fix(security): 全面清除泛目录PHP木马与暗链劫持代码，恢复前端静态资源纯净度并建立回归测试

tools/clean_malware.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+自动化木马清理与静态代码脱毒清洗工具
+"""
+import os
+import shutil
+
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+MALICIOUS_JS_INJECTION = ""
+MALICIOUS_HTML_INJECTION = ''
+
+def remove_malware_directories():
+    """清理恶意生成的递归目录"""
+    dirs_to_remove = [
+        os.path.join(BASE_DIR, 'public', 'images', 'images'),
+        os.path.join(BASE_DIR, 'public', 'template', 'template'),
+    ]
+    for d in dirs_to_remove:
+        if os.path.exists(d):
+            print(f"Removing malicious directory: {d}")
+            shutil.rmtree(d, ignore_errors=True)
+
+def remove_malware_php_files():
+    """清理 public 静态目录下的 PHP 木马与后门文件"""
+    search_dirs = [
+        os.path.join(BASE_DIR, 'public', 'assets'),
+        os.path.join(BASE_DIR, 'public', 'images'),
+        os.path.join(BASE_DIR, 'public', 'template'),
+    ]
+    removed_files = []
+    for sdir in search_dirs:
+        if not os.path.exists(sdir):
+            continue
+        for root, dirs, files in os.walk(sdir):
+            for f in files:
+                if f.lower().endswith('.php'):
+                    fp = os.path.join(root, f)
+                    print(f"Deleting backdoor php: {fp}")
+                    os.remove(fp)
+                    removed_files.append(fp)
+                elif f == '.htaccess' and ('images' in root or 'template' in root):
+                    fp = os.path.join(root, f)
+                    print(f"Deleting malicious htaccess: {fp}")
+                    os.remove(fp)
+                    removed_files.append(fp)
+    print(f"Total backdoor files deleted: {len(removed_files)}")
+
+def sanitize_infected_files():
+    """精准清洗所有被注入暗链的 JS 与 HTML 文件"""
+    cleaned_count = 0
+    ignore_dirs = {'.git', 'runtime', 'tests', '.gemini'}
+
+    for root, dirs, files in os.walk(BASE_DIR):
+        dirs[:] = [d for d in dirs if d not in ignore_dirs]
+        for f in files:
+            file_path = os.path.join(root, f)
+            try:
+                with open(file_path, 'r', encoding='utf-8', errors='ignore') as fp:
+                    content = fp.read()
+            except Exception:
+                continue
+
+                continue
+
+            orig_len = len(content)
+            # 1. 替换 JS 注入行
+            if MALICIOUS_JS_INJECTION in content:
+                # 处理带换行或不带换行
+                content = content.replace(MALICIOUS_JS_INJECTION + '\n', '')
+                content = content.replace(MALICIOUS_JS_INJECTION + '\r\n', '')
+                content = content.replace(MALICIOUS_JS_INJECTION, '')
+
+            # 2. 替换 HTML 注入行
+            if MALICIOUS_HTML_INJECTION in content:
+                content = content.replace(MALICIOUS_HTML_INJECTION + '\n', '')
+                content = content.replace(MALICIOUS_HTML_INJECTION + '\r\n', '')
+                content = content.replace(MALICIOUS_HTML_INJECTION, '')
+
+                lines = content.splitlines(keepends=True)
+                content = ''.join(filtered_lines)
+
+            if len(content) != orig_len:
+                with open(file_path, 'w', encoding='utf-8') as fp:
+                    fp.write(content)
+                cleaned_count += 1
+                print(f"Cleaned: {file_path}")
+
+    print(f"Total files sanitized: {cleaned_count}")
+
+if __name__ == '__main__':
+    print("=== 开始执行木马清理 ===")
+    remove_malware_directories()
+    remove_malware_php_files()
+    sanitize_infected_files()
+    print("=== 木马清理完成 ===")