fix(auth): disable fixed SMS codes in prod

2026-07-14 16:31:14 +08:00
parent 8b49564d66
commit ad0a9e1d98
4 changed files with 33 additions and 5 deletions
@@ -0,0 +1,27 @@
+package org.dromara.web.controller;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("dev")
+class CaptchaControllerSecurityTest {
+
+    @Test
+    void fixedSmsCodeIsDisabledInProdWithoutOverride() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/web/controller/CaptchaController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-admin/src/main/java/org/dromara/web/controller/CaptchaController.java");
+        }
+        String code = Files.readString(source);
+
+        assertTrue(code.contains("!environment.acceptsProfiles(Profiles.of(\"prod\"))"));
+        assertFalse(code.contains("smsDemoFixedCodeEnabled"));
+        assertFalse(code.contains("demo-fixed-code-enabled"));
+    }
+}