fix: 보안 취약점 수정 및 XSS 방지 적용
## 백엔드 보안 수정 - 하드코딩된 비밀번호 및 JWT 시크릿 폴백 제거 - SQL Injection 방지를 위한 화이트리스트 검증 추가 - 인증 미적용 API 라우트에 requireAuth 미들웨어 적용 - CSRF 보호 미들웨어 구현 (csrf.js) - 파일 업로드 보안 유틸리티 추가 (fileUploadSecurity.js) - 비밀번호 정책 검증 유틸리티 추가 (passwordValidator.js) ## 프론트엔드 XSS 방지 - api-base.js에 전역 escapeHtml() 함수 추가 - 17개 주요 JS 파일에 escapeHtml 적용: - tbm.js, daily-patrol.js, daily-work-report.js - task-management.js, workplace-status.js - equipment-detail.js, equipment-management.js - issue-detail.js, issue-report.js - vacation-common.js, worker-management.js - safety-report-list.js, nonconformity-list.js - project-management.js, workplace-management.js ## 정리 - 백업 폴더 및 빈 파일 삭제 - SECURITY_GUIDE.md 문서 추가 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Hyungi Ahn
@@ -12,151 +12,123 @@ const { getDb } = require('../dbPool');
|
||||
/**
|
||||
* 작업 생성
|
||||
*/
|
||||
const createTask = async (taskData, callback) => {
|
||||
try {
|
||||
const db = await getDb();
|
||||
const { work_type_id, task_name, description } = taskData;
|
||||
const createTask = async (taskData) => {
|
||||
const db = await getDb();
|
||||
const { work_type_id, task_name, description } = taskData;
|
||||
|
||||
const [result] = await db.query(
|
||||
`INSERT INTO tasks (work_type_id, task_name, description, is_active)
|
||||
VALUES (?, ?, ?, 1)`,
|
||||
[work_type_id || null, task_name, description || null]
|
||||
);
|
||||
const [result] = await db.query(
|
||||
`INSERT INTO tasks (work_type_id, task_name, description, is_active)
|
||||
VALUES (?, ?, ?, 1)`,
|
||||
[work_type_id || null, task_name, description || null]
|
||||
);
|
||||
|
||||
callback(null, result.insertId);
|
||||
} catch (err) {
|
||||
callback(err);
|
||||
}
|
||||
return result.insertId;
|
||||
};
|
||||
|
||||
/**
|
||||
* 전체 작업 목록 조회 (공정 정보 포함)
|
||||
*/
|
||||
const getAllTasks = async (callback) => {
|
||||
try {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description, t.is_active,
|
||||
t.created_at, t.updated_at,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
ORDER BY wt.category ASC, t.task_id DESC`
|
||||
);
|
||||
callback(null, rows);
|
||||
} catch (err) {
|
||||
callback(err);
|
||||
}
|
||||
const getAllTasks = async () => {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description, t.is_active,
|
||||
t.created_at, t.updated_at,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
ORDER BY wt.category ASC, t.task_id DESC`
|
||||
);
|
||||
return rows;
|
||||
};
|
||||
|
||||
/**
|
||||
* 활성 작업만 조회
|
||||
*/
|
||||
const getActiveTasks = async (callback) => {
|
||||
try {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
WHERE t.is_active = 1
|
||||
ORDER BY wt.category ASC, t.task_name ASC`
|
||||
);
|
||||
callback(null, rows);
|
||||
} catch (err) {
|
||||
callback(err);
|
||||
}
|
||||
const getActiveTasks = async () => {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
WHERE t.is_active = 1
|
||||
ORDER BY wt.category ASC, t.task_name ASC`
|
||||
);
|
||||
return rows;
|
||||
};
|
||||
|
||||
/**
|
||||
* 공정별 작업 목록 조회
|
||||
*/
|
||||
const getTasksByWorkType = async (workTypeId, callback) => {
|
||||
try {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description, t.is_active,
|
||||
t.created_at, t.updated_at,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
WHERE t.work_type_id = ?
