From 997cc0723c848bc75b7fb26313cf14528d18fd68 Mon Sep 17 00:00:00 2001
From: LivySara <1936808975@qq.com>
Date: Mon, 2 Feb 2026 09:57:30 +0800
Subject: [PATCH 1/4] =?UTF-8?q?fix=EF=BC=9Ajson=E5=8E=9F=E5=9E=8B=E6=B1=A1?=
 =?UTF-8?q?=E6=9F=93=E9=98=B2=E6=8A=A4=E4=BF=AE=E6=AD=A3=20=20---story=3D1?=
 =?UTF-8?q?30244063?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../template-manage/components/template-import-dialog.vue     | 4 ++--
 lib/client/src/views/system/components/project-form.vue       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/client/src/views/project/template-manage/components/template-import-dialog.vue b/lib/client/src/views/project/template-manage/components/template-import-dialog.vue
index 54629d2bb..164e92551 100644
--- a/lib/client/src/views/project/template-manage/components/template-import-dialog.vue
+++ b/lib/client/src/views/project/template-manage/components/template-import-dialog.vue
@@ -55,7 +55,7 @@
 <script>
     import { mapGetters } from 'vuex'
     import templateMixin from './template-mixin'
-    import { sanitizeObject } from 'shared/security/property-injection-guard'
+    import { deepClone } from 'shared/security/property-injection-guard'
 
     export default {
         name: 'template-import-dialog',
@@ -130,7 +130,7 @@
         methods: {
             handleUploadSuccess (res) {
                 this.dialog.formData.jsonStr = res.responseData.data
-                this.templateJson = sanitizeObject(JSON.parse(res.responseData.data), true)
+                this.templateJson = deepClone(JSON.parse(res.responseData.data), true)
                 if (typeof this.templateJson.template !== 'object' || typeof this.templateJson.vars !== 'object' || typeof this.templateJson.functions !== 'object') {
                     this.$bkMessage({
                         theme: 'error',
diff --git a/lib/client/src/views/system/components/project-form.vue b/lib/client/src/views/system/components/project-form.vue
index be9c73753..b0a201a87 100644
--- a/lib/client/src/views/system/components/project-form.vue
+++ b/lib/client/src/views/system/components/project-form.vue
@@ -51,7 +51,7 @@
 
 <script>
     import LayoutThumbList from '@/components/project/layout-thumb-list'
-    import { sanitizeObject } from 'shared/security/property-injection-guard'
+    import { deepClone } from 'shared/security/property-injection-guard'
 
     const defaultFormData = {
         projectCode: '',
@@ -178,7 +178,7 @@
             },
             handleUploadSuccess (res) {
                 const dataStr = res.responseData?.data
-                this.importProjectData = sanitizeObject(JSON.parse(dataStr), true)
+                this.importProjectData = deepClone(JSON.parse(dataStr), true)
                 if (typeof this.importProjectData?.route !== 'object' || typeof this.importProjectData?.func !== 'object' || typeof this.importProjectData?.page !== 'object') {
                     this.$bkMessage({
                         theme: 'error',

From d87a9d455c41a0350524a74f35b71bf5764769d6 Mon Sep 17 00:00:00 2001
From: LivySara <1936808975@qq.com>
Date: Mon, 2 Feb 2026 10:02:39 +0800
Subject: [PATCH 2/4] =?UTF-8?q?fix=EF=BC=9A=E6=A8=A1=E6=9D=BF=E9=A1=B9?=
 =?UTF-8?q?=E7=9B=AEsql=E9=98=B2=E6=8A=A4=E7=AD=89=E4=BF=AE=E6=AD=A3=20---?=
 =?UTF-8?q?story=3D130244026?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/server/model/project-code.js              |   2 +-
 .../lib/server/controller/open-api.js         |  30 +-
 .../lib/server/service/data-source.js         | 532 ++++++++++--------
 .../lib/server/service/open-api.js            | 131 ++++-
 .../lib/server/controller/open-api.js         |  10 +-
 .../lib/server/service/data-source.js         | 532 ++++++++++--------
 .../lib/server/service/open-api.js            | 131 ++++-
 lib/server/service/common/data-service.js     |   6 +-
 8 files changed, 810 insertions(+), 564 deletions(-)

diff --git a/lib/server/model/project-code.js b/lib/server/model/project-code.js
index 5555d7a61..c93641523 100644
--- a/lib/server/model/project-code.js
+++ b/lib/server/model/project-code.js
@@ -671,7 +671,7 @@ const projectCode = {
                     path.join(targetPath, 'lib/server/controller/flow.js'),
                     path.join(targetPath, 'lib/server/controller/flow.js'),
                     (content) => {
-                        return content.replace(/\$\{spaceId\}/, spaceData.bkFlowSpaceId || 0)
+                        return content.replace(/\$\{spaceId\}/, spaceData?.bkFlowSpaceId || 0)
                     }
                 )
                 await this.generateFileByReplace(
diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js b/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js
index f621c7876..cc465a6f3 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/controller/open-api.js
@@ -24,6 +24,7 @@ import {
     filterTableDataWithKeys
 } from '../service/form'
 import dataSourceController from './data-source'
+import { enhancedSqlSecurityCheck } from '../service/open-api'
 import { METHODS_WITHOUT_DATA } from '../../shared/constant'
 
