JimuReport v2.5.4：报表与数据大屏升级时，如何把双端安全加固真正落地

#!/usr/bin/env bash
set -euo pipefail

APP_HOME="/opt/jimureport"
BACKUP_ROOT="/var/backups/jimureport"
STAMP="$(date +%Y%m%d-%H%M%S)"
BACKUP_DIR="${BACKUP_ROOT}/${STAMP}"

mkdir -p "${BACKUP_DIR}"

# 按实际部署目录调整；不存在的目录会被跳过。
for item in config uploads templates; do
  if [ -e "${APP_HOME}/${item}" ]; then
    cp -a "${APP_HOME}/${item}" "${BACKUP_DIR}/"
  fi
done

# 示例：MySQL 用户应通过 ~/.my.cnf 或密钥管理系统提供密码，避免写入脚本。
# mysqldump --single-transaction jimureport > "${BACKUP_DIR}/jimureport.sql"

find "${BACKUP_DIR}" -type f -print0 \
  | sort -z \
  | xargs -0 sha256sum > "${BACKUP_DIR}/SHA256SUMS"

tar -C "${BACKUP_ROOT}" -czf "${BACKUP_DIR}.tar.gz" "${STAMP}"
echo "Backup created: ${BACKUP_DIR}.tar.gz"

upstream jimureport_backend {
    server 127.0.0.1:8080;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name report.example.com;

    ssl_certificate     /etc/nginx/tls/fullchain.pem;
    ssl_certificate_key /etc/nginx/tls/private.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    client_max_body_size 20m;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    # 启用前应在预发布环境验证图表、导出、打印和外部字体。
    # add_header Content-Security-Policy \
    #   "default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'" always;

    location / {
        proxy_pass http://jimureport_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_hide_header X-Powered-By;
    }
}

#!/usr/bin/env bash
set -euo pipefail

BASE_URL="https://report.example.com"
HEADER_FILE="$(mktemp)"
trap 'rm -f "$HEADER_FILE"' EXIT

curl --fail --silent --show-error \
  --max-time 15 \
  --dump-header "$HEADER_FILE" \
  --output /dev/null \
  "$BASE_URL/"

echo "== HTTP response =="
head -n 1 "$HEADER_FILE"

echo "== Security headers =="
for name in \
  strict-transport-security \
  content-security-policy \
  x-content-type-options \
  x-frame-options \
  referrer-policy; do
  if grep -qi "^${name}:" "$HEADER_FILE"; then
    grep -i "^${name}:" "$HEADER_FILE"
  else
    echo "MISSING: ${name}"
  fi
done

用户描述需求
  → 服务端确认用户身份与角色
  → 仅提供该角色允许访问的数据集元数据
  → AI 生成报表草稿
  → 校验字段、过滤条件、表达式和数据源引用
  → 用户预览并确认
  → 发布到指定目录或大屏