shaw
bc3acd6e28
fix(auth): 收紧注册别名查重(根点绕过 / 误拒 / 无界扫描 / 并发竞态)
对 #4814 的审计跟进修复:
- 域名尾随点绕过:[email protected]. 的域名不在 gmail 家族名单内,点号折叠与
googlemail 归一被整体跳过,别名刷号原样可复现。归一化入口统一去掉 FQDN 根点。
- 误拒合法用户:剥 "+后缀" 缺空串守卫,+alice@ 与 +bob@ 都折叠成 @domain,
该域后续 "+x@" 注册会永久 EMAIL_EXISTS 且无自助恢复。改为仅当 "+" 不在首位时剥离。
- 无界不可索引全表扫描:原实现按 LOWER(email) LIKE '%@domain' 把整域邮箱读进内存,
且挂在公开未鉴权的 send-verify-code 上。改为按去点邮箱
REPLACE(LOWER(TRIM(email)), '.', '') 做等值 + "local+%@domain" 前缀探针并带 LIMIT,
新增同表达式的部分索引(migrations/190)。TRIM 口径与既有精确匹配一致,
历史带首尾空白的行同样命中;LIKE 元字符转义,% 与 _ 不会扩大匹配面。
- 并发竞态:注册改走 CreateWithEmailAliasGuard,在邮箱唯一性锁上追加收件箱身份锁并在
锁内复查,避免同一收件箱的多个别名变体同时通过服务层前置查重。管理员建号仍走
Create,不受别名限制。
- 能力断言静默 fail-open:别名查重方法上提到 UserRepository 端口(编译期强制),
移除可选接口类型断言与静默降级分支。
- OAuth 邮箱注册的两条建号路径(同样发放注册赠额)纳入同一查重口径;邮箱换绑/绑定
不纳入,否则用户把邮箱改成自己收件箱的别名会被误拒。
2026-07-25 19:40:53 +08:00
..
2026-07-18 19:17:53 +08:00
2026-07-23 15:50:44 +08:00
2026-07-16 19:57:48 +08:00
2026-07-17 19:15:16 +08:00
2026-07-15 20:30:23 +08:00
2026-07-15 20:30:23 +08:00
2026-07-17 22:10:18 +08:00
2026-07-23 15:50:44 +08:00
2026-07-18 21:05:50 +08:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-19 12:17:52 +08:00
2026-07-25 12:50:46 +08:00
2026-07-17 20:59:29 +08:00
2026-07-23 15:50:44 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 19:40:53 +08:00
2026-07-16 15:37:35 +08:00
2026-07-23 09:19:25 +08:00
2026-07-23 09:19:25 +08:00
2026-07-25 19:40:53 +08:00
2026-07-15 23:58:46 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 12:50:46 +08:00
2026-07-19 12:17:31 +08:00
2026-07-15 04:28:55 -05:00
2026-07-25 12:50:46 +08:00
2026-07-16 15:37:35 +08:00
2026-07-18 15:35:30 +08:00
2026-07-18 21:43:54 +08:00
2026-07-18 21:43:54 +08:00
2026-07-25 12:50:46 +08:00
2026-07-21 11:16:04 +08:00
2026-07-25 12:50:46 +08:00
2026-07-21 11:02:43 +08:00
2026-07-20 11:15:37 +08:00
2026-07-16 13:47:50 +08:00
2026-07-23 16:43:18 +08:00
2026-07-23 16:43:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-20 15:20:51 +08:00
2026-07-20 15:20:51 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-25 11:22:42 +08:00
2026-07-15 10:03:38 -07:00
2026-07-25 11:22:42 +08:00
2026-07-18 13:53:36 +08:00
2026-07-18 13:53:36 +08:00
2026-07-16 16:30:19 +08:00
2026-07-21 11:55:38 +08:00
2026-07-21 11:55:38 +08:00
2026-07-16 16:30:19 +08:00
2026-07-16 16:30:19 +08:00
2026-07-23 11:18:10 +08:00
2026-07-23 11:18:10 +08:00
2026-07-15 09:35:34 -07:00
2026-07-25 11:22:42 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:52 +08:00
2026-07-23 09:20:18 +08:00
2026-07-25 19:40:53 +08:00
2026-07-15 23:58:46 +08:00
2026-07-23 15:50:44 +08:00
2026-07-23 15:50:44 +08:00
2026-07-18 20:41:12 +08:00
2026-07-25 15:37:06 +08:00
2026-07-25 15:37:05 +08:00
2026-07-16 15:45:22 +08:00
2026-07-16 15:45:22 +08:00
2026-07-20 21:00:29 +08:00
2026-07-20 21:00:29 +08:00
2026-07-20 20:40:08 +08:00