 @Controller('/api/open-api')
@@ -157,33 +158,8 @@ export default class OpenApiController {
         @BodyParams({ name: 'sql' }) sql
     ) {
         try {
-            // 涉及到表变更sql的关键词
-            const sqlKeywords = ['DROP DATABASE', 'TRRUNCATE TABLE', 'DROP TABLE', 'DELETE FROM', 'CREATE TABLE', 'ALTER TABLE', 'INSERT INTO']
-            const upperCaseSql = sql.toUpperCase()
-            // 此接口只能执行查询语句，禁止执行任何涉及表变更的语句
-            if (!upperCaseSql || !upperCaseSql.startsWith('SELECT ') || sqlKeywords.indexOf(upperCaseSql) !== -1) {
-                throw new global.BusinessError('sql语句未以SELECT开头或含有变更数据表的危险关键词', -1, 400)
-            }
-            return await dataService.execSql(sql)
-        } catch (e) {
-            throw new global.BusinessError(e.sqlMessage || e.message || '执行查询sql失败', -1, 500)
-        }
-    }
-
-    // 执行sql获取某张表下数据
-    @OutputJson()
-    @Post('/execQuerySql')
-    async execQuerySql (
-        @BodyParams({ name: 'sql' }) sql
-    ) {
-        try {
-            // 涉及到表变更sql的关键词
-            const sqlKeywords = ['DROP DATABASE', 'TRRUNCATE TABLE', 'DROP TABLE', 'DELETE FROM', 'CREATE TABLE', 'ALTER TABLE', 'INSERT INTO']
-            const upperCaseSql = sql && sql.toUpperCase()
-            // 此接口只能执行查询语句，禁止执行任何涉及表变更的语句
-            if (!upperCaseSql || !upperCaseSql.startsWith('SELECT') || sqlKeywords.indexOf(upperCaseSql) !== -1) {
-                throw new global.BusinessError('sql语句未以SELECT开头或含有变更数据表的危险关键词', -1, 400)
-            }
+            // 使用增强的SQL安全检查函数
+            enhancedSqlSecurityCheck(sql)
             return await dataService.execSql(sql)
         } catch (e) {
             throw new global.BusinessError(e.sqlMessage || e.message || '执行查询sql失败', -1, 500)
diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js b/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
index 3890b83da..ae0049a47 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
@@ -1,239 +1,293 @@
-import {
-    validateData
-} from '../../shared/form/validate'
-import {
-    formMap
-} from '../../shared/form/index'
-import {
-    isEmpty
-} from '../../shared/util'
-import {
-    NO_LENGTH_ORM_KEY
-} from '../../shared/data-source/constant'
-import {
-    splitSql,
-    uuid
-} from '../util'
-import dataService, {
-    Like,
-    getDataService as getThirdPartDataService
-} from './data-service'
-import dayjs from 'dayjs'
-import DayJSUtcPlugin from 'dayjs/plugin/utc'
-import thirdPartDBConfs from '../conf/third-part-db'
-import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
-import { RequestContext } from '../middleware/request-context'
-import { decode } from 'js-base64'
-
-dayjs.extend(DayJSUtcPlugin)
-
-// 数据源入库校验
-export const validate = async (formId, data) => {
-    // 如果有 formId，执行 nocode 校验
-    if (formId) {
-        const formData = formMap[formId]
-        if (!formData) {
-            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
-        }
-        const validateResult = await validateData(
-            formData.content,
-            data,
-            formData,
-            dataService
-        )
-        if (!validateResult.result) {
-            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
-        }
-    }
-}
-
-// 数据在入库前进行转换
-export const transferData = (formId, data) => {
-    let result = data
-    // 如果有 formId，执行 nocode 转换
-    if (formId) {
-        result = {}
-        data.forEach(({ key, value }) => {
-            result[key] = value
-        })
-    }
-
-    return result
-}
-
-// 根据时区转换时间
-export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
-    if (isEmpty(data)) {
-        return data
-    }
-    const transferList = Array.isArray(data) ? data : [data]
-    columns.forEach((column) => {
-        if (column.type === 'datetime') {
-            transferList.forEach((transferItem) => {
-                if (transferItem[column.propertyName] && timezoneOffset) {
-                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
-                        .utcOffset(-timezoneOffset)
-                        .format('YYYY-MM-DD HH:mm:ss')
-                }
-            })
-        }
-    })
-    return Array.isArray(data) ? transferList : transferList[0]
-}
-
-// 只能是查询语句检查
-export const querySqlCheck = (sql) => {
-    if (!/;$/.test(sql.trim())) {
-        throw new Error('Sql 语句不完整，需要是【;】号结尾')
-    }
-    const checkList = [
-        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
-        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
-        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
-        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
-        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
-        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
-        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
-        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
-    ]
-    const sqlArr = splitSql(sql)
-    sqlArr.forEach((sqlStr) => {
-        const lowerCaseSql = sqlStr.trim().toLowerCase()
-        if (lowerCaseSql) {
-            checkList.forEach((checkItem) => {
-                if (checkItem.check(lowerCaseSql)) {
-                    throw new Error(checkItem.message)
-                }
-            })
-        }
-    })
-}
-
-// sql 解码
-export const decodeSql = (sql, params) => {
-    let decodedSql = decode(sql)
-    const paramKeys = Object.keys(params || {})
-    if (paramKeys.length > 0) {
-        paramKeys.forEach((paramKey) => {
-            const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
-            decodedSql = decodedSql.replace(reg, params[paramKey])
-        })
-    }
-    return decodedSql
-}
-
-@EventSubscriber()
-class PreviewSubscriber {
-    beforeInsert ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.createUser = currentUser.username || entity.createUser
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.createTime = new Date()
-        entity.updateTime = new Date()
-    }
-
-    beforeUpdate ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.updateTime = new Date()
-    }
-}
-
-/**
- * 获取 dataservice
- * @param {*} thirdPartDBName 第三方db name
- * @returns dataService
- */
-export const getDataService = async (thirdPartDBName) => {
-    if (thirdPartDBName) {
-        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
-        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
-            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
-                const { length, ...rest } = cur
-                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
-                return acc
-            }, {})
-            const entity = new EntitySchema({
-                name: cur.tableName,
-                columns
-            })
-            acc.entities.push(entity)
-            acc.entityMap[cur.tableName] = entity
-            return acc
-        }, { entities: [], entityMap: {} })
-        const ormConfig = {
-            name: uuid(),
-            type: 'mysql',
-            host: thirdPartDB.host,
-            port: thirdPartDB.port,
-            username: thirdPartDB.username,
-            password: thirdPartDB.password,
-            database: thirdPartDB.dbName,
-            entities,
-            subscribers: [PreviewSubscriber],
-            synchronize: false,
-            migrationsRun: false,
-            extra: {
-                connectionLimit: 5
-            }
-        }
-        const con = await createConnection(ormConfig)
-        const thirdPartDataService = {
-            ...getThirdPartDataService(ormConfig.name, entityMap),
-            close () {
-                return new Promise((resolve, reject) => {
-                    if (con.isConnected) {
-                        con.close().then(resolve, reject)
-                    } else {
-                        resolve()
-                    }
-                })
-            }
-        }
-        return thirdPartDataService
-    }
-
-    return dataService
-}
-
-/**
- * 获取有权限的数据
- * @param {*} queryData 查询条件
- * @param {*} tableFileName 表文件名
- * @param {*} timezoneOffset 时区偏移
- * @returns 表数据
- */
-export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
-    const {
-        page,
-        pageSize,
-        bkSortKey,
-        bkSortValue,
-        bkDataSourceType,
-        ...others
-    } = queryData
-    const order = bkSortKey
-        ? {
-            [bkSortKey]: bkSortValue
-        }
-        : {
-            id: 'DESC'
-        }
-    const query = Object
-        .keys(others)
-        .reduce((acc, cur) => {
-            acc[cur] = Like(`%${others[cur]}%`)
-            return acc
-        }, {})
-    const dataService = await getDataService(thirdPartDBName)
-    const result = await dataService.get({
-        tableFileName,
-        page,
-        pageSize,
-        order,
-        query
-    })
-    const { columns } = dataService.getTableMetadata(tableFileName)
-    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
-    return result
-}
+import {
+    validateData
+} from '../../shared/form/validate'
+import {
+    formMap
+} from '../../shared/form/index'
+import {
+    isEmpty
+} from '../../shared/util'
+import {
+    NO_LENGTH_ORM_KEY
+} from '../../shared/data-source/constant'
+import {
+    splitSql,
+    uuid
+} from '../util'
+import dataService, {
+    Like,
+    getDataService as getThirdPartDataService
+} from './data-service'
+import dayjs from 'dayjs'
+import DayJSUtcPlugin from 'dayjs/plugin/utc'
+import thirdPartDBConfs from '../conf/third-part-db'
+import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
+import { RequestContext } from '../middleware/request-context'
+import { decode } from 'js-base64'
+
+dayjs.extend(DayJSUtcPlugin)
+
+// 数据源入库校验
+export const validate = async (formId, data) => {
+    // 如果有 formId，执行 nocode 校验
+    if (formId) {
+        const formData = formMap[formId]
+        if (!formData) {
+            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
+        }
+        const validateResult = await validateData(
+            formData.content,
+            data,
+            formData,
+            dataService
+        )
+        if (!validateResult.result) {
+            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
+        }
+    }
+}
+
+// 数据在入库前进行转换
+export const transferData = (formId, data) => {
+    let result = data
+    // 如果有 formId，执行 nocode 转换
+    if (formId) {
+        result = {}
+        data.forEach(({ key, value }) => {
+            result[key] = value
+        })
+    }
+
+    return result
+}
+
+// 根据时区转换时间
+export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
+    if (isEmpty(data)) {
+        return data
+    }
+    const transferList = Array.isArray(data) ? data : [data]
+    columns.forEach((column) => {
+        if (column.type === 'datetime') {
+            transferList.forEach((transferItem) => {
+                if (transferItem[column.propertyName] && timezoneOffset) {
+                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
+                        .utcOffset(-timezoneOffset)
+                        .format('YYYY-MM-DD HH:mm:ss')
+                }
+            })
+        }
+    })
+    return Array.isArray(data) ? transferList : transferList[0]
+}
+
+// 只能是查询语句检查 - 增强版本
