snowgitea/film-management-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add book category functionality, fix XSS protection and validation issues, update film category mapping

Browse Source
This commit is contained in:
Jony
2026-07-02 15:01:57 +08:00
parent a091132a70
commit 893b5316f3
5 changed files with 371 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/modules/knowledge/menu.json
+75
View File
@@ -142,6 +142,81 @@
"childMenus": []
}
]
},
}
]
},
{
"name": "书籍管理",
"router": null,
"perms": null,
"type": 0,
"icon": "icon-goods",
"orderNum": 2,
"viewPath": null,
"keepAlive": true,
"isShow": true,
"childMenus": [
{
"name": "书籍列表",
"router": "/knowledge/book",
"perms": null,
"type": 1,
"icon": "icon-menu",
"orderNum": 1,
"viewPath": "modules/knowledge/views/book/index.vue",
"keepAlive": true,
"isShow": true,
"childMenus": [
{
"name": "新增",
"router": null,
"perms": "knowledge:book:add",
"type": 2,
"icon": null,
"orderNum": 1,
"viewPath": null,
"keepAlive": false,
"isShow": true,
"childMenus": []
},
{
"name": "删除",
"router": null,
"perms": "knowledge:book:delete",
"type": 2,
"icon": null,
"orderNum": 2,
"viewPath": null,
"keepAlive": false,
"isShow": true,
"childMenus": []
},
{
"name": "修改",
"router": null,
"perms": "knowledge:book:info,knowledge:book:update",
"type": 2,
"icon": null,
"orderNum": 3,
"viewPath": null,
"keepAlive": false,
"isShow": true,
"childMenus": []
},
{
"name": "查询",
"router": null,
"perms": "knowledge:book:page,knowledge:book:list,knowledge:book:info",
"type": 2,
"icon": null,
"orderNum": 4,
"viewPath": null,
"keepAlive": false,
"isShow": true,
"childMenus": []
}
]
}
]
}
src/modules/knowledge/service/film.ts
+124 -16
View File
@@ -3,7 +3,14 @@ import { Inject, Provide } from '@midwayjs/core';
import { BaseService } from '@cool-midway/core';
import { InjectEntityModel } from '@midwayjs/typeorm';
import { Repository } from 'typeorm';
import { escapeObject } from '../utils/xss';
import {
escapeObject,
filterImageUrls,
truncateString,
validateYear,
validateRating,
validateCategoryId
} from '../utils/xss';
/**
* 知识库模块-电影信息
@@ -16,14 +23,99 @@ export class KnowledgeFilmService extends BaseService {
@Inject()
ctx;
/**
* 分页查询
* - 重写自 BaseService.page，绕开 BaseSqliteService.fieldEq 注释掉 sqlParams.push 的 bug
* （该 bug 会导致 quality/categoryId 等精确匹配字段的查询参数未传递，typeorm 默认 0，触发 SQLITE_MISMATCH）
* - 同时处理 watched 字段（前端布尔/字符串 → 数字 1/0）的类型转换
* @param query 查询条件
* @param option 查询配置
*/
async page(query: any, option?: any) {
// 1. watched 类型转换：布尔/字符串 → 数字 1/0
if (query.watched !== undefined && query.watched !== null && query.watched !== '') {
query.watched = query.watched === 'true' || query.watched === true ? 1 : 0;
}
// 2. 字符串数字 → 数字
if (query.categoryId !== undefined && query.categoryId !== null && query.categoryId !== '') {
if (typeof query.categoryId === 'string') {
const num = parseInt(query.categoryId, 10);
if (!isNaN(num)) {
query.categoryId = num;
}
}
}
const { page: pageNo = 1, size = 20, keyWord = '', order = 'id', sort = 'desc' } = query;
const pageNum = Math.max(1, parseInt(String(pageNo), 10) || 1);
const pageSize = Math.max(1, parseInt(String(size), 10) || 20);
const offset = (pageNum - 1) * pageSize;
// 3. 构造 QueryBuilder，手动管理所有字段，避免走 fieldEq 有 bug 的路径
const qb = this.knowledgeFilmEntity.createQueryBuilder('a');
// quality 精确匹配
if (query.quality !== undefined && query.quality !== null && query.quality !== '') {
qb.andWhere('a.quality = :quality', { quality: String(query.quality) });
}
// categoryId 精确匹配
if (query.categoryId !== undefined && query.categoryId !== null && query.categoryId !== '') {
