feat: 对接MeshSafe文件安全检测(上传/解包自动送检+轮询回写,不通过禁止分享传输,文件夹确认后仅分享通过内容,人工复核/重新检测,meshsafe.enabled总开关)

2026-11-01 20:29:31 +08:00
parent c5a262b3dd
commit 4c7dd207d0
30 changed files with 2000 additions and 6 deletions
--- a/docker-test/application-local.yml
+++ b/docker-test/application-local.yml
@@ -0,0 +1,118 @@
+server:
+  port: 8081
+
+spring:
+  application:
+    name: s-file
+  datasource:
+    url: jdbc:postgresql://127.0.0.1:54330/s_file
+    driver-class-name: org.postgresql.Driver
+    username: sfile
+    password: sfile123
+    druid:
+      initial-size: 2
+      min-idle: 2
+      max-active: 10
+      validation-query: SELECT 1
+  redis:
+    host: 127.0.0.1
+    port: 63800
+    timeout: 5000
+    lettuce:
+      pool:
+        max-active: 8
+        max-idle: 4
+  rabbitmq:
+    host: 127.0.0.1
+    port: 56730
+    username: sfile
+    password: sfile123
+  servlet:
+    multipart:
+      max-file-size: 500MB
+      max-request-size: 500MB
+  main:
+    allow-bean-definition-overriding: true
+
+mybatis-plus:
+  mapper-locations: classpath*:com/senmesh/**/mapper/*.xml
+
+# 平台编码(init-data 中 uc_platform.platform_code=1)
+system:
+  code: 1
+
+# 发号器雪花 workerId(键格式: code.snowflake.workid.<本机IP>,方括号与裸键双写兼容)
+"[code.snowflake.workid.192.168.71.85]": 1
+"[code.snowflake.workid.172.27.160.1]": 1
+"[code.snowflake.workid.172.28.16.1]": 1
+"[code.snowflake.workid.127.0.0.1]": 1
+code.snowflake.workid.192.168.71.85: 1
+code.snowflake.workid.172.27.160.1: 1
+code.snowflake.workid.172.28.16.1: 1
+code.snowflake.workid.127.0.0.1: 1
+
+security:
+  jwt:
+    enable: true
+    secret: sfile-local-test-secret-key-please-change-0123456789abcdef
+    expiration: 86400000
+    header: Authorization
+  ignoring: /error,/favicon.ico
+  login-page: /login
+  superior-only: false
+  use-local: true
+  allow-if-all-abstain-decisions: true
+  oauth2:
+    enable: false
+  not-logs: ""
+
+# 新用户初始密码
+user:
+  default:
+    password: Qaz123567!@#
+
+file:
+  upload-dir: D:/zcodedata/sfile/upload
+  storage:
+    type: local
+  transfer:
+    # 内网侧
+    location: "1"
+    send-dir: D:/zcodedata/sfile/transfer/send
+    receive-dir: D:/zcodedata/sfile/transfer/receive
+    unpack-risk-check: false
+
+dify:
+  risk:
+    rule:
+      api-key: test-rule-key
+    scan:
+      api-key: test-scan-key
+
+# MeshSafe 文件安全检测(对接本地 MeshSafe venv 实例,端口 48443)
+# enabled=false 完全关闭检测:不送检/不拦截/预检返回空/前端隐藏检测列
+meshsafe:
+  enabled: true
+  base-url: http://127.0.0.1:48443
+  client-id: test-client
+  secret: test-secret
+  channel: sfile-local
+  timeout-seconds: 120
+  fail-open: true
+  poll-timeout-minutes: 60
+  review-sync-to-meshsafe: true
+  poll:
+    cron: "0 */10 * * * ?"
+
+rabbitmq:
+  custom:
+    topic-exchange-name: s-file-local-topic
+    delayed-exchange-name: s-file-local-delayed
+    broadcast-id: s-file-local-broadcast
+
+swagger:
+  enable: true
+
+logging:
+  level:
+    com.senmesh: info