安全加固：CORS白名单、JWT密钥自动生成、SSRF防护、路径遍历与错误信息泄露修复

backend/utils/db.py

@@ -2,6 +2,7 @@
 数据库连接与初始化
 """
 import os
+import re
 import pymysql
 from werkzeug.security import generate_password_hash
 
@@ -31,6 +32,13 @@ mysql_user_source = config_mysql_user_source
 mysql_database_source = config_mysql_database_source
 
 
+def _safe_identifier(name):
+    """仅允许字母、数字、下划线的数据库/表名片段，防止注入 DDL 片段。"""
+    if not re.fullmatch(r'[A-Za-z0-9_]+', name or ''):
+        raise ValueError(f'非法标识符: {name!r}')
+    return name
+
+
 def describe_db_target():
     return (
         f"{mysql_user}@{mysql_host}/{mysql_database} "
@@ -80,9 +88,10 @@ def init_db():
         charset='utf8mb4'
     )
     try:
+        db_name = _safe_identifier(mysql_database)
         with conn.cursor() as cur:
-            cur.execute(f"CREATE DATABASE IF NOT EXISTS `{mysql_database}` DEFAULT CHARSET utf8mb4")
-            cur.execute(f"USE `{mysql_database}`")
+            cur.execute(f"CREATE DATABASE IF NOT EXISTS `{db_name}` DEFAULT CHARSET utf8mb4")
+            cur.execute(f"USE `{db_name}`")
             cur.execute("""
                 CREATE TABLE IF NOT EXISTS users (
                     id INT AUTO_INCREMENT PRIMARY KEY,