diff --git a/lib/client/src/views/project/template-manage/components/render-template.vue b/lib/client/src/views/project/template-manage/components/render-template.vue
index bcfc7811d..090601f86 100644
--- a/lib/client/src/views/project/template-manage/components/render-template.vue
+++ b/lib/client/src/views/project/template-manage/components/render-template.vue
@@ -37,7 +37,7 @@
                                         <i v-if="template.templateType === 'MOBILE'" class="bk-drag-icon bk-drag-mobilephone"> </i>
                                         <i v-else class="bk-drag-icon bk-drag-pc"> </i>
                                     </span>
-                                    <div class="name" v-tooltips="template.templateName">{{template.templateName}}</div>
+                                    <div class="name" v-bk-overflow-tips="{ content: template.templateName }">{{template.templateName}}</div>
                                 </div>
                                 <div class="stat">{{ template.updateUser || template.createUser }}</div>
                             </div>
diff --git a/lib/client/src/views/project/template-manage/components/template-import-dialog.vue b/lib/client/src/views/project/template-manage/components/template-import-dialog.vue
index 54629d2bb..164e92551 100644
--- a/lib/client/src/views/project/template-manage/components/template-import-dialog.vue
+++ b/lib/client/src/views/project/template-manage/components/template-import-dialog.vue
@@ -55,7 +55,7 @@
 <script>
     import { mapGetters } from 'vuex'
     import templateMixin from './template-mixin'
-    import { sanitizeObject } from 'shared/security/property-injection-guard'
+    import { deepClone } from 'shared/security/property-injection-guard'
 
     export default {
         name: 'template-import-dialog',
@@ -130,7 +130,7 @@
         methods: {
             handleUploadSuccess (res) {
                 this.dialog.formData.jsonStr = res.responseData.data
-                this.templateJson = sanitizeObject(JSON.parse(res.responseData.data), true)
+                this.templateJson = deepClone(JSON.parse(res.responseData.data), true)
                 if (typeof this.templateJson.template !== 'object' || typeof this.templateJson.vars !== 'object' || typeof this.templateJson.functions !== 'object') {
                     this.$bkMessage({
                         theme: 'error',
diff --git a/lib/client/src/views/system/components/project-form.vue b/lib/client/src/views/system/components/project-form.vue
index be9c73753..b0a201a87 100644
--- a/lib/client/src/views/system/components/project-form.vue
+++ b/lib/client/src/views/system/components/project-form.vue
@@ -51,7 +51,7 @@
 
 <script>
     import LayoutThumbList from '@/components/project/layout-thumb-list'
-    import { sanitizeObject } from 'shared/security/property-injection-guard'
+    import { deepClone } from 'shared/security/property-injection-guard'
 
     const defaultFormData = {
         projectCode: '',
@@ -178,7 +178,7 @@
             },
             handleUploadSuccess (res) {
                 const dataStr = res.responseData?.data
-                this.importProjectData = sanitizeObject(JSON.parse(dataStr), true)
+                this.importProjectData = deepClone(JSON.parse(dataStr), true)
                 if (typeof this.importProjectData?.route !== 'object' || typeof this.importProjectData?.func !== 'object' || typeof this.importProjectData?.page !== 'object') {
                     this.$bkMessage({
                         theme: 'error',
diff --git a/lib/server/controller/component.js b/lib/server/controller/component.js
index 318147188..a5a25d841 100644
--- a/lib/server/controller/component.js
+++ b/lib/server/controller/component.js
@@ -250,16 +250,18 @@ export const exportComps = async (ctx) => {
     const sourcePath = path.join(STATIC_URL, componentDirName)
     const targetPath = path.join(STATIC_URL, `${componentDirName}.zip`)
 
-    await fse.ensureDir(sourcePath)
-    await compressing.zip.compressDir(sourcePath, targetPath, { ignoreBase: true })
-        .then(async () => {
-            ctx.attachment(targetPath)
-            await send(ctx, targetPath)
-            fse.remove(sourcePath)
-            fse.remove(targetPath)
-        }).catch((err) => {
-            console.log(err)
-        })
+    try {
+        await fse.ensureDir(sourcePath)
+        await compressing.zip.compressDir(sourcePath, targetPath, { ignoreBase: true })
+        ctx.attachment(targetPath)
+        await send(ctx, targetPath)
+    } catch (err) {
+        console.log(err)
+    } finally {
+        // 确保清理临时文件
+        await fse.remove(sourcePath).catch(() => {})
+        await fse.remove(targetPath).catch(() => {})
+    }
 }
 
 export const updatePageComp = async (ctx) => {
@@ -669,11 +671,86 @@ async function safeUnzip (zipFilePath, destDir) {
     const fs = require('fs')
     const fse = require('fs-extra')
 
+    // ZIP 炸弹防护配置
+    const MAX_EXTRACTED_SIZE = 50 * 1024 * 1024 // 50MB - 解压后文件总大小限制
+    const MAX_FILES_COUNT = 1000 // 文件数量限制
+    const MAX_DEPTH = 10 // 目录嵌套深度限制
+    const MAX_COMPRESSION_RATIO = 100 // 最大压缩比（解压后/压缩前）
+
     await fse.ensureDir(destDir)
 