2026-07-20 20:40:08 +08:00
2026-07-25 15:37:05 +08:00
2026-07-17 22:10:18 +08:00
2026-07-17 22:10:18 +08:00
2026-07-17 22:10:18 +08:00
2026-07-20 22:43:11 +08:00
2026-07-23 09:20:18 +08:00
2026-07-17 21:59:57 +08:00
2026-07-17 21:59:57 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:52 +08:00
2026-07-16 15:45:22 +08:00
2026-07-25 15:37:05 +08:00
2026-07-23 10:26:58 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 03:00:26 +08:00
2026-07-24 02:42:23 +08:00
2026-07-18 15:35:30 +08:00
2026-07-24 02:42:23 +08:00
2026-07-17 22:10:18 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-20 10:40:18 +08:00
2026-07-22 13:32:35 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-19 12:17:52 +08:00
2026-07-19 12:17:52 +08:00
2026-07-19 12:17:42 +08:00
2026-07-19 12:17:42 +08:00
2026-07-19 22:40:58 +08:00
2026-07-19 22:40:58 +08:00
2026-07-15 09:40:08 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-18 14:37:25 +08:00
2026-07-18 14:37:25 +08:00
2026-07-16 18:18:28 +08:00
2026-07-25 12:50:46 +08:00
2026-07-15 23:58:46 +08:00
2026-07-15 23:58:46 +08:00
2026-07-17 15:07:41 +08:00
2026-07-16 00:16:21 +08:00
2026-07-17 15:07:41 +08:00
2026-07-20 15:20:51 +08:00
2026-07-20 15:20:51 +08:00
2026-07-15 19:57:37 -07:00
2026-07-15 19:57:37 -07:00
2026-07-15 19:57:37 -07:00
2026-07-19 00:56:21 -07:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-15 09:35:34 -07:00
2026-07-19 11:39:20 +08:00
2026-07-19 11:23:26 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-23 15:50:44 +08:00
2026-07-25 18:34:37 +08:00
2026-07-25 18:34:37 +08:00
2026-07-15 22:52:35 +08:00
2026-07-15 22:52:35 +08:00
2026-07-25 05:31:31 +08:00
2026-07-25 15:37:05 +08:00
2026-07-15 22:52:35 +08:00
2026-07-20 16:12:56 +08:00
2026-07-23 00:12:28 +08:00
2026-07-20 21:44:42 +08:00
2026-07-16 00:40:46 +08:00
2026-07-23 00:12:28 +08:00
2026-07-17 08:44:23 +08:00
2026-07-17 18:12:33 +08:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-20 15:30:31 +08:00
2026-07-20 15:30:31 +08:00
2026-07-20 18:49:24 +08:00
2026-07-24 20:15:58 +08:00
2026-07-19 22:28:49 +08:00
2026-07-17 18:12:33 +08:00
2026-07-15 23:58:46 +08:00
2026-07-15 23:58:46 +08:00
2026-07-15 13:01:16 +08:00
2026-07-15 13:01:16 +08:00
2026-07-25 01:40:26 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-19 19:48:25 +08:00
2026-07-19 19:48:25 +08:00
2026-07-19 12:17:23 +08:00
2026-07-19 12:17:23 +08:00
2026-07-25 13:42:35 +08:00
2026-07-21 15:22:12 +08:00
2026-07-17 16:59:40 +08:00
2026-07-24 01:22:34 +08:00
2026-07-21 15:22:12 +08:00
2026-07-22 13:32:35 +08:00
2026-07-20 16:12:56 +08:00
2026-07-25 14:32:18 +08:00
2026-07-22 12:15:48 +08:00
2026-07-22 12:15:48 +08:00
2026-07-25 14:32:18 +08:00
2026-07-15 14:07:01 +08:00
2026-07-20 11:39:37 +08:00
2026-07-17 22:10:18 +08:00
2026-07-23 00:12:28 +08:00
2026-07-22 16:49:31 +08:00
2026-07-19 18:50:33 +08:00
