安全加固：CORS白名单、JWT密钥自动生成、SSRF防护、路径遍历与错误信息泄露修复

backend/blueprints/main.py

@@ -3,6 +3,7 @@
 """
 import os
 from flask import Blueprint, redirect, url_for, send_file, session
+from werkzeug.utils import safe_join
 
 from utils.auth import login_required, is_session_user_valid
 from utils.render import render_html
@@ -29,9 +30,7 @@ def admin_page():
 @main.route('/static/<path:filename>')
 def serve_static(filename):
     """提供 static 目录及子目录下的静态文件访问"""
-    filepath = os.path.normpath(os.path.join(STATIC_DIR, filename))
-    static_abs = os.path.abspath(STATIC_DIR)
-    file_abs = os.path.abspath(filepath)
-    if not file_abs.startswith(static_abs) or not os.path.isfile(file_abs):
+    filepath = safe_join(STATIC_DIR, filename)
+    if filepath is None or not os.path.isfile(filepath):
         return '', 404
-    return send_file(file_abs, as_attachment=False)
+    return send_file(filepath, as_attachment=False)