     const directory = await unzipper.Open.file(zipFilePath)
+    
+    // 第一阶段：预检查所有文件（ZIP 炸弹防护）
+    let totalUncompressedSize = 0
+    let totalCompressedSize = 0
+    let fileCount = 0
+    
+    for (const file of directory.files) {
+        // 统计文件数量
+        fileCount++
+        if (fileCount > MAX_FILES_COUNT) {
+            throw new Error(`ZIP 包中文件数量过多，最大允许 ${MAX_FILES_COUNT} 个文件`)
+        }
+        
+        // 累计解压后大小
+        const uncompressedSize = file.uncompressedSize || 0
+        totalUncompressedSize += uncompressedSize
+        if (totalUncompressedSize > MAX_EXTRACTED_SIZE) {
+            throw new Error(`解压后文件总大小超过限制，最大允许 ${MAX_EXTRACTED_SIZE / 1024 / 1024}MB`)
+        }
+        
+        // 累计压缩大小
+        const compressedSize = file.compressedSize || 0
+        totalCompressedSize += compressedSize
+        
+        // 检查目录嵌套深度
+        const pathDepth = file.path.split('/').filter(p => p).length
+        if (pathDepth > MAX_DEPTH) {
+            throw new Error(`文件路径嵌套过深（${pathDepth}层），最大允许 ${MAX_DEPTH} 层`)
+        }
+    }
+    
+    // 检查整体压缩比（防止压缩比异常高的 ZIP 炸弹）
+    if (totalCompressedSize > 0) {
+        const compressionRatio = totalUncompressedSize / totalCompressedSize
+        if (compressionRatio > MAX_COMPRESSION_RATIO) {
+            throw new Error(`检测到异常压缩比（${compressionRatio.toFixed(1)}:1），可能是 ZIP 炸弹攻击`)
+        }
+    }
+    
+    // 第二阶段：执行实际解压
     for (const file of directory.files) {
-        const filePath = filterFilePath(file.path)
+        const rawPath = file.path
+        
+        // 符号链接检测：禁止 ZIP 包中包含符号链接（防止符号链接攻击）
+        if (file.type === 'SymbolicLink') {
+            throw new Error('ZIP 包中不允许包含符号链接')
+        }
+        
+        // URL 编码检测：防止 %2e%2e 等编码绕过路径遍历防护
+        // 1. 直接禁止包含 % 字符的路径
+        if (rawPath.includes('%')) {
+            throw new Error('ZIP 包中的文件路径不允许包含 URL 编码字符')
+        }
+        
+        // 2. 尝试解码并检测是否存在编码后的路径遍历
+        try {
+            const decodedPath = decodeURIComponent(rawPath)
+            // 如果解码后与原路径不同，且包含路径遍历符号
+            if (decodedPath !== rawPath && decodedPath.includes('..')) {
+                throw new Error('检测到 URL 编码的路径遍历攻击')
+            }
+        } catch (e) {
+            // 如果 decodeURIComponent 抛出异常（如非法编码），认为是恶意输入
+            if (e.message && e.message.includes('URI malformed')) {
+                throw new Error('ZIP 包中包含非法的 URL 编码')
+            }
+            // 重新抛出其他异常（包括我们自己抛出的安全检测异常）
+            throw e
+        }
+        
+        const filePath = filterFilePath(rawPath)
         if (!filePath) {
         // 文件名清理后为空，跳过或抛错
             throw new Error('文件名非法，无法解压')
@@ -688,8 +765,26 @@ async function safeUnzip (zipFilePath, destDir) {
             await fse.ensureDir(absolutePath)
         } else {
             await fse.ensureDir(path.dirname(absolutePath))
+            
+            // 实时监控写入大小（额外的运行时检查）
+            let writtenSize = 0
+            const maxFileSize = MAX_EXTRACTED_SIZE // 单个文件最大不超过总限制
+            
             const readStream = file.stream()
             const writeStream = fs.createWriteStream(absolutePath)
+            
+            // 监控写入的数据量
+            readStream.on('data', (chunk) => {
+                writtenSize += chunk.length
+                if (writtenSize > maxFileSize) {
+                    readStream.destroy()
+                    writeStream.destroy()
+                    // 删除部分写入的文件
+                    fs.unlink(absolutePath, () => {})
+                    throw new Error(`单个文件解压后大小超过限制: ${file.path}`)
+                }
+            })
+            
             await new Promise((resolve, reject) => {
                 readStream.pipe(writeStream)
                     .on('finish', resolve)
@@ -714,9 +809,26 @@ export const upload = async (ctx) => {
         }
         const uploadComponent = ctx.request.files.upload_file
 
+        // 1. 文件大小限制检查（最大 5MB）
+        const MAX_FILE_SIZE = 5 * 1024 * 1024 // 5MB
+        if (uploadComponent.size > MAX_FILE_SIZE) {
+            throw new Error('文件大小超过限制，最大支持5MB')
+        }
+
+        // 2. MIME 类型检查
         if (!['application/x-zip', 'application/zip', 'application/x-zip-compressed'].includes(uploadComponent.type)) {
             throw new Error(global.i18n.t('自定义组件上传只支持zip包'))
         }
+
+        // 3. 文件魔术数字检查（防止 MIME 类型伪造）
+        const fileBuffer = fs.readFileSync(uploadComponent.path)
+        const fileSignature = fileBuffer.toString('hex', 0, 4)
+        
+        // ZIP 文件的魔术数字：504B0304 (PK..) 或 504B0506 (空ZIP) 或 504B0708 (跨卷ZIP)
+        const validZipSignatures = ['504b0304', '504b0506', '504b0708']
+        if (!validZipSignatures.includes(fileSignature.toLowerCase())) {
+            throw new Error('文件格式不正确，只支持ZIP格式')
+        }
         let exitComponent = null
         if (id) {
             exitComponent = await ComponentModel.getOne({
diff --git a/lib/server/controller/file.js b/lib/server/controller/file.js
index 7433babe4..d36f89e20 100644
--- a/lib/server/controller/file.js
+++ b/lib/server/controller/file.js
@@ -10,13 +10,11 @@
  */
 
 import path from 'path'
-import fs from 'fs'
 import FileType from 'file-type'
 import md5 from 'md5'
-import { JSDOM } from 'jsdom'
-import DOMPurify from 'dompurify'
 import { LCDataService, TABLE_FILE_NAME } from '../service/common/data-service'
 import fileService from '../utils/file-service/index'
+import { validateNoStrictFile } from '../../shared/security/file-protection'
 import {
     Controller,
     Get,
@@ -86,7 +84,7 @@ export default class FileController {
 
         const fileKey = md5(`${userInfo.username}${projectId}${filePath}${Date.now()}`)
 
-        const noStrictExts = ['doc', 'xls', 'ppt', 'msi', 'csv', 'svg']
+        const noStrictExts = ['doc', 'xls', 'ppt', 'csv', 'svg']
 
         let ext = path.extname(file.name).slice(1)
         let mime = file.type
@@ -97,7 +95,7 @@ export default class FileController {
             mime = typeResult.mime
         }
 
-        if (!ALLOW_UPLOAD_TYPE.includes(ext)) {   
+        if (!ALLOW_UPLOAD_TYPE.includes(ext)) {
             throw new Error('不允许上传该格式类型文件')
         }
 
