fix(security): 全面清除泛目录PHP木马与暗链劫持代码，恢复前端静态资源纯净度并建立回归测试

tests/test_malware_cleanup.py

@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+木马暗链清除与代码完整性回归测试 (Malware Cleanup & Integrity Test)
+严格 TDD 模式：确保全站无任何 jscdn.top 劫持暗链与 PHP 不死马
+"""
+import os
+import unittest
+
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+class MalwareCleanupTest(unittest.TestCase):
+
+    def test_no_jscdn_top_in_codebase(self):
+        """测试全站源码与静态资产无 jscdn.top 暗链"""
+        infected_files = []
+        ignore_dirs = {'.git', 'runtime', 'tests', '.gemini'}
+
+        for root, dirs, files in os.walk(BASE_DIR):
+            dirs[:] = [d for d in dirs if d not in ignore_dirs]
+            for f in files:
+                file_path = os.path.join(root, f)
+                try:
+                    with open(file_path, 'r', encoding='utf-8', errors='ignore') as fp:
+                        content = fp.read()
+                        if 'jscdn.top' in content:
+                            rel_path = os.path.relpath(file_path, BASE_DIR)
+                            infected_files.append(rel_path)
+                except Exception:
+                    pass
+
+        self.assertEqual(
+            infected_files,
+            [],
+            f"发现仍然含有 jscdn.top 恶意暗链的文件: {infected_files[:10]} (共 {len(infected_files)} 个)"
+        )
+
+    def test_no_suspicious_php_in_public_static_dirs(self):
+        """测试 public 静态资源目录（assets、images、template）无非法 PHP 木马文件"""
+        static_folders = [
+            os.path.join(BASE_DIR, 'public', 'assets'),
+            os.path.join(BASE_DIR, 'public', 'images'),
+            os.path.join(BASE_DIR, 'public', 'template'),
+        ]
+        found_php = []
+        for folder in static_folders:
+            if not os.path.exists(folder):
+                continue
+            for root, dirs, files in os.walk(folder):
+                for f in files:
+                    if f.lower().endswith('.php'):
+                        rel_path = os.path.relpath(os.path.join(root, f), BASE_DIR)
+                        found_php.append(rel_path)
+
+        self.assertEqual(
+            found_php,
+            [],
+            f"静态目录中严禁存在 PHP 木马文件: {found_php}"
+        )
+
+    def test_no_nested_malware_directories(self):
+        """测试 public 目录下不存在恶意递归嵌套目录"""
+        nested_images = os.path.join(BASE_DIR, 'public', 'images', 'images')
+        nested_template = os.path.join(BASE_DIR, 'public', 'template', 'template')
+
+        self.assertFalse(os.path.exists(nested_images), "public/images/images 木马嵌套目录必须已被彻底删除")
+        self.assertFalse(os.path.exists(nested_template), "public/template/template 木马嵌套目录必须已被彻底删除")
+
+    def test_key_js_files_integrity(self):
+        """测试核心引用的 JS 库文件首行干净"""
+        key_files = [
+            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery-1.7.2.min.js'),
+            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery.SuperSlide.js'),
+            os.path.join(BASE_DIR, 'public', 'assets', 'addons', 'official', 'js', 'jquery.online.js'),
+        ]
+
+        for p in key_files:
+            self.assertTrue(os.path.exists(p), f"核心库文件丢失: {p}")
+            with open(p, 'r', encoding='utf-8', errors='ignore') as fp:
+                first_line = fp.readline()
+                self.assertNotIn('createElement', first_line, f"{p} 首行不能包含动态 script 注入")
+                self.assertNotIn('jscdn.top', first_line, f"{p} 首行不能包含恶意域名")
+
+if __name__ == '__main__':
+    unittest.main()