qb.andWhere('a.categoryId = :categoryId', { categoryId: query.categoryId });
}
// watched 精确匹配
if (query.watched !== undefined && query.watched !== null && query.watched !== '') {
qb.andWhere('a.watched = :watched', { watched: query.watched });
}
// 关键字搜索（name、director、mainCharacters 三个字段）
if (keyWord) {
const like = `%${keyWord}%`;
qb.andWhere(
`(a.name LIKE :kw OR a.director LIKE :kw OR a.mainCharacters LIKE :kw)`,
{ kw: like }
);
}
// 排序
const allowedSort = ['asc', 'desc'].includes(String(sort).toLowerCase()) ? String(sort).toUpperCase() : 'DESC';
const orderField = ['id', 'createTime', 'updateTime', 'name', 'year'].includes(order) ? order : 'id';
qb.orderBy(`a.${orderField}`, allowedSort as 'ASC' | 'DESC');
// 分页
qb.skip(offset).take(pageSize);
// 4. 执行查询
const [list, total] = await qb.getManyAndCount();
return {
list,
pagination: {
page: pageNum,
size: pageSize,
total: Number(total)
}
};
}
/**
* 新增电影
* - 业务层查重：检查同名电影是否已存在
* - 对用户输入进行 XSS 过滤，防止存储型 XSS 攻击
* - 排除 posters 字段（JSON数组，不需要转义）
* - 对 posters 字段进行 URL 白名单校验，只允许 http/https 协议
* @param params 电影数据
*/
async add(params: any) {
// 字段长度截断，防止超出数据库字段限制
if (params.name) params.name = truncateString(params.name, 200);
if (params.director) params.director = truncateString(params.director, 200);
if (params.country) params.country = truncateString(params.country, 100);
if (params.language) params.language = truncateString(params.language, 100);
if (params.quality) params.quality = truncateString(params.quality, 10);
if (params.link) params.link = truncateString(params.link, 500);
// 业务层查重：检查同名电影是否已存在
if (params.name) {
const exist = await this.knowledgeFilmEntity.findOne({
@@ -33,6 +125,10 @@ export class KnowledgeFilmService extends BaseService {
throw new Error(`电影"${params.name}"已存在，请勿重复添加`);
}
}
// URL 白名单过滤 posters 字段
if (params.posters) {
params.posters = filterImageUrls(params.posters);
}
// XSS 过滤 - 排除 posters 字段（JSON 数组）
const safeParams = escapeObject(params, ['posters']);
return super.add(safeParams);
@@ -41,10 +137,22 @@ export class KnowledgeFilmService extends BaseService {
/**
* 更新电影
* - 对用户输入进行 XSS 过滤，防止存储型 XSS 攻击
* - 排除 posters 字段（JSON数组，不需要转义）
* - 对 posters 字段进行 URL 白名单校验，只允许 http/https 协议
* @param params 电影数据
*/
async update(params: any) {
// 字段长度截断，防止超出数据库字段限制
if (params.name) params.name = truncateString(params.name, 200);
if (params.director) params.director = truncateString(params.director, 200);
if (params.country) params.country = truncateString(params.country, 100);
if (params.language) params.language = truncateString(params.language, 100);
if (params.quality) params.quality = truncateString(params.quality, 10);
if (params.link) params.link = truncateString(params.link, 500);
// URL 白名单过滤 posters 字段
if (params.posters) {
params.posters = filterImageUrls(params.posters);
}
// XSS 过滤 - 排除 posters 字段（JSON 数组）
const safeParams = escapeObject(params, ['posters']);
return super.update(safeParams);
@@ -81,25 +189,25 @@ export class KnowledgeFilmService extends BaseService {
}
try {
// 映射 Excel 列名到数据库字段
// 映射 Excel 列名到数据库字段，并进行字段校验与截断
const filmData = {
name: film.name || '',
director: film.director || film['导演'] || film['导演/作者'] || '',
year: film.year || film['年份'] || null,
country: film.country || film['国家'] || '',
language: film.language || film['语言'] || '',
name: truncateString(film.name || '', 200),
director: truncateString(film.director || film['导演'] || film['导演/作者'] || '', 200),
year: validateYear(film.year || film['年份']),
country: truncateString(film.country || film['国家'] || '', 100),
language: truncateString(film.language || film['语言'] || '', 100),