@@ -108,15 +106,9 @@ export default class FileController {
         }
         file.name = file.name?.replace(/(\||;|&|\\|\$|>|<|`|!|\s+)/gi, '')
 
-        if (mime === 'image/svg+xml') {
-            const svgString = fs.readFileSync(filePath, 'utf-8')
-
-            // 过滤xss
-            const window = new JSDOM('').window
-            const purify = DOMPurify(window)
-            const cleanSvg = purify.sanitize(svgString)
-
-            fs.writeFileSync(filePath, cleanSvg)
+        // 对 noStrictExts 中的文件类型进行安全验证
+        if (noStrictExts.includes(ext)) {
+            await validateNoStrictFile(filePath, ext, mime)
         }
 
         try {
diff --git a/lib/server/controller/page-template.js b/lib/server/controller/page-template.js
index bae2846f1..6df4041f1 100644
--- a/lib/server/controller/page-template.js
+++ b/lib/server/controller/page-template.js
@@ -262,6 +262,48 @@ export const importTemplate = async (ctx) => {
     try {
         const params = ctx.request.body
         params.belongProjectId = ctx.request.headers['x-project-id']
+        
+        // 验证数据结构
+        if (!params.template || typeof params.template !== 'object') {
+            ctx.throwError({
+                message: global.i18n.t('模板数据格式不正确')
+            })
+        }
+        
+        // 验证必需字段
+        const { template, vars = [], functions = [] } = params
+        if (!template.templateName || !template.content || !template.categoryId) {
+            ctx.throwError({
+                message: global.i18n.t('模板缺少必需字段')
+            })
+        }
+        
+        // 验证字段类型
+        if (!Array.isArray(vars) || !Array.isArray(functions)) {
+            ctx.throwError({
+                message: global.i18n.t('变量和函数必须是数组格式')
+            })
+        }
+        
+        // 验证content是否为合法JSON
+        try {
+            const contentObj = typeof template.content === 'string' ? JSON.parse(template.content) : template.content
+            if (typeof contentObj !== 'object') {
+                throw new Error('Invalid content format')
+            }
+        } catch (e) {
+            ctx.throwError({
+                message: global.i18n.t('模板内容格式不正确')
+            })
+        }
+        
+        // 限制数组大小,防止DoS
+        if (vars.length > 100 || functions.length > 100) {
+            ctx.throwError({
+                message: global.i18n.t('导入的变量或函数数量超过限制')
+            })
+        }
+        
         // 模板名称已存在
         const record = await PageTemplateModel.getOne({
             templateName: params?.template?.templateName,
@@ -273,7 +315,8 @@ export const importTemplate = async (ctx) => {
                 message: global.i18n.t('模板名称已存在')
             })
         }
-
+        // 重置一遍这几个字段值
+        Object.assign(params.template, { fromPageCode: '', isOffcial: 0, offcialType: '', parentId: 0 })
         await handleImportTemplate(params)
         ctx.send({
             code: 0,
diff --git a/lib/server/controller/page.js b/lib/server/controller/page.js
index 1832b4713..35fd086ea 100644
--- a/lib/server/controller/page.js
+++ b/lib/server/controller/page.js
@@ -15,8 +15,10 @@ import { LCDataService, TABLE_FILE_NAME } from '../service/common/data-service'
 import { POST_PAGE_CREATE, PUT_PAGE_UPDATE } from '../system-conf/operate-log'
 import { whereVersionLiteral } from '../model/common'
 import iamAppPermModel from '../model/iam-app-perm'
+import { logger } from '../logger'
 
 const fs = require('fs')
+const path = require('path')
 
 export const getPageList = async (ctx) => {
     try {
@@ -551,12 +553,72 @@ async function queryPageDeatail (pageId) {
     return detail
 }
 
+// 导入json文件并返回内容
+// 校验文件魔数（检查文件头是否为合法JSON）
+const validateJsonFileMagic = (filePath) => {
+    const buffer = Buffer.alloc(1024) // 读取前 1KB
+    const fd = fs.openSync(filePath, 'r')
+    try {
+        fs.readSync(fd, buffer, 0, 1024, 0)
+    } finally {
+        fs.closeSync(fd)
+    }
+    
+    // JSON 文件应以 {、[ 或空白符开头
+    const content = buffer.toString('utf8').trim()
+    if (!content.startsWith('{') && !content.startsWith('[')) {
+        throw new Error(global.i18n.t('文件格式不正确，必须是JSON格式'))
+    }
+}
+
 // 导入json文件并返回内容
 export const importJson = async (ctx) => {
+    let tempFilePath = null
+    
     try {
+        // 1. 文件存在性校验
         const file = ctx.request.files || {}
         const uploadFile = file.upload_file || {}
+        
+        if (!uploadFile || !uploadFile.path) {
+            throw new Error(global.i18n.t('未上传文件'))
+        }
+        
+        tempFilePath = uploadFile.path
+        
+        // 2. 文件大小限制 (15MB)
+        const MAX_FILE_SIZE = 15 * 1024 * 1024
+        const stats = fs.statSync(uploadFile.path)
+        if (stats.size > MAX_FILE_SIZE) {
+            throw new Error(global.i18n.t('文件大小超过限制(15MB)'))
+        }
+        
+        // 3. 文件类型校验 (MIME + 扩展名)
+        const allowedMimes = ['application/json', 'text/plain', 'text/json']
+        const fileName = uploadFile.name || uploadFile.filename || ''
+        const ext = path.extname(fileName).toLowerCase()
+        
+        if (ext !== '.json') {
+            throw new Error(global.i18n.t('仅支持 .json 文件'))
+        }
+        
+        if (uploadFile.type && !allowedMimes.includes(uploadFile.type)) {
+            throw new Error(global.i18n.t('文件MIME类型不正确，仅支持JSON格式'))
+        }
+        
+        // 4. 魔数校验（文件头检测）
+        validateJsonFileMagic(uploadFile.path)
+        
+        // 5. 读取文件内容
         const data = fs.readFileSync(uploadFile.path, 'utf8')
+        
+        // 6. JSON 格式校验
+        try {
+            JSON.parse(data)
+        } catch (e) {
+            throw new Error(global.i18n.t('JSON 格式不正确：{{n}}', { n: e.message }))
+        }
+        
         ctx.send({
             code: 0,
             message: 'OK',
@@ -566,6 +628,17 @@ export const importJson = async (ctx) => {
         ctx.throwError({
             message: global.i18n.t('上传失败：{{n}}', { n: err.message })
         })
+    } finally {
+        // 7. 清理临时文件
+        if (tempFilePath) {
+            try {
+                if (fs.existsSync(tempFilePath)) {
+                    fs.unlinkSync(tempFilePath)
+                }
+            } catch (e) {
+                logger.error(`Failed to clean temp file: ${tempFilePath}`, e)
+            }
+        }
     }
 }
 