+export const querySqlCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    
+    if (!/;$/.test(trimmedSql)) {
+        throw new Error('Sql 语句不完整，需要是【;】号结尾')
+    }
+
+    // 基础检查列表（保持原有逻辑）
+    const checkList = [
+        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
+        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
+        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
+        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
+        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
+        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
+        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
+        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
+    ]
+
+    // 增强的安全检查列表
+    const enhancedCheckList = [
+        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
+        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
+        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
+        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
+        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
+        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
+        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
+        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
+        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
+        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
+        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
+        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
+        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
+        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
+        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
+        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
+        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
+        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
+        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
+        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
+        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
+        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
+        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
+        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
+    ]
+
+    const sqlArr = splitSql(sql)
+    sqlArr.forEach((sqlStr) => {
+        const lowerCaseSql = sqlStr.trim().toLowerCase()
+        if (lowerCaseSql) {
+            // 执行原有检查
+            checkList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+
+            // 执行增强检查
+            enhancedCheckList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+        }
+    })
+}
+
+// sql 解码
+export const decodeSql = (sql, params) => {
+    try {
+        let decodedSql = decode(sql)
+
+        if (!decodedSql || typeof decodedSql !== 'string') {
+            throw new Error('无效的SQL语句')
+        }
+        
+        const paramKeys = Object.keys(params || {})
+        if (paramKeys.length > 0) {
+            paramKeys.forEach((paramKey) => {
+                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
+                decodedSql = decodedSql.replace(reg, params[paramKey])
+            })
+        }
+        return decodedSql
+    } catch (error) {
+        throw new Error(`SQL解码失败: ${error.message}`)
+    }
+}
+
+@EventSubscriber()
+class PreviewSubscriber {
+    beforeInsert ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.createUser = currentUser.username || entity.createUser
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.createTime = new Date()
+        entity.updateTime = new Date()
+    }
+
+    beforeUpdate ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.updateTime = new Date()
+    }
+}
+
+/**
+ * 获取 dataservice
+ * @param {*} thirdPartDBName 第三方db name
+ * @returns dataService
+ */
+export const getDataService = async (thirdPartDBName) => {
+    if (thirdPartDBName) {
+        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
+        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
+            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
+                const { length, ...rest } = cur
+                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
+                return acc
+            }, {})
+            const entity = new EntitySchema({
+                name: cur.tableName,
+                columns
+            })
+            acc.entities.push(entity)
+            acc.entityMap[cur.tableName] = entity
+            return acc
+        }, { entities: [], entityMap: {} })
+        const ormConfig = {
+            name: uuid(),
+            type: 'mysql',
+            host: thirdPartDB.host,
+            port: thirdPartDB.port,
+            username: thirdPartDB.username,
+            password: thirdPartDB.password,
+            database: thirdPartDB.dbName,
+            entities,
+            subscribers: [PreviewSubscriber],
+            synchronize: false,
+            migrationsRun: false,
+            extra: {
+                connectionLimit: 5
+            }
+        }
+        const con = await createConnection(ormConfig)
+        const thirdPartDataService = {
+            ...getThirdPartDataService(ormConfig.name, entityMap),
+            close () {
+                return new Promise((resolve, reject) => {
+                    if (con.isConnected) {
+                        con.close().then(resolve, reject)
+                    } else {
+                        resolve()
+                    }
+                })
+            }
+        }
+        return thirdPartDataService
+    }
+
+    return dataService
+}
+
+/**
+ * 获取有权限的数据
+ * @param {*} queryData 查询条件
+ * @param {*} tableFileName 表文件名
+ * @param {*} timezoneOffset 时区偏移
+ * @returns 表数据
+ */
+export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
+    const {
+        page,
+        pageSize,
+        bkSortKey,
+        bkSortValue,
+        bkDataSourceType,
+        ...others
+    } = queryData
+    const order = bkSortKey
+        ? {
+            [bkSortKey]: bkSortValue
+        }
+        : {
+            id: 'DESC'
+        }
+    const query = Object
+        .keys(others)
+        .reduce((acc, cur) => {
+            acc[cur] = Like(`%${others[cur]}%`)
+            return acc
+        }, {})
+    const dataService = await getDataService(thirdPartDBName)
+    const result = await dataService.get({
+        tableFileName,
+        page,
+        pageSize,
+        order,
+        query
+    })
+    const { columns } = dataService.getTableMetadata(tableFileName)
+    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
+    return result
+}
diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js b/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
index d8433fdb3..973e4d02f 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
@@ -1,24 +1,107 @@
-import bkToken from '../conf/token'
-import {
-    decodeToken
-} from '@bkui/apigateway-nodejs-sdk'
-
-export const getUserFromApiGW = async (jwt) => {
-    const { user } = await decodeToken(jwt, bkToken)
-    if (!user) {
-        throw new Error('未解析到用户名，请修改后再试')
-    }
-    return user
-}
-
-export const getAuthQuerySubfix = (cookies) => {
-    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
-}
-
-export const getAuthPostParams = (cookies) => {
-    return {
-        bk_app_code: bkToken?.bk_app_code,
-        bk_app_secret: bkToken?.bk_app_secret,
-        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
-    }
-}
+import bkToken from '../conf/token'
+import {
+    decodeToken
+} from '@bkui/apigateway-nodejs-sdk'
+
+/**
+ * 增强的SQL安全检查函数
+ * @param {string} sql SQL语句
+ * @throws {Error} 如果检测到危险模式
+ */
+export const enhancedSqlSecurityCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    const upperCaseSql = trimmedSql.toUpperCase()
+
+    // 基本检查：必须以SELECT开头
+    if (!upperCaseSql.startsWith('SELECT')) {
+        throw new Error('仅支持SELECT查询语句')
+    }
+
+    // 危险关键词检查（更全面）
+    const dangerousKeywords = [
+        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
+        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
+        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
+        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
+    ]
+    
+    for (const keyword of dangerousKeywords) {
+        if (upperCaseSql.includes(keyword)) {
+            throw new Error(`检测到危险关键词: ${keyword}`)
+        }
+    }
+
+    // 危险模式检查
+    const dangerousPatterns = [
+        /UNION\s+SELECT/i, // UNION注入
+        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
+        /XP_CMDSHELL/i, // SQL Server命令执行
+        /SP_EXECUTESQL/i, // SQL Server动态SQL
+        /EXEC\s*\(/i, // 执行函数
+        /EXECUTE\s*\(/i, // 执行函数
+        /INFORMATION_SCHEMA/i, // 信息模式
+        /PERFORMANCE_SCHEMA/i, // 性能模式
+        /MYSQL\./i, // MySQL系统表
+        /\@\@/, // 系统变量
+        /DATABASE\(\)/i, // 数据库函数
+        /USER\(\)/i, // 用户函数
+        /VERSION\(\)/i, // 版本函数
+        /BENCHMARK\s*\(/i, // 基准测试函数
+        /SLEEP\s*\(/i, // 延时函数
+        /WAITFOR\s+DELAY/i, // SQL Server延时
+        /PG_SLEEP\s*\(/i, // PostgreSQL延时
+        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
+        /INTO\s+OUTFILE/i, // 文件写入
+        /INTO\s+DUMPFILE/i, // 文件转储
+        /LOAD_FILE\s*\(/i, // 文件读取
+        /CHAR\s*\(/i, // 字符编码绕过
+        /ASCII\s*\(/i, // ASCII编码绕过
+        /HEX\s*\(/i, // 十六进制编码绕过
+        /UNHEX\s*\(/i, // 反十六进制编码
+        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
+        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
+        /MID\s*\(/i, // 中间字符串
+        /LEFT\s*\(/i, // 左侧字符串
+        /RIGHT\s*\(/i, // 右侧字符串
+        /IF\s*\(/i, // 条件函数（可能用于盲注）
+        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
+        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
+        /UPDATEXML\s*\(/i, // XML更新函数
+        /NAME_CONST\s*\(/i, // 名称常量函数
+        /MULTIPOINT\s*\(/i, // 几何函数
+        /POLYGON\s*\(/i, // 多边形函数
+        /MULTIPOLYGON\s*\(/i, // 多多边形函数
+        /LINESTRING\s*\(/i, // 线字符串函数
+        /MULTILINESTRING\s*\(/i // 多线字符串函数
+    ]
+
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(sql)) {
+            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
+        }
+    }
+}
+
+export const getUserFromApiGW = async (jwt) => {
+    const { user } = await decodeToken(jwt, bkToken)
+    if (!user) {
+        throw new Error('未解析到用户名，请修改后再试')
+    }
+    return user
+}
+
+export const getAuthQuerySubfix = (cookies) => {
+    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
+}
+
+export const getAuthPostParams = (cookies) => {
+    return {
+        bk_app_code: bkToken?.bk_app_code,
+        bk_app_secret: bkToken?.bk_app_secret,
+        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
+    }
+}
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js b/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js
index 7594a467b..8823a2869 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/controller/open-api.js
@@ -24,6 +24,7 @@ import {
     filterTableDataWithKeys
 } from '../service/form'
 import dataSourceController from './data-source'
+import { enhancedSqlSecurityCheck } from '../service/open-api'
 import { METHODS_WITHOUT_DATA } from '../../shared/constant'
 
