fix version 1

module/social/feed/internal/logic/post/action.go

@@ -22,6 +22,11 @@ func Action(ctx context.Context, in *pb.PostActionRequest) (reply *pb.DataStatus
 	if in.GetActionOp() == "" || in.GetActionType() == "" || in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
+	// 白名单校验，避免非法操作/类别拼出空列名或未绑定目标表的更新语句
+	if (in.ActionOp != "ilike" && in.ActionOp != "unlike") ||
+		(in.ActionType != "post" && in.ActionType != "comment") {
+		return nil, errcode.ErrInvalidArgument
+	}
 	if err := models.LikeAction(in.ActionOp, in.ActionType, in.Identity); err != nil {
 		printer.Error(err.Error())
 		return nil, err