@@ -606,9 +679,7 @@ const updagePageActiveInfo = async (pageId, activeUser) => {
         updateTime: currentPage.updateTime,
         updateUser: currentPage.updateUser
     }
-    await repository.update({
-        where: { id: currentPage.id }
-    }, updateFields)
+    await repository.update({ id: currentPage.id }, updateFields)
     return Object.assign(currentPage, updateFields)
 }
 
@@ -687,9 +758,7 @@ export const releasePage = async ctx => {
         const currentPage = await repository.findOne({ where: { id: pageId } }) || {}
 
         if (activeUser === currentPage.activeUser) {
-            await repository.update({
-                where: { id: currentPage.id }
-            }, {
+            await repository.update({ id: currentPage.id }, {
                 activeUser: null,
                 updateTime: currentPage.updateTime,
                 updateUser: currentPage.updateUser
diff --git a/lib/server/controller/project-code.js b/lib/server/controller/project-code.js
index d36eb9d08..4c2cf02ce 100644
--- a/lib/server/controller/project-code.js
+++ b/lib/server/controller/project-code.js
@@ -29,6 +29,12 @@ const ProjectCode = {
             let pathName = `bklesscode-project-${projectCode}-${projectId}${versionId ? `-${versionName}` : ''}`
             // 去除路径名中的./\符号
             pathName = pathName?.replace(/[./\\]/g, '_')
+            
+            // 确保 pathName 只包含安全字符
+            if (!/^[a-zA-Z0-9_-]+$/.test(pathName)) {
+                throw new Error('路径名包含非法字符')
+            }
+            
             await ProjectCodeModel.generateCode(projectId, versionId || undefined, pathName)
 
             const sourcePath = path.join(STATIC_URL, pathName)
diff --git a/lib/server/controller/project.js b/lib/server/controller/project.js
index 2ddb26ab7..0e1268571 100644
--- a/lib/server/controller/project.js
+++ b/lib/server/controller/project.js
@@ -165,24 +165,33 @@ module.exports = {
     // 导出应用
     async exportProject (ctx) {
         let projectId = ctx.request.query?.projectId
-        projectId = parseInt(projectId)
+        projectId = parseInt(projectId, 10)
+        
+        // 参数有效性校验
+        if (!projectId || isNaN(projectId) || projectId <= 0) {
+            ctx.throw(400, global.i18n.t('无效的项目ID'))
+        }
+        
         const versionId = null
 
         const pathName = `lesscode-project-${projectId}.json`
         const targetPath = path.join(STATIC_URL, pathName)
         
-        const exportData = await getExportProjectData(projectId, versionId)
-        const exportDataStr = JSON.stringify(exportData)
+        try {
+            const exportData = await getExportProjectData(projectId, versionId)
+            const exportDataStr = JSON.stringify(exportData)
 
-        await fse.ensureFile(targetPath).then(async () => {
+            await fse.ensureFile(targetPath)
             fse.writeFileSync(targetPath, exportDataStr, 'utf8')
             ctx.attachment(targetPath)
             await send(ctx, targetPath)
-            fse.remove(targetPath)
-        }).catch(err => {
+        } catch (err) {
             console.log('导出应用失败err', err)
             ctx.throw(global.i18n.t('导出应用失败'))
-        })
+        } finally {
+            // 确保清理临时文件
+            await fse.remove(targetPath).catch(() => {})
+        }
     },
 
     async queryProject (ctx) {
diff --git a/lib/server/model/project-code.js b/lib/server/model/project-code.js
index 5555d7a61..c93641523 100644
--- a/lib/server/model/project-code.js
+++ b/lib/server/model/project-code.js
@@ -671,7 +671,7 @@ const projectCode = {
                     path.join(targetPath, 'lib/server/controller/flow.js'),
                     path.join(targetPath, 'lib/server/controller/flow.js'),
                     (content) => {
-                        return content.replace(/\$\{spaceId\}/, spaceData.bkFlowSpaceId || 0)
+                        return content.replace(/\$\{spaceId\}/, spaceData?.bkFlowSpaceId || 0)
                     }
                 )
                 await this.generateFileByReplace(
diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js b/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js
index f621c7876..cc465a6f3 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js
@@ -24,6 +24,7 @@ import {
     filterTableDataWithKeys
 } from '../service/form'
 import dataSourceController from './data-source'
+import { enhancedSqlSecurityCheck } from '../service/open-api'
 import { METHODS_WITHOUT_DATA } from '../../shared/constant'
 
 @Controller('/api/open-api')
@@ -157,33 +158,8 @@ export default class OpenApiController {
         @BodyParams({ name: 'sql' }) sql
     ) {
         try {
-            // 涉及到表变更sql的关键词
-            const sqlKeywords = ['DROP DATABASE', 'TRRUNCATE TABLE', 'DROP TABLE', 'DELETE FROM', 'CREATE TABLE', 'ALTER TABLE', 'INSERT INTO']
-            const upperCaseSql = sql.toUpperCase()
-            // 此接口只能执行查询语句，禁止执行任何涉及表变更的语句
-            if (!upperCaseSql || !upperCaseSql.startsWith('SELECT ') || sqlKeywords.indexOf(upperCaseSql) !== -1) {
-                throw new global.BusinessError('sql语句未以SELECT开头或含有变更数据表的危险关键词', -1, 400)
-            }
-            return await dataService.execSql(sql)
-        } catch (e) {
-            throw new global.BusinessError(e.sqlMessage || e.message || '执行查询sql失败', -1, 500)
-        }
-    }
-
-    // 执行sql获取某张表下数据
-    @OutputJson()
-    @Post('/execQuerySql')
-    async execQuerySql (
-        @BodyParams({ name: 'sql' }) sql
-    ) {
-        try {
-            // 涉及到表变更sql的关键词
-            const sqlKeywords = ['DROP DATABASE', 'TRRUNCATE TABLE', 'DROP TABLE', 'DELETE FROM', 'CREATE TABLE', 'ALTER TABLE', 'INSERT INTO']
-            const upperCaseSql = sql && sql.toUpperCase()
-            // 此接口只能执行查询语句，禁止执行任何涉及表变更的语句
-            if (!upperCaseSql || !upperCaseSql.startsWith('SELECT') || sqlKeywords.indexOf(upperCaseSql) !== -1) {
-                throw new global.BusinessError('sql语句未以SELECT开头或含有变更数据表的危险关键词', -1, 400)
-            }
+            // 使用增强的SQL安全检查函数
+            enhancedSqlSecurityCheck(sql)
             return await dataService.execSql(sql)
         } catch (e) {
             throw new global.BusinessError(e.sqlMessage || e.message || '执行查询sql失败', -1, 500)
diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js b/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
index 3890b83da..0f6b25aaa 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
@@ -81,11 +81,19 @@ export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
     return Array.isArray(data) ? transferList : transferList[0]
 }
 
