diff --git a/lib/shared/security/property-injection-guard.js b/lib/shared/security/property-injection-guard.js
new file mode 100644
index 000000000..f3aa1f8dc
--- /dev/null
+++ b/lib/shared/security/property-injection-guard.js
@@ -0,0 +1,215 @@
+/**
+ * @desc 防止Remote property injection攻击的安全工具函数
+ * @author LessCode Security Team
+ */
+
+// 禁止的属性名，这些属性可能被用于原型链污染攻击
+const FORBIDDEN_KEYS = [
+ '__proto__',
+ 'constructor',
+ 'prototype',
+ 'hasOwnProperty',
+ 'isPrototypeOf',
+ 'propertyIsEnumerable',
+ 'toLocaleString',
+ 'toString',
+ 'valueOf'
+]
+
+// 安全的属性名正则表达式，只允许字母、数字、下划线和连字符
+const SAFE_KEY_REGEX = /^[a-zA-Z0-9_-]+$/
+
+/**
+ * @desc 检查属性名是否安全
+ * @param {string} key 属性名
+ * @returns {boolean} 是否安全
+ */
+export function isSafePropertyKey (key) {
+ if (typeof key !== 'string') {
+ return false
+ }
+
+ // 检查是否在禁止列表中
+ if (FORBIDDEN_KEYS.includes(key)) {
+ return false
+ }
+
+ // 检查是否符合安全命名规范
+ if (!SAFE_KEY_REGEX.test(key)) {
+ return false
+ }
+
+ return true
+}
+
+/**
+ * @desc 安全地合并对象属性，防止原型链污染
+ * @param {Object} target 目标对象
+ * @param {Object} source 源对象
+ * @param {Object} options 选项
+ * @param {boolean} options.deep 是否深度合并
+ * @param {boolean} options.strict 是否严格模式（拒绝所有不安全的属性）
+ * @returns {Object} 合并后的安全对象
+ */
+export function safeObjectMerge (target = {}, source = {}, options = {}) {
+ const { deep = false, strict = true } = options
+
+ // 创建没有原型链的安全对象
+ const safeTarget = Object.create(null)
+
+ // 先复制目标对象的属性
+ if (target && typeof target === 'object') {
+ for (const key in target) {
+ if (Object.prototype.hasOwnProperty.call(target, key) && isSafePropertyKey(key)) {
+ safeTarget[key] = deep ? deepClone(target[key]) : target[key]
+ }
+ }
+ }
+
+ // 再合并源对象的属性
+ if (source && typeof source === 'object') {
+ for (const key in source) {
+ if (Object.prototype.hasOwnProperty.call(source, key)) {
+ if (isSafePropertyKey(key)) {
+ if (deep && typeof source[key] === 'object' && source[key] !== null) {
+ safeTarget[key] = safeObjectMerge(safeTarget[key] || {}, source[key], { deep: true, strict })
+ } else {
+ safeTarget[key] = source[key]
+ }
+ } else if (strict) {
+ // 严格模式下，记录不安全的属性但拒绝合并
+ console.warn(`[Security] Rejected unsafe property key: ${key}`)
+ }
+ }
+ }
+ }
+
+ return safeTarget
+}
+
+/**
+ * @desc 安全地设置对象属性
+ * @param {Object} target 目标对象
+ * @param {string} key 属性名
+ * @param {any} value 属性值
+ * @param {boolean} strict 是否严格模式
+ * @returns {boolean} 是否设置成功
+ */
+export function safeSetProperty (target, key, value, strict = true) {
+ if (!target || typeof target !== 'object') {
+ return false
+ }
+
+ if (!isSafePropertyKey(key)) {
+ if (strict) {
+ console.warn(`[Security] Rejected unsafe property key: ${key}`)
+ return false
+ }
+ return false
+ }
+
+ target[key] = value
+ return true
+}
+
+/**
+ * @desc 安全地遍历对象属性
+ * @param {Object} obj 要遍历的对象
+ * @param {Function} callback 回调函数
+ * @param {boolean} strict 是否严格模式
+ */
+export function safeForEachProperty (obj, callback, strict = true) {
+ if (!obj || typeof obj !== 'object') {
+ return
+ }
+
+ for (const key in obj) {
+ if (Object.prototype.hasOwnProperty.call(obj, key)) {
+ if (isSafePropertyKey(key)) {
