版本标识
+
+                # 如果版本有变化，更新 versions.json
+                # 🧹 P2修复（格式统一）：统一以新格式 dict 读写，保留 cached_at/zip_size 等缓存元字段；
+                # 旧逻辑拿字符串与 dict 比较会把 dict 条目永远判为"有更新"并覆盖成字符串丢失元信息
+                entry = versions_db.get(item_id)
+                if isinstance(entry, str):
+                    entry = {"hash": entry}
+                elif not isinstance(entry, dict):
+                    entry = {}
+                old_version = entry.get("hash", "")
+                if latest_sha and latest_sha != old_version:
+                    entry["hash"] = latest_sha
+                    versions_db[item_id] = entry
+                    updated_count += 1
+                    print(f"[版本更新] {item['title']}: {old_version} -> {latest_sha}")
+
         except urllib.error.HTTPError as e:
             print(f"[版本检查失败] {item.get('title', item_id)}: HTTP {e.code}")
         except Exception as e:

router_messages.py

@@ -1,6 +1,7 @@
 # router_messages.py
-from fastapi import APIRouter, HTTPException, Depends
+from fastapi import APIRouter, HTTPException, Depends, Request
 from pydantic import BaseModel
+import asyncio
 import time
 import uuid
 import subprocess
@@ -10,6 +11,11 @@ from notifications import add_notification
 from models import PrivateMessage
 from 安全认证 import require_auth, is_admin
 
+# 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+limiter = Limiter(key_func=get_remote_address)
+
 router = APIRouter()
 
 # ==========================================
@@ -107,7 +113,11 @@ async def run_admin_script(req: AdminScriptRequest, current_user: str = Depends(
         clean_env = {k: v for k, v in os.environ.items()
                      if not any(k.startswith(prefix) for prefix in sensitive_prefixes)}
         # 执行脚本，超时缩短至30秒
-        result = subprocess.run(
+        # ⚡ 性能修复：subprocess.run 会同步等待子进程结束（最长 30 秒），
+        # 在 async 处理器里直接调用会占死唯一的事件循环，脚本跑完前整个服务无法响应任何请求；
+        # 交给线程池执行，TimeoutExpired 等异常仍由下方原有 except 分支按原样处理。
+        result = await asyncio.to_thread(
+            subprocess.run,
             ["python", script_path],
             capture_output=True,
             text=True,
@@ -150,7 +160,8 @@ async def run_admin_script(req: AdminScriptRequest, current_user: str = Depends(
 # 原有功能：私信与聊天
 # ==========================================
 @router.post("/api/messages/private")
-async def send_private_message(msg: PrivateMessage, current_user: str = Depends(require_auth)):
+@limiter.limit("30/minute")  # 🔒 安全限流：防止私信骚扰/刷屏（聊天节奏快，阈值比发帖宽松）
+async def send_private_message(request: Request, msg: PrivateMessage, current_user: str = Depends(require_auth)):
     msg.sender = current_user  # 强制发送者身份，防止伪造
     
     # 验证接收者存在

router_posts.py

@@ -5,7 +5,7 @@
 # 功能：帖子发布、列表、详情、互动（点赞/收藏/评论/打赏）
 # ==========================================
 
-from fastapi import APIRouter, HTTPException, Depends
+from fastapi import APIRouter, HTTPException, Depends, Request
 from sqlalchemy.orm import Session
 from models import PostCreate, PostUpdate, RatingRequest
 import 数据库连接 as db
@@ -20,6 +20,11 @@ import hashlib
 import datetime
 import logging
 
+# 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+limiter = Limiter(key_func=get_remote_address)
+
 router = APIRouter()
 
 # ==========================================
@@ -144,7 +149,8 @@ async def get_post_detail(post_id: str):
     raise HTTPException(status_code=404, detail="帖子不存在")
 
 @router.post("/api/posts")
-async def create_post(post: PostCreate, current_user: str = Depends(require_auth)):
+@limiter.limit("5/minute")  # 🔒 安全限流：防止刷帖洗版（一次发布含多图上传，但建帖只调一次）
+async def create_post(request: Request, post: PostCreate, current_user: str = Depends(require_auth)):
     """
     发布帖子
     """

router_users_auth.py

@@ -144,9 +144,12 @@ async def send_code_api(request: Request, req: SendCodeRequest):
     }
     