-// 只能是查询语句检查
+// 只能是查询语句检查 - 增强版本
 export const querySqlCheck = (sql) => {
-    if (!/;$/.test(sql.trim())) {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    
+    if (!/;$/.test(trimmedSql)) {
         throw new Error('Sql 语句不完整，需要是【;】号结尾')
     }
+
+    // 基础检查列表（保持原有逻辑）
     const checkList = [
         { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
         { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
@@ -96,30 +104,76 @@ export const querySqlCheck = (sql) => {
         { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
         { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
     ]
+
+    // 增强的安全检查列表
+    const enhancedCheckList = [
+        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
+        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
+        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
+        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
+        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
+        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
+        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
+        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
+        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
+        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
+        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
+        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
+        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
+        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
+        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
+        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
+        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
+        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
+        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
+        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
+        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
+        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
+        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
+        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
+    ]
+
     const sqlArr = splitSql(sql)
     sqlArr.forEach((sqlStr) => {
         const lowerCaseSql = sqlStr.trim().toLowerCase()
         if (lowerCaseSql) {
+            // 执行原有检查
             checkList.forEach((checkItem) => {
                 if (checkItem.check(lowerCaseSql)) {
                     throw new Error(checkItem.message)
                 }
             })
+
+            // 执行增强检查
+            enhancedCheckList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
         }
     })
 }
 
 // sql 解码
 export const decodeSql = (sql, params) => {
-    let decodedSql = decode(sql)
-    const paramKeys = Object.keys(params || {})
-    if (paramKeys.length > 0) {
-        paramKeys.forEach((paramKey) => {
-            const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
-            decodedSql = decodedSql.replace(reg, params[paramKey])
-        })
+    try {
+        let decodedSql = decode(sql)
+
+        if (!decodedSql || typeof decodedSql !== 'string') {
+            throw new Error('无效的SQL语句')
+        }
+        
+        const paramKeys = Object.keys(params || {})
+        if (paramKeys.length > 0) {
+            paramKeys.forEach((paramKey) => {
+                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
+                decodedSql = decodedSql.replace(reg, params[paramKey])
+            })
+        }
+        return decodedSql
+    } catch (error) {
+        throw new Error(`SQL解码失败: ${error.message}`)
     }
-    return decodedSql
 }
 
 @EventSubscriber()
diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js b/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
index d8433fdb3..400f878cc 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
@@ -3,6 +3,89 @@ import {
     decodeToken
 } from '@bkui/apigateway-nodejs-sdk'
 
+/**
+ * 增强的SQL安全检查函数
+ * @param {string} sql SQL语句
+ * @throws {Error} 如果检测到危险模式
+ */
+export const enhancedSqlSecurityCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    const upperCaseSql = trimmedSql.toUpperCase()
+
+    // 基本检查：必须以SELECT开头
+    if (!upperCaseSql.startsWith('SELECT')) {
+        throw new Error('仅支持SELECT查询语句')
+    }
+
+    // 危险关键词检查（更全面）
+    const dangerousKeywords = [
+        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
+        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
+        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
+        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
+    ]
+    
+    for (const keyword of dangerousKeywords) {
+        if (upperCaseSql.includes(keyword)) {
+            throw new Error(`检测到危险关键词: ${keyword}`)
+        }
+    }
+
+    // 危险模式检查
+    const dangerousPatterns = [
+        /UNION\s+SELECT/i, // UNION注入
+        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
+        /XP_CMDSHELL/i, // SQL Server命令执行
+        /SP_EXECUTESQL/i, // SQL Server动态SQL
+        /EXEC\s*\(/i, // 执行函数
+        /EXECUTE\s*\(/i, // 执行函数
+        /INFORMATION_SCHEMA/i, // 信息模式
+        /PERFORMANCE_SCHEMA/i, // 性能模式
+        /MYSQL\./i, // MySQL系统表
+        /\@\@/, // 系统变量
+        /DATABASE\(\)/i, // 数据库函数
+        /USER\(\)/i, // 用户函数
+        /VERSION\(\)/i, // 版本函数
+        /BENCHMARK\s*\(/i, // 基准测试函数
+        /SLEEP\s*\(/i, // 延时函数
+        /WAITFOR\s+DELAY/i, // SQL Server延时
+        /PG_SLEEP\s*\(/i, // PostgreSQL延时
+        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
+        /INTO\s+OUTFILE/i, // 文件写入
+        /INTO\s+DUMPFILE/i, // 文件转储
+        /LOAD_FILE\s*\(/i, // 文件读取
+        /CHAR\s*\(/i, // 字符编码绕过
+        /ASCII\s*\(/i, // ASCII编码绕过
+        /HEX\s*\(/i, // 十六进制编码绕过
+        /UNHEX\s*\(/i, // 反十六进制编码
+        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
+        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
+        /MID\s*\(/i, // 中间字符串
+        /LEFT\s*\(/i, // 左侧字符串
+        /RIGHT\s*\(/i, // 右侧字符串
+        /IF\s*\(/i, // 条件函数（可能用于盲注）
+        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
+        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
+        /UPDATEXML\s*\(/i, // XML更新函数
+        /NAME_CONST\s*\(/i, // 名称常量函数
+        /MULTIPOINT\s*\(/i, // 几何函数
+        /POLYGON\s*\(/i, // 多边形函数
+        /MULTIPOLYGON\s*\(/i, // 多多边形函数
+        /LINESTRING\s*\(/i, // 线字符串函数
+        /MULTILINESTRING\s*\(/i // 多线字符串函数
+    ]
+
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(sql)) {
+            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
+        }
+    }
+}
+
 export const getUserFromApiGW = async (jwt) => {
     const { user } = await decodeToken(jwt, bkToken)
     if (!user) {
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js b/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js
index 7594a467b..8823a2869 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js
@@ -24,6 +24,7 @@ import {
     filterTableDataWithKeys
 } from '../service/form'
 import dataSourceController from './data-source'
+import { enhancedSqlSecurityCheck } from '../service/open-api'
 import { METHODS_WITHOUT_DATA } from '../../shared/constant'
 