2026-07-20 16:29:12 +08:00
2026-07-19 18:50:33 +08:00
2026-07-23 00:12:28 +08:00
2026-07-24 01:22:34 +08:00
2026-07-16 00:23:40 -07:00
2026-07-23 00:12:28 +08:00
2026-07-25 12:50:46 +08:00
2026-07-22 13:32:35 +08:00
2026-07-24 01:22:34 +08:00
2026-07-16 17:11:00 +08:00
2026-07-17 18:12:33 +08:00
2026-07-17 08:44:23 +08:00
2026-07-17 18:12:33 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 15:15:59 +08:00
2026-07-25 12:51:20 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 15:15:59 +08:00
2026-07-24 02:59:32 +08:00
2026-07-22 16:46:29 +08:00
2026-07-23 00:12:28 +08:00
2026-07-23 00:12:28 +08:00
2026-07-15 18:30:16 +08:00
2026-07-15 18:30:16 +08:00
2026-07-21 11:16:04 +08:00
2026-07-21 11:16:04 +08:00
2026-07-16 00:19:20 +08:00
2026-07-25 01:40:26 +08:00
2026-07-15 22:23:57 +08:00
2026-07-15 22:23:57 +08:00
2026-07-24 02:59:32 +08:00
2026-07-24 02:59:32 +08:00
2026-07-24 02:59:32 +08:00
2026-07-15 22:37:30 +08:00
2026-07-15 21:20:41 +08:00
2026-07-18 03:24:04 +08:00
2026-07-25 15:37:06 +08:00
2026-07-25 15:37:05 +08:00
2026-07-15 22:15:44 +08:00
2026-07-18 19:17:53 +08:00
2026-07-16 17:11:00 +08:00
2026-07-21 11:02:43 +08:00
2026-07-21 05:02:30 -07:00
2026-07-24 02:59:32 +08:00
2026-07-15 22:52:35 +08:00
2026-07-15 22:52:35 +08:00
2026-07-16 17:11:00 +08:00
2026-07-21 11:02:43 +08:00
2026-07-20 10:47:05 +08:00
2026-07-22 13:32:35 +08:00
2026-07-15 22:52:35 +08:00
2026-07-21 11:02:43 +08:00
2026-07-18 19:17:53 +08:00
2026-07-15 23:58:46 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:42:16 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-19 11:23:26 +08:00
2026-07-19 11:39:20 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 03:24:04 +08:00
2026-07-15 11:17:45 +08:00
2026-07-15 11:17:45 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-23 22:43:36 +08:00
2026-07-25 13:41:40 +08:00
2026-07-15 23:58:46 +08:00
2026-07-18 15:35:30 +08:00
2026-07-18 20:41:12 +08:00
2026-07-17 22:10:18 +08:00
2026-07-16 13:47:50 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-17 22:10:18 +08:00
2026-07-16 00:11:17 +08:00
2026-07-17 22:10:18 +08:00
2026-07-15 13:24:08 +08:00
2026-07-21 03:07:01 +08:00
2026-07-16 13:47:50 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-18 10:46:42 +08:00
2026-07-20 00:09:11 +08:00
2026-07-20 00:09:11 +08:00
2026-07-20 00:09:11 +08:00
2026-07-20 00:09:11 +08:00
2026-07-20 00:09:00 +08:00
2026-07-18 14:42:22 +08:00
2026-07-19 21:37:26 +08:00
2026-07-18 14:42:22 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-16 16:49:08 +08:00
2026-07-16 16:49:08 +08:00
2026-07-17 20:59:29 +08:00
2026-07-17 20:59:29 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-25 15:16:05 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-18 14:42:22 +08:00
2026-07-19 21:37:26 +08:00
2026-07-19 21:37:26 +08:00
2026-07-23 15:50:44 +08:00