fix(security): 关闭Fastjson AutoType并移除硬编码云密钥

关闭Redis序列化AutoType，腾讯云短信密钥改为配置/环境变量注入。

Co-authored-by: Cursor <cursoragent@cursor.com>

fs-ad-api/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-ad-new-api/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-admin/src/main/resources/application.yml

@@ -12,3 +12,9 @@ spring:
 #    active: druid-fby
 #    active: dev
 
+# 腾讯云短信密钥（安全修复：禁止硬编码，请通过环境变量注入，并立即轮换旧密钥）
+tencent:
+  cloud:
+    secret-id: ${TENCENT_CLOUD_SECRET_ID:}
+    secret-key: ${TENCENT_CLOUD_SECRET_KEY:}
+

fs-common-api/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-company-app/src/main/java/com/fs/core/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-company/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-doctor-app/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-framework/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -27,7 +27,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-ipad-task/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-live-app/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-live-mq/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-mp-app/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qw-api-msg/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qw-api/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qw-company-api/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qw-mq/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qw-task/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qw-voice/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qwhook-msg/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qwhook-sop/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-qwhook/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-redis/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-repeat-api/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-service/src/main/java/com/fs/sms/service/impl/SmsTServiceImpl.java

@@ -21,6 +21,7 @@ import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
 import org.apache.http.util.EntityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
 import java.io.IOException;
@@ -32,10 +33,22 @@ public class SmsTServiceImpl implements SmsService {
     @Autowired
     private RedisCache redisCache;
 
+    /** 腾讯云 SecretId，从配置注入，禁止硬编码 */
+    @Value("${tencent.cloud.secret-id:}")
+    private String tencentSecretId;
+
+    /** 腾讯云 SecretKey，从配置注入，禁止硬编码 */
+    @Value("${tencent.cloud.secret-key:}")
+    private String tencentSecretKey;
+
     @Override
     public R sendTSms(String mobile, String code) {
         try {
-            Credential cred = new Credential("AKIDdAdvzoQpzuOo11mq2TntjKI5eqrhNp22", "zmLgpzzcwAFNJ4dx2iDTVHgw3ELCrIVg");
+            if (tencentSecretId == null || tencentSecretId.isEmpty()
+                    || tencentSecretKey == null || tencentSecretKey.isEmpty()) {
+                return R.error("腾讯云短信密钥未配置，请设置 tencent.cloud.secret-id/secret-key");
+            }
+            Credential cred = new Credential(tencentSecretId, tencentSecretKey);
             HttpProfile httpProfile = new HttpProfile();
             httpProfile.setEndpoint("sms.tencentcloudapi.com");
             ClientProfile clientProfile = new ClientProfile();

fs-store/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-user-app-ai-chat/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-user-app/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-watch/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)

fs-wx-api/src/main/java/com/fs/framework/config/FastJson2JsonRedisSerializer.java

@@ -28,7 +28,7 @@ public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
 
     static
     {
-        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
+        ParserConfig.getGlobalInstance().setAutoTypeSupport(false); // 安全修复：关闭 AutoType，防止反序列化 RCE
     }
 
     public FastJson2JsonRedisSerializer(Class<T> clazz)