 @Controller('/api/open-api')
@@ -156,13 +157,8 @@ export default class OpenApiController {
         @BodyParams({ name: 'sql' }) sql
     ) {
         try {
-            // 涉及到表变更sql的关键词
-            const sqlKeywords = ['DROP DATABASE', 'TRRUNCATE TABLE', 'DROP TABLE', 'DELETE FROM', 'CREATE TABLE', 'ALTER TABLE', 'INSERT INTO']
-            const upperCaseSql = sql && sql.toUpperCase()
-            // 此接口只能执行查询语句，禁止执行任何涉及表变更的语句
-            if (!upperCaseSql || !upperCaseSql.startsWith('SELECT') || sqlKeywords.indexOf(upperCaseSql) !== -1) {
-                throw new global.BusinessError('sql语句未以SELECT开头或含有变更数据表的危险关键词', -1, 400)
-            }
+            // 使用增强的SQL安全检查函数
+            enhancedSqlSecurityCheck(sql)
             return await dataService.execSql(sql)
         } catch (e) {
             throw new global.BusinessError(e.sqlMessage || e.message || '执行查询sql失败', -1, 500)
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js b/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
index 3890b83da..0f6b25aaa 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
@@ -81,11 +81,19 @@ export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
     return Array.isArray(data) ? transferList : transferList[0]
 }
 
-// 只能是查询语句检查
+// 只能是查询语句检查 - 增强版本
 export const querySqlCheck = (sql) => {
-    if (!/;$/.test(sql.trim())) {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    
+    if (!/;$/.test(trimmedSql)) {
         throw new Error('Sql 语句不完整，需要是【;】号结尾')
     }
+
+    // 基础检查列表（保持原有逻辑）
     const checkList = [
         { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
         { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
@@ -96,30 +104,76 @@ export const querySqlCheck = (sql) => {
         { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
         { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
     ]
+
+    // 增强的安全检查列表
+    const enhancedCheckList = [
+        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
+        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
+        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
+        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
+        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
+        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
+        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
+        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
+        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
+        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
+        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
+        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
+        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
+        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
+        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
+        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
+        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
+        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
+        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
+        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
+        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
+        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
+        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
+        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
+    ]
+
     const sqlArr = splitSql(sql)
     sqlArr.forEach((sqlStr) => {
         const lowerCaseSql = sqlStr.trim().toLowerCase()
         if (lowerCaseSql) {
+            // 执行原有检查
             checkList.forEach((checkItem) => {
                 if (checkItem.check(lowerCaseSql)) {
                     throw new Error(checkItem.message)
                 }
             })
+
+            // 执行增强检查
+            enhancedCheckList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
         }
     })
 }
 
 // sql 解码
 export const decodeSql = (sql, params) => {
-    let decodedSql = decode(sql)
-    const paramKeys = Object.keys(params || {})
-    if (paramKeys.length > 0) {
-        paramKeys.forEach((paramKey) => {
-            const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
-            decodedSql = decodedSql.replace(reg, params[paramKey])
-        })
+    try {
+        let decodedSql = decode(sql)
+
+        if (!decodedSql || typeof decodedSql !== 'string') {
+            throw new Error('无效的SQL语句')
+        }
+        
+        const paramKeys = Object.keys(params || {})
+        if (paramKeys.length > 0) {
+            paramKeys.forEach((paramKey) => {
+                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
+                decodedSql = decodedSql.replace(reg, params[paramKey])
+            })
+        }
+        return decodedSql
+    } catch (error) {
+        throw new Error(`SQL解码失败: ${error.message}`)
     }
-    return decodedSql
 }
 
 @EventSubscriber()
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js b/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
index d8433fdb3..400f878cc 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
@@ -3,6 +3,89 @@ import {
     decodeToken
 } from '@bkui/apigateway-nodejs-sdk'
 