     # 同步发送（会阻塞等待结果）
+    # ⚡ 性能修复：send_email_code 内部走 SMTP 同步连接（最长可阻塞十秒级），
+    # 直接在 async 处理器里调用会占死唯一的事件循环，导致整个服务期间无法响应任何请求；
+    # 改由 asyncio.to_thread 丢到线程池执行，等待结果的同时不阻塞其他请求。
     if req.contact_type == "email":
         try:
-            send_email_code(req.contact, code, req.action_type)
+            await asyncio.to_thread(send_email_code, req.contact, code, req.action_type)
             return {"status": "success", "message": "验证码已成功发送至邮箱"}
         except Exception as e:
             # 🔒 P0安全修复：仅服务端记录详细错误，不暴露给前端

verify_code_engine.py

@@ -34,6 +34,31 @@ _last_cleanup_time = 0
 _CLEANUP_INTERVAL = 300  # 5分钟清理一次
 
 
+# ==========================================
+# 🔒 日志脱敏工具
+# ==========================================
+# 作用：HF Spaces 的运行日志对外可见，验证码与联系方式明文入日志等同于泄露账号
+# 关联：云端/本地判据与 数据库连接.py 保持一致（HF Spaces 会注入 SPACE_ID）
+_IS_CLOUD = bool(os.environ.get("SPACE_ID"))
+
+
+def _mask_contact(contact: str) -> str:
+    """
+    🔒 联系方式脱敏（邮箱 / 手机号统一处理），仅用于日志输出
+    参数：contact - 原始邮箱或手机号
+    返回：脱敏后的字符串，保留足够辨识度以便排障，但不足以定位到具体用户
+    """
+    if not contact:
+        return ""
+    contact = str(contact)
+    if "@" in contact:
+        name, _, domain = contact.partition("@")
+        return f"{name[:1]}***@{domain}" if len(name) > 1 else f"***@{domain}"
+    if len(contact) >= 7:
+        return contact[:3] + "****" + contact[-2:]
+    return "***"
+
+
 def check_send_cooldown(contact: str):
     """
     🔒 检查发送频率限制
@@ -148,7 +173,8 @@ def send_email_code(to_email: str, code: str, action: str):
     )
     try:
         with urllib.request.urlopen(req, timeout=10) as response:
-            print(f"✅ 成功触发 Webhook 发送验证码 {code} 至 {to_email}")
+            # 🔒 安全修复：不再打印验证码与邮箱明文（日志对外可见），仅留脱敏标识与动作类型
+            print(f"✅ 成功触发 Webhook 发送验证码邮件至 {_mask_contact(to_email)}（动作: {action}）")
     except Exception as e:
         print(f"❌ Webhook 触发失败: {e}")
 
@@ -198,7 +224,7 @@ def send_sms_code(phone: str, code: str, action: str):
         req.add_header("Authorization", f"Basic {auth}")
         try:
             with urllib.request.urlopen(req, timeout=10) as response:
-                print(f"✅ Twilio 短信已成功下发至 {phone}")
+                print(f"✅ Twilio 短信已成功下发至 {_mask_contact(phone)}")
         except Exception as e:
             print(f"❌ Twilio 发送失败: {e}")
         return
@@ -239,7 +265,7 @@ def send_sms_code(phone: str, code: str, action: str):
         try:
             response = client.send_sms(send_req)
             if response.body.code == "OK":
-                print(f"✅ 阿里云短信已成功下发至 {phone}")
+                print(f"✅ 阿里云短信已成功下发至 {_mask_contact(phone)}")
             else:
                 print(f"❌ 阿里云下发失败: {response.body.message}")
         except Exception as e:
@@ -250,4 +276,9 @@ def send_sms_code(phone: str, code: str, action: str):
     # 降级模式：控制台打印模拟
     # ==========================================
     # 作用：当没有配置任何短信服务时，仅在控制台打印验证码（仅限开发测试）
-    print(f"⚠️ 未配置短信秘钥，模拟下发 -> 手机号: {phone}, 验证码: {code}")
+    # 🔒 P0安全修复：云端日志对外可见，生产环境绝不能打印验证码明文；
+    # 本地开发（无 SPACE_ID）保留原行为，不影响调试便利性。
+    if _IS_CLOUD:
+        print(f"⚠️ 未配置短信密钥，验证码未实际下发（目标: {_mask_contact(phone)}）")
+    else:
+        print(f"⚠️ 未配置短信密钥，模拟下发 -> 手机号: {phone}, 验证码: {code}")