 @Controller('/api/open-api')
@@ -156,13 +157,8 @@ export default class OpenApiController {
         @BodyParams({ name: 'sql' }) sql
     ) {
         try {
-            // 涉及到表变更sql的关键词
-            const sqlKeywords = ['DROP DATABASE', 'TRRUNCATE TABLE', 'DROP TABLE', 'DELETE FROM', 'CREATE TABLE', 'ALTER TABLE', 'INSERT INTO']
-            const upperCaseSql = sql && sql.toUpperCase()
-            // 此接口只能执行查询语句，禁止执行任何涉及表变更的语句
-            if (!upperCaseSql || !upperCaseSql.startsWith('SELECT') || sqlKeywords.indexOf(upperCaseSql) !== -1) {
-                throw new global.BusinessError('sql语句未以SELECT开头或含有变更数据表的危险关键词', -1, 400)
-            }
+            // 使用增强的SQL安全检查函数
+            enhancedSqlSecurityCheck(sql)
             return await dataService.execSql(sql)
         } catch (e) {
             throw new global.BusinessError(e.sqlMessage || e.message || '执行查询sql失败', -1, 500)
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js b/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
index 3890b83da..ae0049a47 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
@@ -1,239 +1,293 @@
-import {
-    validateData
-} from '../../shared/form/validate'
-import {
-    formMap
-} from '../../shared/form/index'
-import {
-    isEmpty
-} from '../../shared/util'
-import {
-    NO_LENGTH_ORM_KEY
-} from '../../shared/data-source/constant'
-import {
-    splitSql,
-    uuid
-} from '../util'
-import dataService, {
-    Like,
-    getDataService as getThirdPartDataService
-} from './data-service'
-import dayjs from 'dayjs'
-import DayJSUtcPlugin from 'dayjs/plugin/utc'
-import thirdPartDBConfs from '../conf/third-part-db'
-import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
-import { RequestContext } from '../middleware/request-context'
-import { decode } from 'js-base64'
-
-dayjs.extend(DayJSUtcPlugin)
-
-// 数据源入库校验
-export const validate = async (formId, data) => {
-    // 如果有 formId，执行 nocode 校验
-    if (formId) {
-        const formData = formMap[formId]
-        if (!formData) {
-            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
-        }
-        const validateResult = await validateData(
-            formData.content,
-            data,
-            formData,
-            dataService
-        )
-        if (!validateResult.result) {
-            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
-        }
-    }
-}
-
-// 数据在入库前进行转换
-export const transferData = (formId, data) => {
-    let result = data
-    // 如果有 formId，执行 nocode 转换
-    if (formId) {
-        result = {}
-        data.forEach(({ key, value }) => {
-            result[key] = value
-        })
-    }
-
-    return result
-}
-
-// 根据时区转换时间
-export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
-    if (isEmpty(data)) {
-        return data
-    }
-    const transferList = Array.isArray(data) ? data : [data]
-    columns.forEach((column) => {
-        if (column.type === 'datetime') {
-            transferList.forEach((transferItem) => {
-                if (transferItem[column.propertyName] && timezoneOffset) {
-                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
-                        .utcOffset(-timezoneOffset)
-                        .format('YYYY-MM-DD HH:mm:ss')
-                }
-            })
-        }
-    })
-    return Array.isArray(data) ? transferList : transferList[0]
-}
-
-// 只能是查询语句检查
-export const querySqlCheck = (sql) => {
-    if (!/;$/.test(sql.trim())) {
-        throw new Error('Sql 语句不完整，需要是【;】号结尾')
-    }
-    const checkList = [
-        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
-        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
-        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
-        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
-        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
-        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
-        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
-        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
-    ]
-    const sqlArr = splitSql(sql)
-    sqlArr.forEach((sqlStr) => {
-        const lowerCaseSql = sqlStr.trim().toLowerCase()
-        if (lowerCaseSql) {
-            checkList.forEach((checkItem) => {
-                if (checkItem.check(lowerCaseSql)) {
-                    throw new Error(checkItem.message)
-                }
-            })
-        }
-    })
-}
-
-// sql 解码
-export const decodeSql = (sql, params) => {
-    let decodedSql = decode(sql)
-    const paramKeys = Object.keys(params || {})
-    if (paramKeys.length > 0) {
-        paramKeys.forEach((paramKey) => {
-            const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
-            decodedSql = decodedSql.replace(reg, params[paramKey])
-        })
-    }
-    return decodedSql
-}
-
-@EventSubscriber()
-class PreviewSubscriber {
-    beforeInsert ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.createUser = currentUser.username || entity.createUser
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.createTime = new Date()
-        entity.updateTime = new Date()
-    }
-
-    beforeUpdate ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.updateTime = new Date()
-    }
-}
-
-/**
- * 获取 dataservice
- * @param {*} thirdPartDBName 第三方db name
- * @returns dataService
- */
-export const getDataService = async (thirdPartDBName) => {
-    if (thirdPartDBName) {
-        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
-        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
-            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
-                const { length, ...rest } = cur
-                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
-                return acc
-            }, {})
-            const entity = new EntitySchema({
-                name: cur.tableName,
-                columns
-            })
-            acc.entities.push(entity)
-            acc.entityMap[cur.tableName] = entity
-            return acc
-        }, { entities: [], entityMap: {} })
-        const ormConfig = {
-            name: uuid(),
-            type: 'mysql',
-            host: thirdPartDB.host,
-            port: thirdPartDB.port,
-            username: thirdPartDB.username,
-            password: thirdPartDB.password,
-            database: thirdPartDB.dbName,
-            entities,
-            subscribers: [PreviewSubscriber],
-            synchronize: false,
-            migrationsRun: false,
-            extra: {
-                connectionLimit: 5
-            }
-        }
-        const con = await createConnection(ormConfig)
-        const thirdPartDataService = {
-            ...getThirdPartDataService(ormConfig.name, entityMap),
-            close () {
-                return new Promise((resolve, reject) => {
-                    if (con.isConnected) {
-                        con.close().then(resolve, reject)
-                    } else {
-                        resolve()
-                    }
-                })
-            }
-        }
-        return thirdPartDataService
-    }
-
-    return dataService
-}
-
-/**
- * 获取有权限的数据
- * @param {*} queryData 查询条件
- * @param {*} tableFileName 表文件名
- * @param {*} timezoneOffset 时区偏移
- * @returns 表数据
- */
-export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
-    const {
-        page,
-        pageSize,
-        bkSortKey,
-        bkSortValue,
-        bkDataSourceType,
-        ...others
-    } = queryData
-    const order = bkSortKey
-        ? {
-            [bkSortKey]: bkSortValue
-        }
-        : {
-            id: 'DESC'
-        }
-    const query = Object
-        .keys(others)
-        .reduce((acc, cur) => {
-            acc[cur] = Like(`%${others[cur]}%`)
-            return acc
-        }, {})
-    const dataService = await getDataService(thirdPartDBName)
-    const result = await dataService.get({
-        tableFileName,
-        page,
-        pageSize,
-        order,
-        query
-    })
-    const { columns } = dataService.getTableMetadata(tableFileName)
-    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
-    return result
-}
+import {
+    validateData
+} from '../../shared/form/validate'
+import {
+    formMap
+} from '../../shared/form/index'
+import {
+    isEmpty
+} from '../../shared/util'
+import {
+    NO_LENGTH_ORM_KEY
+} from '../../shared/data-source/constant'
+import {
+    splitSql,
+    uuid
+} from '../util'
+import dataService, {
+    Like,
+    getDataService as getThirdPartDataService
+} from './data-service'
+import dayjs from 'dayjs'
+import DayJSUtcPlugin from 'dayjs/plugin/utc'
+import thirdPartDBConfs from '../conf/third-part-db'
+import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
+import { RequestContext } from '../middleware/request-context'
+import { decode } from 'js-base64'
+
+dayjs.extend(DayJSUtcPlugin)
+
+// 数据源入库校验
+export const validate = async (formId, data) => {
+    // 如果有 formId，执行 nocode 校验
+    if (formId) {
+        const formData = formMap[formId]
+        if (!formData) {
+            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
+        }
+        const validateResult = await validateData(
+            formData.content,
+            data,
+            formData,
+            dataService
+        )
+        if (!validateResult.result) {
+            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
+        }
+    }
+}
+
+// 数据在入库前进行转换
+export const transferData = (formId, data) => {
+    let result = data
+    // 如果有 formId，执行 nocode 转换
+    if (formId) {
+        result = {}
+        data.forEach(({ key, value }) => {
+            result[key] = value
+        })
+    }
+
+    return result
+}
+
+// 根据时区转换时间
+export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
+    if (isEmpty(data)) {
+        return data
+    }
+    const transferList = Array.isArray(data) ? data : [data]
+    columns.forEach((column) => {
+        if (column.type === 'datetime') {
+            transferList.forEach((transferItem) => {
+                if (transferItem[column.propertyName] && timezoneOffset) {
+                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
+                        .utcOffset(-timezoneOffset)
+                        .format('YYYY-MM-DD HH:mm:ss')
+                }
+            })
+        }
+    })
+    return Array.isArray(data) ? transferList : transferList[0]
+}
+
+// 只能是查询语句检查 - 增强版本
+export const querySqlCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    
+    if (!/;$/.test(trimmedSql)) {
+        throw new Error('Sql 语句不完整，需要是【;】号结尾')
+    }
+
+    // 基础检查列表（保持原有逻辑）
+    const checkList = [
+        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
+        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
+        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
+        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
+        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
+        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
+        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
+        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
+    ]
+
+    // 增强的安全检查列表
+    const enhancedCheckList = [
+        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
+        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
+        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
+        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
+        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
+        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
+        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
+        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
+        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
+        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
+        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
+        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
+        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
+        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
+        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
+        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
+        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
+        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
+        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
+        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
+        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
+        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
+        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
+        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
+    ]
+
+    const sqlArr = splitSql(sql)
+    sqlArr.forEach((sqlStr) => {
+        const lowerCaseSql = sqlStr.trim().toLowerCase()
+        if (lowerCaseSql) {
+            // 执行原有检查
+            checkList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+
+            // 执行增强检查
+            enhancedCheckList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+        }
+    })
+}
+
+// sql 解码
+export const decodeSql = (sql, params) => {
+    try {
+        let decodedSql = decode(sql)
+
+        if (!decodedSql || typeof decodedSql !== 'string') {
+            throw new Error('无效的SQL语句')
+        }
+        
+        const paramKeys = Object.keys(params || {})
+        if (paramKeys.length > 0) {
+            paramKeys.forEach((paramKey) => {
+                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
+                decodedSql = decodedSql.replace(reg, params[paramKey])
+            })
+        }
+        return decodedSql
+    } catch (error) {
+        throw new Error(`SQL解码失败: ${error.message}`)
+    }
+}
+
+@EventSubscriber()
+class PreviewSubscriber {
+    beforeInsert ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.createUser = currentUser.username || entity.createUser
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.createTime = new Date()
+        entity.updateTime = new Date()
+    }
+
+    beforeUpdate ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.updateTime = new Date()
+    }
+}
+
+/**
+ * 获取 dataservice
+ * @param {*} thirdPartDBName 第三方db name
+ * @returns dataService
+ */
+export const getDataService = async (thirdPartDBName) => {
+    if (thirdPartDBName) {
+        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
+        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
+            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
+                const { length, ...rest } = cur
+                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
+                return acc
+            }, {})
+            const entity = new EntitySchema({
+                name: cur.tableName,
+                columns
+            })
+            acc.entities.push(entity)
+            acc.entityMap[cur.tableName] = entity
+            return acc
+        }, { entities: [], entityMap: {} })
+        const ormConfig = {
+            name: uuid(),
+            type: 'mysql',
+            host: thirdPartDB.host,
+            port: thirdPartDB.port,
+            username: thirdPartDB.username,
+            password: thirdPartDB.password,
+            database: thirdPartDB.dbName,
+            entities,
+            subscribers: [PreviewSubscriber],
+            synchronize: false,
+            migrationsRun: false,
+            extra: {
+                connectionLimit: 5
+            }
+        }
+        const con = await createConnection(ormConfig)
+        const thirdPartDataService = {
+            ...getThirdPartDataService(ormConfig.name, entityMap),
+            close () {
+                return new Promise((resolve, reject) => {
+                    if (con.isConnected) {
+                        con.close().then(resolve, reject)
+                    } else {
+                        resolve()
+                    }
+                })
+            }
+        }
+        return thirdPartDataService
+    }
+
+    return dataService
+}
+
+/**
+ * 获取有权限的数据
+ * @param {*} queryData 查询条件
+ * @param {*} tableFileName 表文件名
+ * @param {*} timezoneOffset 时区偏移
+ * @returns 表数据
+ */
+export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
+    const {
+        page,
+        pageSize,
+        bkSortKey,
+        bkSortValue,
+        bkDataSourceType,
+        ...others
+    } = queryData
+    const order = bkSortKey
+        ? {
+            [bkSortKey]: bkSortValue
+        }
+        : {
+            id: 'DESC'
+        }
+    const query = Object
+        .keys(others)
+        .reduce((acc, cur) => {
+            acc[cur] = Like(`%${others[cur]}%`)
+            return acc
+        }, {})
+    const dataService = await getDataService(thirdPartDBName)
+    const result = await dataService.get({
+        tableFileName,
+        page,
+        pageSize,
+        order,
+        query
+    })
+    const { columns } = dataService.getTableMetadata(tableFileName)
+    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
+    return result
+}
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js b/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
index d8433fdb3..973e4d02f 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
@@ -1,24 +1,107 @@
-import bkToken from '../conf/token'
-import {
-    decodeToken
-} from '@bkui/apigateway-nodejs-sdk'
-
-export const getUserFromApiGW = async (jwt) => {
-    const { user } = await decodeToken(jwt, bkToken)
-    if (!user) {
-        throw new Error('未解析到用户名，请修改后再试')
-    }
-    return user
-}
-
-export const getAuthQuerySubfix = (cookies) => {
-    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
-}
-
-export const getAuthPostParams = (cookies) => {
-    return {
-        bk_app_code: bkToken?.bk_app_code,
-        bk_app_secret: bkToken?.bk_app_secret,
-        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
-    }
-}
+import bkToken from '../conf/token'
+import {
+    decodeToken
+} from '@bkui/apigateway-nodejs-sdk'
+
+/**
+ * 增强的SQL安全检查函数
+ * @param {string} sql SQL语句
+ * @throws {Error} 如果检测到危险模式
+ */
+export const enhancedSqlSecurityCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    const upperCaseSql = trimmedSql.toUpperCase()
+
+    // 基本检查：必须以SELECT开头
+    if (!upperCaseSql.startsWith('SELECT')) {
+        throw new Error('仅支持SELECT查询语句')
+    }
+
+    // 危险关键词检查（更全面）
+    const dangerousKeywords = [
+        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
+        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
+        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
+        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
+    ]
+    
+    for (const keyword of dangerousKeywords) {
+        if (upperCaseSql.includes(keyword)) {
+            throw new Error(`检测到危险关键词: ${keyword}`)
+        }
+    }
+
+    // 危险模式检查
+    const dangerousPatterns = [
+        /UNION\s+SELECT/i, // UNION注入
+        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
+        /XP_CMDSHELL/i, // SQL Server命令执行
+        /SP_EXECUTESQL/i, // SQL Server动态SQL
+        /EXEC\s*\(/i, // 执行函数
+        /EXECUTE\s*\(/i, // 执行函数
+        /INFORMATION_SCHEMA/i, // 信息模式
+        /PERFORMANCE_SCHEMA/i, // 性能模式
+        /MYSQL\./i, // MySQL系统表
+        /\@\@/, // 系统变量
+        /DATABASE\(\)/i, // 数据库函数
+        /USER\(\)/i, // 用户函数
+        /VERSION\(\)/i, // 版本函数
+        /BENCHMARK\s*\(/i, // 基准测试函数
+        /SLEEP\s*\(/i, // 延时函数
+        /WAITFOR\s+DELAY/i, // SQL Server延时
+        /PG_SLEEP\s*\(/i, // PostgreSQL延时
+        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
+        /INTO\s+OUTFILE/i, // 文件写入
+        /INTO\s+DUMPFILE/i, // 文件转储
+        /LOAD_FILE\s*\(/i, // 文件读取
+        /CHAR\s*\(/i, // 字符编码绕过
+        /ASCII\s*\(/i, // ASCII编码绕过
+        /HEX\s*\(/i, // 十六进制编码绕过
+        /UNHEX\s*\(/i, // 反十六进制编码
+        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
+        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
+        /MID\s*\(/i, // 中间字符串
+        /LEFT\s*\(/i, // 左侧字符串
+        /RIGHT\s*\(/i, // 右侧字符串
+        /IF\s*\(/i, // 条件函数（可能用于盲注）
+        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
+        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
+        /UPDATEXML\s*\(/i, // XML更新函数
+        /NAME_CONST\s*\(/i, // 名称常量函数
+        /MULTIPOINT\s*\(/i, // 几何函数
+        /POLYGON\s*\(/i, // 多边形函数
+        /MULTIPOLYGON\s*\(/i, // 多多边形函数
+        /LINESTRING\s*\(/i, // 线字符串函数
+        /MULTILINESTRING\s*\(/i // 多线字符串函数
+    ]
+
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(sql)) {
+            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
+        }
+    }
+}
+
+export const getUserFromApiGW = async (jwt) => {
+    const { user } = await decodeToken(jwt, bkToken)
+    if (!user) {
+        throw new Error('未解析到用户名，请修改后再试')
+    }
+    return user
+}
+
+export const getAuthQuerySubfix = (cookies) => {
+    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
+}
+
+export const getAuthPostParams = (cookies) => {
+    return {
+        bk_app_code: bkToken?.bk_app_code,
+        bk_app_secret: bkToken?.bk_app_secret,
+        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
+    }
+}
diff --git a/lib/server/service/common/data-service.js b/lib/server/service/common/data-service.js
index 03e8d10ab..b53d12318 100644
--- a/lib/server/service/common/data-service.js
+++ b/lib/server/service/common/data-service.js
@@ -365,7 +365,7 @@ export function getDataService (name = 'default', customEntityMap) {
             const repository = getRepositoryByName(tableFileName)
             try {
                 const { id, ...rest } = data
-                const { affected = 0 } = await repository.update({ where: transformQuery(where) }, transformData(rest, repository.metadata.columns))
+                const { affected = 0 } = await repository.update(transformQuery(where), transformData(rest, repository.metadata.columns))
                 return affected
             } catch (error) {
                 throw new Error(error.sqlMessage || error)
@@ -392,7 +392,7 @@ export function getDataService (name = 'default', customEntityMap) {
                 }
             }
             try {
-                const { affected = 0 } = await repository.update({ where: { id: data.id } }, transformData(editData, repository.metadata.columns))
+                const { affected = 0 } = await repository.update({ id: data.id }, transformData(editData, repository.metadata.columns))
                 return affected
             } catch (error) {
                 throw new Error(error.sqlMessage || error)
@@ -425,7 +425,7 @@ export function getDataService (name = 'default', customEntityMap) {
 