+/**
+ * 增强的SQL安全检查函数
+ * @param {string} sql SQL语句
+ * @throws {Error} 如果检测到危险模式
+ */
+export const enhancedSqlSecurityCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    const upperCaseSql = trimmedSql.toUpperCase()
+
+    // 基本检查：必须以SELECT开头
+    if (!upperCaseSql.startsWith('SELECT')) {
+        throw new Error('仅支持SELECT查询语句')
+    }
+
+    // 危险关键词检查（更全面）
+    const dangerousKeywords = [
+        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
+        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
+        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
+        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
+    ]
+    
+    for (const keyword of dangerousKeywords) {
+        if (upperCaseSql.includes(keyword)) {
+            throw new Error(`检测到危险关键词: ${keyword}`)
+        }
+    }
+
+    // 危险模式检查
+    const dangerousPatterns = [
+        /UNION\s+SELECT/i, // UNION注入
+        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
+        /XP_CMDSHELL/i, // SQL Server命令执行
+        /SP_EXECUTESQL/i, // SQL Server动态SQL
+        /EXEC\s*\(/i, // 执行函数
+        /EXECUTE\s*\(/i, // 执行函数
+        /INFORMATION_SCHEMA/i, // 信息模式
+        /PERFORMANCE_SCHEMA/i, // 性能模式
+        /MYSQL\./i, // MySQL系统表
+        /\@\@/, // 系统变量
+        /DATABASE\(\)/i, // 数据库函数
+        /USER\(\)/i, // 用户函数
+        /VERSION\(\)/i, // 版本函数
+        /BENCHMARK\s*\(/i, // 基准测试函数
+        /SLEEP\s*\(/i, // 延时函数
+        /WAITFOR\s+DELAY/i, // SQL Server延时
+        /PG_SLEEP\s*\(/i, // PostgreSQL延时
+        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
+        /INTO\s+OUTFILE/i, // 文件写入
+        /INTO\s+DUMPFILE/i, // 文件转储
+        /LOAD_FILE\s*\(/i, // 文件读取
+        /CHAR\s*\(/i, // 字符编码绕过
+        /ASCII\s*\(/i, // ASCII编码绕过
+        /HEX\s*\(/i, // 十六进制编码绕过
+        /UNHEX\s*\(/i, // 反十六进制编码
+        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
+        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
+        /MID\s*\(/i, // 中间字符串
+        /LEFT\s*\(/i, // 左侧字符串
+        /RIGHT\s*\(/i, // 右侧字符串
+        /IF\s*\(/i, // 条件函数（可能用于盲注）
+        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
+        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
+        /UPDATEXML\s*\(/i, // XML更新函数
+        /NAME_CONST\s*\(/i, // 名称常量函数
+        /MULTIPOINT\s*\(/i, // 几何函数
+        /POLYGON\s*\(/i, // 多边形函数
+        /MULTIPOLYGON\s*\(/i, // 多多边形函数
+        /LINESTRING\s*\(/i, // 线字符串函数
+        /MULTILINESTRING\s*\(/i // 多线字符串函数
+    ]
+
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(sql)) {
+            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
+        }
+    }
+}
+
 export const getUserFromApiGW = async (jwt) => {
     const { user } = await decodeToken(jwt, bkToken)
     if (!user) {
diff --git a/lib/server/service/common/data-service.js b/lib/server/service/common/data-service.js
index 03e8d10ab..b53d12318 100644
--- a/lib/server/service/common/data-service.js
+++ b/lib/server/service/common/data-service.js
@@ -365,7 +365,7 @@ export function getDataService (name = 'default', customEntityMap) {
             const repository = getRepositoryByName(tableFileName)
             try {
                 const { id, ...rest } = data
-                const { affected = 0 } = await repository.update({ where: transformQuery(where) }, transformData(rest, repository.metadata.columns))
+                const { affected = 0 } = await repository.update(transformQuery(where), transformData(rest, repository.metadata.columns))
                 return affected
             } catch (error) {
                 throw new Error(error.sqlMessage || error)
@@ -392,7 +392,7 @@ export function getDataService (name = 'default', customEntityMap) {
                 }
             }
             try {
-                const { affected = 0 } = await repository.update({ where: { id: data.id } }, transformData(editData, repository.metadata.columns))
+                const { affected = 0 } = await repository.update({ id: data.id }, transformData(editData, repository.metadata.columns))
                 return affected
             } catch (error) {
                 throw new Error(error.sqlMessage || error)
@@ -425,7 +425,7 @@ export function getDataService (name = 'default', customEntityMap) {
 
             try {
                 const transformList = transformData(editDataList, repository.metadata.columns)
-                const updateResult = await Promise.all(transformList.map((data) => repository.update({ where: { id: data.id } }, data)))
+                const updateResult = await Promise.all(transformList.map((data) => repository.update({ id: data.id }, data)))
                 return updateResult.reduce((acc, { affected }) => {
                     acc += affected
                     return acc
diff --git a/lib/server/utils/file-service/index.js b/lib/server/utils/file-service/index.js
index df159424f..3a05a54fe 100644
--- a/lib/server/utils/file-service/index.js
+++ b/lib/server/utils/file-service/index.js
@@ -1,3 +1,5 @@
+import { sanitizeUploadPath } from '../../../shared/security/file-protection'
+
 const fs = require('fs')
 const request = require('request')
 const path = require('path')
@@ -76,7 +78,15 @@ const downloadFile = (targetFile, dest) => {
     checkBkRepoSetting()
     const fse = require('fs-extra')
 