|
||||
ORDER BY t.task_id DESC`,
|
||||
[workTypeId]
|
||||
);
|
||||
callback(null, rows);
|
||||
} catch (err) {
|
||||
callback(err);
|
||||
}
|
||||
const getTasksByWorkType = async (workTypeId) => {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description, t.is_active,
|
||||
t.created_at, t.updated_at,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
WHERE t.work_type_id = ?
|
||||
ORDER BY t.task_id DESC`,
|
||||
[workTypeId]
|
||||
);
|
||||
return rows;
|
||||
};
|
||||
|
||||
/**
|
||||
* 단일 작업 조회
|
||||
*/
|
||||
const getTaskById = async (taskId, callback) => {
|
||||
try {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description, t.is_active,
|
||||
t.created_at, t.updated_at,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
WHERE t.task_id = ?`,
|
||||
[taskId]
|
||||
);
|
||||
callback(null, rows[0] || null);
|
||||
} catch (err) {
|
||||
callback(err);
|
||||
}
|
||||
const getTaskById = async (taskId) => {
|
||||
const db = await getDb();
|
||||
const [rows] = await db.query(
|
||||
`SELECT t.task_id, t.work_type_id, t.task_name, t.description, t.is_active,
|
||||
t.created_at, t.updated_at,
|
||||
wt.name as work_type_name, wt.category
|
||||
FROM tasks t
|
||||
LEFT JOIN work_types wt ON t.work_type_id = wt.id
|
||||
WHERE t.task_id = ?`,
|
||||
[taskId]
|
||||
);
|
||||
return rows[0] || null;
|
||||
};
|
||||
|
||||
/**
|
||||
* 작업 수정
|
||||
*/
|
||||
const updateTask = async (taskId, taskData, callback) => {
|
||||
try {
|
||||
const db = await getDb();
|
||||
const { work_type_id, task_name, description, is_active } = taskData;
|
||||
const updateTask = async (taskId, taskData) => {
|
||||
const db = await getDb();
|
||||
const { work_type_id, task_name, description, is_active } = taskData;
|
||||
|
||||
const [result] = await db.query(
|
||||
`UPDATE tasks
|
||||
SET work_type_id = ?,
|
||||
task_name = ?,
|
||||
description = ?,
|
||||
is_active = ?,
|
||||
updated_at = NOW()
|
||||
WHERE task_id = ?`,
|
||||
[
|
||||
work_type_id || null,
|
||||
task_name,
|
||||
description || null,
|
||||
is_active !== undefined ? is_active : 1,
|
||||
taskId
|
||||
]
|
||||
);
|
||||
const [result] = await db.query(
|
||||
`UPDATE tasks
|
||||
SET work_type_id = ?,
|
||||
task_name = ?,
|
||||
description = ?,
|
||||
is_active = ?,
|
||||
updated_at = NOW()
|
||||
WHERE task_id = ?`,
|
||||
[
|
||||
work_type_id || null,
|
||||
task_name,
|
||||
description || null,
|
||||
is_active !== undefined ? is_active : 1,
|
||||
taskId
|
||||
]
|
||||
);
|
||||
|
||||
callback(null, result);
|
||||
} catch (err) {
|
||||
callback(err);
|
||||
}
|
||||
return result;
|
||||
};
|
||||
|
||||
/**
|
||||
* 작업 삭제
|
||||
*/
|
||||
const deleteTask = async (taskId, callback) => {
|
||||
try {
|
||||
const db = await getDb();
|
||||
const [result] = await db.query(
|
||||
`DELETE FROM tasks WHERE task_id = ?`,
|
||||
[taskId]
|
||||
);
|
||||
callback(null, result);
|
||||
} catch (err) {
|
||||
callback(err);
|
||||
}
|
||||
const deleteTask = async (taskId) => {
|
||||
const db = await getDb();
|
||||
const [result] = await db.query(
|
||||
`DELETE FROM tasks WHERE task_id = ?`,
|
||||
[taskId]
|
||||
);
|
||||
return result;
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
|
||||
Reference in New Issue
Block a user