             try {
                 const transformList = transformData(editDataList, repository.metadata.columns)
-                const updateResult = await Promise.all(transformList.map((data) => repository.update({ where: { id: data.id } }, data)))
+                const updateResult = await Promise.all(transformList.map((data) => repository.update({ id: data.id }, data)))
                 return updateResult.reduce((acc, { affected }) => {
                     acc += affected
                     return acc

From 0c61740e99a412903ee49cff20880d8857de0793 Mon Sep 17 00:00:00 2001
From: LivySara <1936808975@qq.com>
Date: Mon, 2 Feb 2026 10:07:33 +0800
Subject: [PATCH 3/4] =?UTF-8?q?feat=EF=BC=9A=E4=B8=8A=E4=BC=A0=E5=92=8C?=
 =?UTF-8?q?=E4=B8=8B=E8=BD=BD=E5=AE=89=E5=85=A8=E9=98=B2=E6=8A=A4=20---sto?=
 =?UTF-8?q?ry=3D130244258=20#=20Reviewed,=20transaction=20id:=2073268?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../components/render-template.vue            |   2 +-
 lib/server/controller/component.js            | 134 +++++-
 lib/server/controller/file.js                 |  20 +-
 lib/server/controller/page-template.js        |  45 +-
 lib/server/controller/page.js                 |  81 +++-
 lib/server/controller/project-code.js         |   6 +
 lib/server/controller/project.js              |  23 +-
 lib/server/utils/file-service/index.js        | 433 +++++++++---------
 lib/shared/security/file-protection.js        | 197 ++++++++
 9 files changed, 689 insertions(+), 252 deletions(-)
 create mode 100644 lib/shared/security/file-protection.js