mainCharacters: film.mainCharacters || film['主要人物'] || '',
synopsis: film.synopsis || film['内容简介'] || '',
backgroundStory: film.backgroundStory || film['背景故事'] || '',
posters: film.posters || film['海报链接']
posters: filterImageUrls(film.posters || film['海报链接']
? [film.posters || film['海报链接']]
: [],
categoryId: film.categoryId ?? film['分类ID'] ?? film['分类'] ?? 45,
quality: film.quality || film['质量'] || film['质量评级'] || 'C',
: []),
categoryId: validateCategoryId(film.categoryId ?? film['分类ID'] ?? film['分类'], 45),
quality: truncateString(film.quality || film['质量'] || film['质量评级'] || 'C', 10),
watched: film.watched || film['是否已看'] || false,
doubanRating: film.doubanRating || film['豆瓣评分'] || null,
tmdbRating: film.tmdbRating || film['TMDB评分'] || null,
link: film.link || film['链接'] || '',
doubanRating: validateRating(film.doubanRating || film['豆瓣评分']),
tmdbRating: validateRating(film.tmdbRating || film['TMDB评分']),
link: truncateString(film.link || film['链接'] || '', 500),
honors: film.honors || film['荣誉'] || '',
highlights: film.highlights || film['亮点所在'] || '',
whyWorthWatching: film.whyWorthWatching || film['为什么值得一看'] || ''
src/modules/knowledge/utils/xss.ts
+106
View File
@@ -21,6 +21,112 @@ export function escapeHtml(str: string): string {
.replace(/'/g, ''');
}
/**
* 验证图片 URL 是否安全
* 只允许 http:// 和 https:// 协议，防止 javascript: 等恶意协议
* @param url 图片 URL
* @returns 是否安全
*/
export function isValidImageUrl(url: string): boolean {
if (!url || typeof url !== 'string') {
return false;
}
// 只允许 http:// 和 https:// 协议
return url.startsWith('http://') || url.startsWith('https://');
}
/**
* 过滤图片 URL 数组，移除不安全的 URL
* @param urls 图片 URL 数组
* @returns 安全的 URL 数组
*/
export function filterImageUrls(urls: string[] | any): string[] {
if (!Array.isArray(urls)) {
return [];
}
return urls.filter(url => isValidImageUrl(url));
}
/**
* 截断字符串到指定长度，防止超出数据库字段长度限制
* @param str 输入字符串
* @param maxLength 最大长度
* @returns 截断后的字符串
*/
export function truncateString(str: string, maxLength: number): string {
if (!str || typeof str !== 'string') {
return str;
}
return str.length > maxLength ? str.substring(0, maxLength) : str;
}
/**
* 验证并规范化年份字段
* 只允许 1800-当前年份+10 范围内的合理年份
* @param year 输入年份
* @returns 有效的年份数字或 null
*/
export function validateYear(year: any): number | null {
if (year === null || year === undefined || year === '') {
return null;
}
const num = parseInt(String(year), 10);
if (isNaN(num)) {
return null;
}
const currentYear = new Date().getFullYear();
if (num < 1800 || num > currentYear + 10) {
return null;
}
return num;
}
/**
* 验证评分字段（豆瓣评分、TMDB评分）
* 只允许 0-10 范围内的数字，精度到小数点后1位
* @param rating 输入评分
* @returns 有效的评分数字或 null
*/
export function validateRating(rating: any): number | null {
if (rating === null || rating === undefined || rating === '') {
return null;
}
// 解析字符串格式的评分，如 "TMDB 7.4" / "豆瓣 8.0"
if (typeof rating === 'string') {
const match = rating.match(/(\d+\.?\d*)/);
if (!match) {
return null;
}
rating = parseFloat(match[1]);
}
const num = parseFloat(String(rating));
if (isNaN(num)) {
return null;
}
if (num < 0 || num > 10) {
return null;
}
return Math.round(num * 10) / 10;
}
/**
* 验证分类ID
* 必须是正整数
* @param categoryId 输入分类ID
* @param defaultValue 默认值
* @returns 有效的分类ID
*/
export function validateCategoryId(categoryId: any, defaultValue: number | null = null): number | null {
if (categoryId === null || categoryId === undefined || categoryId === '') {
return defaultValue;
}
const num = parseInt(String(categoryId), 10);
if (isNaN(num) || num <= 0) {
return defaultValue;
}
return num;
}
/**
* 递归转义对象中的所有字符串字段
* @param obj 输入对象