From 3ae53014f2554968c19556383690eb99182fc593 Mon Sep 17 00:00:00 2001 From: dujiao-next Date: Sun, 11 Oct 2026 12:13:57 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=B8=8A=E4=BC=A0=E7=9B=AE=E5=BD=95?= =?UTF-8?q?=E6=89=80=E6=9C=89=E6=96=87=E4=BB=B6=E7=A6=81=E6=AD=A2=E6=89=A7?= =?UTF-8?q?=E8=A1=8C=E8=84=9A=E6=9C=AC=EF=BC=8C=E9=98=B2=E6=AD=A2=E5=90=8C?= =?UTF-8?q?=E6=BA=90=E5=AD=98=E5=82=A8=E5=9E=8B=20XSS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/app/httpserver/router.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/internal/app/httpserver/router.go b/internal/app/httpserver/router.go index a5205d86..555331fb 100644 --- a/internal/app/httpserver/router.go +++ b/internal/app/httpserver/router.go @@ -246,13 +246,14 @@ func SetupRouter(cfg *config.Config, c *container.Container) *gin.Engine { r.Use(middleware.CallbackRouteMiddleware(c.SettingService, paymentCallbackHandler, paymentWebhookHandler, upstreamHandler)) // 静态文件服务（上传的图片）必须放在前面。 - // SVG 强制下载并禁止脚本：即使上传校验被绕过，直接打开 /uploads/x.svg 也不会在站点源下执行脚本； - // 引用不受 Content-Disposition 影响，正常显示。 + // 所有上传文件一律禁止脚本：即使上传校验被绕过（如 telegram 场景不限扩展名、上游图片）， + // 直接打开 /uploads/x.html 也不会在站点源下执行脚本； 引用不受影响。 + // SVG 额外强制下载。 r.Group("/uploads", func(c *gin.Context) { + c.Header("Content-Security-Policy", "sandbox; script-src 'none'") + c.Header("X-Content-Type-Options", "nosniff") if strings.EqualFold(path.Ext(c.Request.URL.Path), ".svg") { c.Header("Content-Disposition", "attachment") - c.Header("Content-Security-Policy", "sandbox; script-src 'none'") - c.Header("X-Content-Type-Options", "nosniff") } }).Static("/", "./uploads")