依赖漏洞审计与阻断治理（CVE-评分-策略）最佳实践

核心要点统一数据源与格式，校验 `CVE` 标识与 `CVSS` 范围有效性。阈值策略：达到或超过阈值即阻断；支持例外清单与到期时间。审计记录包含依赖、版本、CVE、评分、策略判定与审批信息。参数与规则CVE格式：`CVE-YYYY-NNNN`；年份范围与编号长度校验。CVSS范围：`0.0` 至 `10.0`；保留一位小数或两位小数。阈值示例：阻断 `>= 7.0`；警告 `5.0–6.9`；通过 `< 5.0`。实现示例type Advisory = { package: string; version: string; cve: string; cvss: number; url?: string; expiresAt?: number } function validCve(id: string): boolean { const m = /^CVE-(\d{4})-(\d{4,})$/.exec(id) if (!m) return false const year = parseInt(m[1], 10) return year >= 1999 && year <= new Date().getFullYear() } function validCvss(score: number): boolean { return score >= 0 && score <= 10 && Number.isFinite(score) } type Policy = { blockThreshold: number; warnThreshold: number; now: number } function inException(a: Advisory, exceptions: Map<string, number>, now: number): boolean { const key = `${a.package}@${a.version}:${a.cve}` const until = exceptions.get(key) return !!until && until >= now } function decide(a: Advisory, p: Policy, exceptions: Map<string, number>): 'block' | 'warn' | 'pass' { if (!validCve(a.cve) || !validCvss(a.cvss)) return 'block' if (inException(a, exceptions, p.now)) return 'pass' if (a.cvss >= p.blockThreshold) return 'block' if (a.cvss >= p.warnThreshold) return 'warn' return 'pass' } function evaluate(advisories: Advisory[], policy: Policy, exceptions: Map<string, number>): { blocked: Advisory[]; warned: Advisory[]; passed: Advisory[] } { const blocked: Advisory[] = [] const warned: Advisory[] = [] const passed: Advisory[] = [] for (const a of advisories) { const d = decide(a, policy, exceptions) if (d === 'block') blocked.push(a) else if (d === 'warn') warned.push(a) else passed.push(a) } return { blocked, warned, passed } } 审计与CI门禁构建前解析安全报告并执行策略；阻断项直接失败并输出详情。审计记录包含依赖、版本、CVE、CVSS、策略结果与例外到期时间。