+    // 安全过滤 targetFile 路径
+    targetFile = sanitizeUploadPath(targetFile)
+    if (!targetFile) {
+        return Promise.reject(new Error(global.i18n.t('文件路径无效')))
+    }
+
     if (dest) {
+        // 确保 dest 是规范化的绝对路径
+        dest = path.resolve(dest)
         const destParent = path.dirname(dest)
         fse.ensureDirSync(destParent)
     }
@@ -174,9 +184,8 @@ const uploadImage = async (filePath, uploadKey, settings = {}) => {
  * @returns {Promise} 文件存储路径
  */
 const uploadRepoFile = async (uploadPath, fileStream, settings = {}) => {
-    // 把..过滤掉， 避免相对路径, 过滤危险字符
-    uploadPath = uploadPath?.replaceAll('..', '')
-    uploadPath = uploadPath?.replace(/(\||;|&|\\|\$|>|<|`|!|\s+)/gi, '')
+    // 安全过滤上传路径
+    uploadPath = sanitizeUploadPath(uploadPath)
     const url = getUrl(uploadPath, settings.isPublic)
     const options = {
         url,
diff --git a/lib/shared/security/file-protection.js b/lib/shared/security/file-protection.js
new file mode 100644
index 000000000..308abd949
--- /dev/null
+++ b/lib/shared/security/file-protection.js
@@ -0,0 +1,197 @@
+/**
+ * 文件安全保护模块
+ * 对 noStrictExts 中的文件类型进行安全验证
+ */
+
+import fs from 'fs'
+import FileType from 'file-type'
+import { JSDOM } from 'jsdom'
+import DOMPurify from 'dompurify'
+
+/**
+ * 安全过滤上传路径
+ * @param {string} uploadPath - 原始路径
+ * @returns {string} 过滤后的安全路径
+ */
+export function sanitizeUploadPath (uploadPath) {
+    if (!uploadPath) return ''
+    
+    // 移除所有路径遍历尝试
+    uploadPath = uploadPath.replace(/\.\./g, '')
+    uploadPath = uploadPath.replace(/[\/\\]+/g, '/') // 统一路径分隔符
+    uploadPath = uploadPath.replace(/^\/+/, '') // 移除开头的斜杠
+    
+    // 过滤危险字符（包括控制字符）
+    // eslint-disable-next-line no-control-regex
+    uploadPath = uploadPath.replace(/[\x00-\x1f\x7f-\x9f]/g, '') // 控制字符
+    uploadPath = uploadPath.replace(/[|;&\\$><`!%\s]/g, '') // 危险字符
+    
+    return uploadPath
+}
+
+/**
+ * 验证 noStrictExts 文件类型的安全性
+ * @param {string} filePath - 文件路径
+ * @param {string} ext - 文件扩展名
+ * @param {string} mime - MIME 类型
+ * @throws {Error} 验证失败时抛出错误
+ */
+export async function validateNoStrictFile (filePath, ext, mime) {
+    if (!filePath || !fs.existsSync(filePath)) {
+        throw new Error('文件不存在或路径无效')
+    }
+
+    switch (ext.toLowerCase()) {
+        case 'svg':
+            await validateSvgFile(filePath)
+            break
+        case 'csv':
+            await validateCsvFile(filePath)
+            break
+        case 'doc':
+        case 'xls':
+        case 'ppt':
+            await validateOfficeFile(filePath, ext)
+            break
+        default:
+            // 对于其他 noStrictExts 中的文件类型，进行基本验证
+            break
+    }
+}
+
+/**
+ * 验证 SVG 文件安全性
+ * @param {string} filePath - SVG 文件路径
+ */
+async function validateSvgFile (filePath) {
+    try {
+        const svgContent = fs.readFileSync(filePath, 'utf-8')
+        
+        // 检查 SVG 复杂度（防止 DoS 攻击）
+        const elementCount = (svgContent.match(/<[^>]+>/g) || []).length
+        if (elementCount > 1000) {
+            throw new Error('SVG 文件过于复杂，可能存在 DoS 风险')
+        }
+        
+        // 使用 DOMPurify 进行清理
+        const window = new JSDOM('').window
+        const purify = DOMPurify(window)
+        const cleanSvg = purify.sanitize(svgContent)
+        
+        // 将清理后的内容写回文件
+        fs.writeFileSync(filePath, cleanSvg)
+    } catch (error) {
+        if (error.message.includes('SVG')) {
+            throw error
+        }
+        throw new Error('SVG 文件格式验证失败')
+    }
+}
+
+/**
+ * 验证 CSV 文件安全性
+ * @param {string} filePath - CSV 文件路径
+ */
+async function validateCsvFile (filePath) {
+    try {
+        const csvContent = fs.readFileSync(filePath, 'utf-8')
+        
+        // 检查 CSV 注入攻击模式
+        const injectionPatterns = [
+            /^[\s]*[=@+\-]/gm, // 公式注入
+            /cmd\s*\|/gi, // 命令注入
+            /powershell/gi, // PowerShell 命令
+            /\|.*calc/gi, // 计算器调用
+            /\|.*notepad/gi // 记事本调用
+        ]
+        
+        for (const pattern of injectionPatterns) {
+            if (pattern.test(csvContent)) {
+                throw new Error('CSV 文件包含潜在的注入攻击内容')
+            }
+        }
+        
+        // 检查是否包含可疑的公式
+        const lines = csvContent.split('\n')
+        for (const line of lines) {
+            const cells = line.split(',')
+            for (const cell of cells) {
+                const trimmedCell = cell.trim()
+                if (trimmedCell.startsWith('=') || trimmedCell.startsWith('@')
+                    || trimmedCell.startsWith('+') || trimmedCell.startsWith('-')) {
+                    // 进一步检查是否为恶意公式
+                    if (/\b(cmd|powershell|calc|notepad|system|exec)\b/i.test(trimmedCell)) {
+                        throw new Error('CSV 文件包含恶意公式')
+                    }
+                }
+            }
+        }
+    } catch (error) {
+        if (error.message.includes('CSV')) {
+            throw error
+        }
+        throw new Error('CSV 文件格式验证失败')
+    }
+}
+
+/**
+ * 验证 Office 文档安全性
+ * @param {string} filePath - Office 文档路径
+ * @param {string} ext - 文件扩展名
+ */
+async function validateOfficeFile (filePath, ext) {
+    try {
+        // 使用 file-type 库验证文件的真实类型
+        const typeResult = await FileType.fromFile(filePath)
+        
+        if (!typeResult) {
+            throw new Error(`无法识别 ${ext.toUpperCase()} 文件的真实类型`)
+        }
+        
+        // 验证文件头是否符合预期的 Office 文档格式
+        const validMimeTypes = {
+            'doc': ['application/msword'],
+            'xls': ['application/vnd.ms-excel'],
+            'ppt': ['application/vnd.ms-powerpoint']
+        }
+        
+        const expectedMimes = validMimeTypes[ext.toLowerCase()]
+        if (expectedMimes && !expectedMimes.includes(typeResult.mime)) {
+            // 对于新版本的 Office 文档，检查是否为 ZIP 格式（docx, xlsx, pptx 的基础格式）
+            if (typeResult.mime !== 'application/zip') {
+                throw new Error(`${ext.toUpperCase()} 文件类型验证失败，实际类型为 ${typeResult.mime}`)
+            }
+        }
+        
+        // 读取文件头进行进一步验证
+        const buffer = fs.readFileSync(filePath)
+        const header = buffer.slice(0, 8)
+        
+        // 检查 Office 文档的魔数
+        const officeSignatures = {
+            'doc': [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1], // OLE2 格式
+            'xls': [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1], // OLE2 格式
+            'ppt': [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1] // OLE2 格式
+        }
+        
+        const expectedSignature = officeSignatures[ext.toLowerCase()]
+        if (expectedSignature) {
+            const headerMatches = expectedSignature.every((byte, index) => header[index] === byte)
+            
+            // 如果不是 OLE2 格式，检查是否为 ZIP 格式（新版本 Office 文档）
+            if (!headerMatches) {
+                const zipSignature = [0x50, 0x4B, 0x03, 0x04] // ZIP 文件头
+                const isZip = zipSignature.every((byte, index) => header[index] === byte)
+                
+                if (!isZip) {
+                    throw new Error(`${ext.toUpperCase()} 文件头验证失败`)
+                }
+            }
+        }
+    } catch (error) {
+        if (error.message.includes('文件') || error.message.includes('类型') || error.message.includes('验证')) {
+            throw error
+        }
+        throw new Error(`${ext.toUpperCase()} 文件安全验证失败`)
+    }
+}