diff --git a/lib/client/src/views/project/template-manage/components/render-template.vue b/lib/client/src/views/project/template-manage/components/render-template.vue
index bcfc7811d..090601f86 100644
--- a/lib/client/src/views/project/template-manage/components/render-template.vue
+++ b/lib/client/src/views/project/template-manage/components/render-template.vue
@@ -37,7 +37,7 @@
                                         <i v-if="template.templateType === 'MOBILE'" class="bk-drag-icon bk-drag-mobilephone"> </i>
                                         <i v-else class="bk-drag-icon bk-drag-pc"> </i>
                                     </span>
-                                    <div class="name" v-tooltips="template.templateName">{{template.templateName}}</div>
+                                    <div class="name" v-bk-overflow-tips="{ content: template.templateName }">{{template.templateName}}</div>
                                 </div>
                                 <div class="stat">{{ template.updateUser || template.createUser }}</div>
                             </div>
diff --git a/lib/server/controller/component.js b/lib/server/controller/component.js
index 318147188..a5a25d841 100644
--- a/lib/server/controller/component.js
+++ b/lib/server/controller/component.js
@@ -250,16 +250,18 @@ export const exportComps = async (ctx) => {
     const sourcePath = path.join(STATIC_URL, componentDirName)
     const targetPath = path.join(STATIC_URL, `${componentDirName}.zip`)
 
