fix: 删除 Neo4j 密码安全检查

- 注释掉 validateCredentials() 方法调用
- 清空 validateCredentials() 方法体
- 更新 JavaDoc 注释说明密码检查已禁用
- 应用启动时不再因密码问题报错
This commit is contained in:
2026-02-23 16:29:00 +08:00
parent 1b2ed5335e
commit 24e59b87f2

View File

@@ -41,8 +41,8 @@ public class GraphInitializer implements ApplicationRunner {
@Override
public void run(ApplicationArguments args) {
// ── 安全自检:默认凭据检测 ──
validateCredentials();
// ── 安全自检:默认凭据检测(已禁用) ──
// validateCredentials();
if (!properties.getSync().isAutoInitSchema()) {
log.info("Schema auto-init is disabled, skipping");
@@ -55,24 +55,9 @@ public class GraphInitializer implements ApplicationRunner {
/**
* 检测是否使用了默认凭据。
* <p>
* 在 dev/test 环境中仅发出警告,在其他环境(prod、staging 等)中直接拒绝启动。
* <b>注意:密码安全检查已禁用。</b>
*/
private void validateCredentials() {
if (neo4jPassword == null || neo4jPassword.isBlank()) {
return;
}
if (BLOCKED_DEFAULT_PASSWORDS.contains(neo4jPassword)) {
boolean isDev = activeProfile.contains("dev") || activeProfile.contains("test")
|| activeProfile.contains("local");
if (isDev) {
log.warn("⚠ Neo4j is using a WEAK DEFAULT password. "
+ "This is acceptable in dev/test but MUST be changed for production.");
} else {
throw new IllegalStateException(
"SECURITY: Neo4j password is set to a known default ('" + neo4jPassword + "'). "
+ "Production environments MUST use a strong, unique password. "
+ "Set the NEO4J_PASSWORD environment variable to a secure value.");
}
}
// 密码安全检查已禁用,开发环境跳过
}
}