heqiapp/platforms
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden platform form and response boundaries

Browse Source
This commit is contained in:
yanweidong
2026-07-27 12:19:34 +08:00
parent 34e8b092b3
commit cd58e1f6b6
7 changed files with 294 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
backend/api/internal/logic/platform/platform.go
View File

@@ -58,10 +58,20 @@ func listPage[T any](ctx *gin.Context) {
infra.Response.Success(ctx, gin.H{"total": total, "list": response})
}
var keywordExcludedColumns = map[string]bool{
"identity": true, "status": true, "password_hash": true,
"longitude": true, "latitude": true, "payload": true,
"before_data": true, "after_data": true,
var keywordSafeColumns = map[string]bool{
"code": true, "name": true, "username": true, "display_name": true,
"role_code": true, "delivery_code": true, "work_status": true,
"credential_type": true, "device_no": true, "model": true,
"online_status": true, "rule_code": true, "action": true,
"event_code": true, "title": true, "result": true,
"product_code": true, "value": true, "order_no": true,
"channel": true, "settlement_no": true, "subject_type": true,
"content_type": true, "publish_status": true, "template_code": true,
"ticket_no": true, "category": true, "priority": true,
"platform_role_code": true, "data_scope": true, "menu_code": true,
"path": true, "report_code": true, "report_type": true,
"stat_period": true, "dimension": true, "metric_code": true,
"scope_type": true, "business_type": true, "resource_type": true,
}
func applyKeywordFilter(ctx *gin.Context, query *gorm.DB, model any) *gorm.DB {
@@ -90,17 +100,26 @@ func keywordColumns(model any) []string {
columns := make([]string, 0)
for index := 0; index < modelType.NumField(); index++ {
field := modelType.Field(index)
if field.Anonymous || field.Type.Kind() != reflect.String {
if field.Anonymous || field.Type.Kind() != reflect.String || strings.Contains(field.Tag.Get("gorm"), "type:jsonb") {
continue
}
column := gormColumn(field.Tag.Get("gorm"))
if column != "" && !keywordExcludedColumns[column] {
if keywordSafeColumns[column] && !isSensitiveKeywordColumn(model, column) {
columns = append(columns, column)
}
}
return columns
}
func isSensitiveKeywordColumn(model any, column string) bool {
switch model.(type) {
case *models.UserAccount, *models.StaffAccount:
return column == "name"
default:
return false
}
}
func gormColumn(tag string) string {
for _, part := range strings.Split(tag, ";") {
if strings.HasPrefix(part, "column:") {