安全加固：CORS白名单、JWT密钥自动生成、SSRF防护、路径遍历与错误信息泄露修复

backend/ali_oss.py

@@ -26,6 +26,7 @@ from config import (
     accessKeyId,
     accessKeySecret,
 )
+from utils.ssrf import is_internal_url
 
 _client = None
 _client_lock = threading.Lock()
@@ -180,6 +181,9 @@ def upload_data_urls(data_urls: list, prefix: str = "history") -> list:
             del file_content
             continue
 
+        if is_internal_url(data_url):
+            raise ValueError("拒绝下载内网/本机地址的图片")
+
         with requests.get(data_url, stream=True, timeout=_REMOTE_IMAGE_TIMEOUT) as response:
             response.raise_for_status()
             content_length = response.headers.get("Content-Length")