+ callback(key, obj[key])
+ } else if (strict) {
+ console.warn(`[Security] Skipped unsafe property key: ${key}`)
+ }
+ }
+ }
+}
+
+/**
+ * @desc 深度克隆对象，防止原型链污染
+ * @param {any} obj 要克隆的对象
+ * @returns {any} 克隆后的对象
+ */
+export function deepClone (obj) {
+ if (obj === null || typeof obj !== 'object') {
+ return obj
+ }
+
+ if (obj instanceof Date) {
+ return new Date(obj.getTime())
+ }
+
+ if (obj instanceof Array) {
+ return obj.map(item => deepClone(item))
+ }
+
+ if (typeof obj === 'object') {
+ const cloned = Object.create(null)
+ safeForEachProperty(obj, (key, value) => {
+ cloned[key] = deepClone(value)
+ }, false) // 深度克隆时不严格，但会过滤不安全的key
+ return cloned
+ }
+
+ return obj
+}
+
+/**
+ * @desc 验证并清理对象，移除不安全的属性
+ * @param {Object} obj 要清理的对象
+ * @param {boolean} deep 是否深度清理
+ * @returns {Object} 清理后的安全对象
+ */
+export function sanitizeObject (obj, deep = false) {
+ if (!obj || typeof obj !== 'object') {
+ return obj
+ }
+
+ const sanitized = Object.create(null)
+
+ safeForEachProperty(obj, (key, value) => {
+ if (deep && typeof value === 'object' && value !== null) {
+ sanitized[key] = sanitizeObject(value, true)
+ } else {
+ sanitized[key] = value
+ }
+ }, false) // 清理时不严格，但会过滤不安全的key
+
+ return sanitized
+}
+
+/**
+ * @desc 检查对象是否包含不安全的属性
+ * @param {Object} obj 要检查的对象
+ * @param {boolean} deep 是否深度检查
+ * @returns {Array} 不安全属性的列表
+ */
+export function findUnsafeProperties (obj, deep = false) {
+ const unsafeProperties = []
+
+ if (!obj || typeof obj !== 'object') {
+ return unsafeProperties
+ }
+
+ for (const key in obj) {
+ if (Object.prototype.hasOwnProperty.call(obj, key)) {
+ if (!isSafePropertyKey(key)) {
+ unsafeProperties.push(key)
+ } else if (deep && typeof obj[key] === 'object' && obj[key] !== null) {
+ const nestedUnsafe = findUnsafeProperties(obj[key], true)
+ unsafeProperties.push(...nestedUnsafe.map(nestedKey => `${key}.${nestedKey}`))
+ }
+ }
+ }
+
+ return unsafeProperties
+}
diff --git a/lib/shared/util.js b/lib/shared/util.js
index c446691d7..434e0763a 100644
--- a/lib/shared/util.js
+++ b/lib/shared/util.js
@@ -168,13 +168,19 @@ export function throttle (fn, delay = 200) {
* @returns
*/
export function unitFilter (value) {
- if (value?.endsWith('rpx') && value.length < 50) {
- const match = /(\d+)rpx$/.exec(value)
- if (match) {
- const sizeNumber = (parseInt(match[1], 10) / 750 * 20).toFixed(2)
- const result = sizeNumber + 'rem'
- return result
+ if (!value) return ''
+ try {
+ value = value?.toString()
+ if (value?.endsWith('rpx') && value.length < 50) {
+ const match = /(\d+)rpx$/.exec(value)
+ if (match) {
+ const sizeNumber = (parseInt(match[1], 10) / 750 * 20).toFixed(2)
+ const result = sizeNumber + 'rem'
+ return result
+ }
}
+ } catch (error) {
+ console.log(error, 'unitfilter err')
}
return value
}
@@ -434,3 +440,35 @@ export const getLesscodeVarCode = (value) => {
}
return ''
}
+
+// 过滤文件路径中危险字符
+export function filterFilePath (inputPath, options = {}) {
+ // 默认把危险字符替换成_
+ const { replacement = '_' } = options
+
+ if (typeof inputPath !== 'string') {
+ throw new TypeError('inputPath 必须是字符串')
+ }
+
+ // 拆分路径，过滤空和 '.'，禁止 '..'