-    await fse.ensureDir(sourcePath)
-    await compressing.zip.compressDir(sourcePath, targetPath, { ignoreBase: true })
-        .then(async () => {
-            ctx.attachment(targetPath)
-            await send(ctx, targetPath)
-            fse.remove(sourcePath)
-            fse.remove(targetPath)
-        }).catch((err) => {
-            console.log(err)
-        })
+    try {
+        await fse.ensureDir(sourcePath)
+        await compressing.zip.compressDir(sourcePath, targetPath, { ignoreBase: true })
+        ctx.attachment(targetPath)
+        await send(ctx, targetPath)
+    } catch (err) {
+        console.log(err)
+    } finally {
+        // 确保清理临时文件
+        await fse.remove(sourcePath).catch(() => {})
+        await fse.remove(targetPath).catch(() => {})
+    }
 }
 
 export const updatePageComp = async (ctx) => {
@@ -669,11 +671,86 @@ async function safeUnzip (zipFilePath, destDir) {
     const fs = require('fs')
     const fse = require('fs-extra')
 
+    // ZIP 炸弹防护配置
+    const MAX_EXTRACTED_SIZE = 50 * 1024 * 1024 // 50MB - 解压后文件总大小限制
+    const MAX_FILES_COUNT = 1000 // 文件数量限制
+    const MAX_DEPTH = 10 // 目录嵌套深度限制
+    const MAX_COMPRESSION_RATIO = 100 // 最大压缩比（解压后/压缩前）
+
     await fse.ensureDir(destDir)
 
     const directory = await unzipper.Open.file(zipFilePath)
+    
+    // 第一阶段：预检查所有文件（ZIP 炸弹防护）
+    let totalUncompressedSize = 0
+    let totalCompressedSize = 0
+    let fileCount = 0
+    
+    for (const file of directory.files) {
+        // 统计文件数量
+        fileCount++
+        if (fileCount > MAX_FILES_COUNT) {
+            throw new Error(`ZIP 包中文件数量过多，最大允许 ${MAX_FILES_COUNT} 个文件`)
+        }
+        
+        // 累计解压后大小
+        const uncompressedSize = file.uncompressedSize || 0
+        totalUncompressedSize += uncompressedSize
+        if (totalUncompressedSize > MAX_EXTRACTED_SIZE) {
+            throw new Error(`解压后文件总大小超过限制，最大允许 ${MAX_EXTRACTED_SIZE / 1024 / 1024}MB`)
+        }
+        
+        // 累计压缩大小
+        const compressedSize = file.compressedSize || 0
+        totalCompressedSize += compressedSize
+        
+        // 检查目录嵌套深度
+        const pathDepth = file.path.split('/').filter(p => p).length
+        if (pathDepth > MAX_DEPTH) {
+            throw new Error(`文件路径嵌套过深（${pathDepth}层），最大允许 ${MAX_DEPTH} 层`)
+        }
+    }
+    
+    // 检查整体压缩比（防止压缩比异常高的 ZIP 炸弹）
+    if (totalCompressedSize > 0) {
+        const compressionRatio = totalUncompressedSize / totalCompressedSize
+        if (compressionRatio > MAX_COMPRESSION_RATIO) {
+            throw new Error(`检测到异常压缩比（${compressionRatio.toFixed(1)}:1），可能是 ZIP 炸弹攻击`)
+        }
+    }
+    
+    // 第二阶段：执行实际解压
     for (const file of directory.files) {
-        const filePath = filterFilePath(file.path)
+        const rawPath = file.path
+        
+        // 符号链接检测：禁止 ZIP 包中包含符号链接（防止符号链接攻击）
+        if (file.type === 'SymbolicLink') {
+            throw new Error('ZIP 包中不允许包含符号链接')
+        }
+        
+        // URL 编码检测：防止 %2e%2e 等编码绕过路径遍历防护
+        // 1. 直接禁止包含 % 字符的路径
+        if (rawPath.includes('%')) {
+            throw new Error('ZIP 包中的文件路径不允许包含 URL 编码字符')
+        }
+        
+        // 2. 尝试解码并检测是否存在编码后的路径遍历
+        try {
+            const decodedPath = decodeURIComponent(rawPath)
+            // 如果解码后与原路径不同，且包含路径遍历符号
+            if (decodedPath !== rawPath && decodedPath.includes('..')) {
+                throw new Error('检测到 URL 编码的路径遍历攻击')
+            }
+        } catch (e) {
+            // 如果 decodeURIComponent 抛出异常（如非法编码），认为是恶意输入
+            if (e.message && e.message.includes('URI malformed')) {
+                throw new Error('ZIP 包中包含非法的 URL 编码')
+            }
+            // 重新抛出其他异常（包括我们自己抛出的安全检测异常）
+            throw e
+        }
+        
+        const filePath = filterFilePath(rawPath)
         if (!filePath) {
         // 文件名清理后为空，跳过或抛错
             throw new Error('文件名非法，无法解压')
@@ -688,8 +765,26 @@ async function safeUnzip (zipFilePath, destDir) {
             await fse.ensureDir(absolutePath)
         } else {
             await fse.ensureDir(path.dirname(absolutePath))
+            
+            // 实时监控写入大小（额外的运行时检查）
+            let writtenSize = 0
+            const maxFileSize = MAX_EXTRACTED_SIZE // 单个文件最大不超过总限制
+            
             const readStream = file.stream()
             const writeStream = fs.createWriteStream(absolutePath)
+            
+            // 监控写入的数据量
+            readStream.on('data', (chunk) => {
+                writtenSize += chunk.length
+                if (writtenSize > maxFileSize) {
+                    readStream.destroy()
+                    writeStream.destroy()
+                    // 删除部分写入的文件
+                    fs.unlink(absolutePath, () => {})
+                    throw new Error(`单个文件解压后大小超过限制: ${file.path}`)
+                }
+            })
+            
             await new Promise((resolve, reject) => {
                 readStream.pipe(writeStream)
                     .on('finish', resolve)
@@ -714,9 +809,26 @@ export const upload = async (ctx) => {
         }
         const uploadComponent = ctx.request.files.upload_file
 
