fix(auth): disable fixed SMS codes in prod

2026-07-14 16:31:14 +08:00
parent 8b49564d66
commit ad0a9e1d98
4 changed files with 33 additions and 5 deletions
@@ -62,14 +62,11 @@ public class CaptchaController {

    /**
     * 演示/开发兜底：配置后不真发短信，验证码固定为该值，把短信通道从演示关键路径摘掉。
-     * prod profile 仅在 aihr.sms.demo-fixed-code-enabled=true 时临时放行。
+     * prod profile 代码级禁用固定验证码，不接受配置开关绕过。
     */
    @Value("${aihr.sms.dev-fixed-code:}")
    private String smsDevFixedCode;

-    @Value("${aihr.sms.demo-fixed-code-enabled:false}")
-    private boolean smsDemoFixedCodeEnabled;
-
    private final Environment environment;

    /**
@@ -84,7 +81,7 @@ public class CaptchaController {
        @Pattern(regexp = RegexConstants.MOBILE, message = "{user.mobile.phone.number.not.valid}") String phonenumber) {
        String key = GlobalConstants.CAPTCHA_CODE_KEY + phonenumber;
        boolean fixedCodeEnabled = StringUtils.isNotBlank(smsDevFixedCode)
-            && (!environment.acceptsProfiles(Profiles.of("prod")) || smsDemoFixedCodeEnabled);
+            && !environment.acceptsProfiles(Profiles.of("prod"));
        if (fixedCodeEnabled) {
            log.warn("aihr.sms.dev-fixed-code 已启用，短信验证码走固定码，未真实发送短信");
            RedisUtils.setCacheObject(key, smsDevFixedCode, Duration.ofMinutes(Constants.CAPTCHA_EXPIRATION));
@@ -0,0 +1,27 @@
+package org.dromara.web.controller;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("dev")
+class CaptchaControllerSecurityTest {
+
+    @Test
+    void fixedSmsCodeIsDisabledInProdWithoutOverride() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/web/controller/CaptchaController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-admin/src/main/java/org/dromara/web/controller/CaptchaController.java");
+        }
+        String code = Files.readString(source);
+
+        assertTrue(code.contains("!environment.acceptsProfiles(Profiles.of(\"prod\"))"));
+        assertFalse(code.contains("smsDemoFixedCodeEnabled"));
+        assertFalse(code.contains("demo-fixed-code-enabled"));
+    }
+}