+ const parts = inputPath.split('/').filter(part => part && part !== '.')
+
+ if (parts.includes('..')) {
+ throw new Error('路径中不允许包含父目录引用 ".."')
+ }
+
+ // 定义危险字符正则（控制字符 + 常见危险符号）
+ // 这里排除了 '/' 因为已经拆分了
+ const dangerousCharsPattern = '[\\u0000-\\u001F\\\\*?"\'<>|&;$(){}\\[\\]~!#%+=^:, ]'
+ const dangerousCharsRegex = new RegExp(dangerousCharsPattern, 'g')
+
+ const safeParts = parts.map(part => {
+ const replaced = part.replace(dangerousCharsRegex, replacement)
+ if (!replaced) {
+ throw new Error(`路径段 "${part}" 过滤后为空，可能全部是非法字符`)
+ }
+ return replaced
+ })
+
+ return safeParts.join('/')
+}
diff --git a/package.json b/package.json
index 60a84d37f..8d5677336 100644
--- a/package.json
+++ b/package.json
@@ -85,11 +85,12 @@
"@blueking/cli-service-webpack": "0.0.0-beta.81",
"@blueking/crypto-js-sdk": "^0.0.5",
"@blueking/login-modal": "^1.0.1",
- "@blueking/notice-component-vue2": "^2.0.5",
+ "@blueking/notice-component-vue2": "^2.0.6",
"@blueking/user-selector": "^1.0.7",
"@blueking/platform-config": "1.0.5",
"@blueking/chrome-tips": "0.0.3-beta.3",
"@blueking/bkui-library": "0.0.0-beta.4",
+ "@blueking/xss-filter": "^0.0.10",
"@icon-cool/bk-icon-vue-drag-vis": "^0.2.12",
"@toast-ui/editor": "3.1.8",
"@toast-ui/vue-editor": "3.1.8",
@@ -102,9 +103,8 @@
"ansi_up": "^5.0.0",
"app-root-path": "~3.0.0",
"async-validator": "~1.8.1",
- "aws-sdk": "^2.736.0",
"bk-lesscode-render": "1.0.0-beta.4",
- "axios": "~1.6.0",
+ "axios": "~1.12.0",
"babel-plugin-lodash": "^3.3.4",
"babel-plugin-parameter-decorator": "^1.0.16",
"better-npm-run": "~0.1.1",
@@ -125,7 +125,7 @@
"db-migrate": "^0.11.12",
"db-migrate-mysql": "^2.1.2",
"dexie": "^3.2.3",
- "dompurify": "^3.0.6",
+ "dompurify": "^3.2.6",
"echarts": "~5.4.0",
"element-ui": "~2.15.1",
"enhanced-resolve": "^5.10.0",
@@ -185,7 +185,7 @@
"nodemon": "~1.19.3",
"node-fetch": "^2.6.13",
"npm": "6.14.15",
- "path-to-regexp": "^6.1.0",
+ "path-to-regexp": "^8.3.0",
"pinyin": "^2.11.2",
"postcss": "~8.4.31",
"postcss-import": "^15.0.0",
@@ -208,7 +208,7 @@
"swiper-element-animation": "^1.1.0",
"transliteration": "~2.1.8",
"tslib": "^2.0.3",
- "typeorm": "^0.2.25",
+ "typeorm": "~0.3.27",
"typescript": "^4.4.3",
"unzipper": "~0.10.11",
"vant": "^2.12.39",