+        // 1. 文件大小限制检查（最大 5MB）
+        const MAX_FILE_SIZE = 5 * 1024 * 1024 // 5MB
+        if (uploadComponent.size > MAX_FILE_SIZE) {
+            throw new Error('文件大小超过限制，最大支持5MB')
+        }
+
+        // 2. MIME 类型检查
         if (!['application/x-zip', 'application/zip', 'application/x-zip-compressed'].includes(uploadComponent.type)) {
             throw new Error(global.i18n.t('自定义组件上传只支持zip包'))
         }
+
+        // 3. 文件魔术数字检查（防止 MIME 类型伪造）
+        const fileBuffer = fs.readFileSync(uploadComponent.path)
+        const fileSignature = fileBuffer.toString('hex', 0, 4)
+        
+        // ZIP 文件的魔术数字：504B0304 (PK..) 或 504B0506 (空ZIP) 或 504B0708 (跨卷ZIP)
+        const validZipSignatures = ['504b0304', '504b0506', '504b0708']
+        if (!validZipSignatures.includes(fileSignature.toLowerCase())) {
+            throw new Error('文件格式不正确，只支持ZIP格式')
+        }
         let exitComponent = null
         if (id) {
             exitComponent = await ComponentModel.getOne({
diff --git a/lib/server/controller/file.js b/lib/server/controller/file.js
index 7433babe4..d36f89e20 100644
--- a/lib/server/controller/file.js
+++ b/lib/server/controller/file.js
@@ -10,13 +10,11 @@
  */
 
 import path from 'path'
-import fs from 'fs'
 import FileType from 'file-type'
 import md5 from 'md5'
-import { JSDOM } from 'jsdom'
-import DOMPurify from 'dompurify'
 import { LCDataService, TABLE_FILE_NAME } from '../service/common/data-service'
 import fileService from '../utils/file-service/index'
+import { validateNoStrictFile } from '../../shared/security/file-protection'
 import {
     Controller,
     Get,
@@ -86,7 +84,7 @@ export default class FileController {
 
         const fileKey = md5(`${userInfo.username}${projectId}${filePath}${Date.now()}`)
 
-        const noStrictExts = ['doc', 'xls', 'ppt', 'msi', 'csv', 'svg']
+        const noStrictExts = ['doc', 'xls', 'ppt', 'csv', 'svg']
 
         let ext = path.extname(file.name).slice(1)
         let mime = file.type
@@ -97,7 +95,7 @@ export default class FileController {
             mime = typeResult.mime
         }
 
-        if (!ALLOW_UPLOAD_TYPE.includes(ext)) {   
+        if (!ALLOW_UPLOAD_TYPE.includes(ext)) {
             throw new Error('不允许上传该格式类型文件')
         }
 
@@ -108,15 +106,9 @@ export default class FileController {
         }
         file.name = file.name?.replace(/(\||;|&|\\|\$|>|<|`|!|\s+)/gi, '')
 
-        if (mime === 'image/svg+xml') {
-            const svgString = fs.readFileSync(filePath, 'utf-8')
-
-            // 过滤xss
-            const window = new JSDOM('').window
-            const purify = DOMPurify(window)
-            const cleanSvg = purify.sanitize(svgString)
-
-            fs.writeFileSync(filePath, cleanSvg)
+        // 对 noStrictExts 中的文件类型进行安全验证
+        if (noStrictExts.includes(ext)) {
+            await validateNoStrictFile(filePath, ext, mime)
         }
 
         try {
diff --git a/lib/server/controller/page-template.js b/lib/server/controller/page-template.js
index bae2846f1..6df4041f1 100644
--- a/lib/server/controller/page-template.js
+++ b/lib/server/controller/page-template.js
@@ -262,6 +262,48 @@ export const importTemplate = async (ctx) => {
     try {
         const params = ctx.request.body
         params.belongProjectId = ctx.request.headers['x-project-id']
+        
+        // 验证数据结构
+        if (!params.template || typeof params.template !== 'object') {
+            ctx.throwError({
+                message: global.i18n.t('模板数据格式不正确')
+            })
+        }
+        
+        // 验证必需字段
+        const { template, vars = [], functions = [] } = params
+        if (!template.templateName || !template.content || !template.categoryId) {
+            ctx.throwError({
+                message: global.i18n.t('模板缺少必需字段')
+            })
+        }
+        
+        // 验证字段类型
+        if (!Array.isArray(vars) || !Array.isArray(functions)) {
+            ctx.throwError({
+                message: global.i18n.t('变量和函数必须是数组格式')
+            })
+        }
+        
+        // 验证content是否为合法JSON
+        try {
+            const contentObj = typeof template.content === 'string' ? JSON.parse(template.content) : template.content
+            if (typeof contentObj !== 'object') {
+                throw new Error('Invalid content format')
+            }
+        } catch (e) {
+            ctx.throwError({
+                message: global.i18n.t('模板内容格式不正确')
+            })
+        }
+        
+        // 限制数组大小,防止DoS
+        if (vars.length > 100 || functions.length > 100) {
+            ctx.throwError({
+                message: global.i18n.t('导入的变量或函数数量超过限制')
+            })
+        }
+        
         // 模板名称已存在
         const record = await PageTemplateModel.getOne({
             templateName: params?.template?.templateName,
@@ -273,7 +315,8 @@ export const importTemplate = async (ctx) => {
                 message: global.i18n.t('模板名称已存在')
             })
         }
-
+        // 重置一遍这几个字段值
+        Object.assign(params.template, { fromPageCode: '', isOffcial: 0, offcialType: '', parentId: 0 })
         await handleImportTemplate(params)
         ctx.send({
             code: 0,
diff --git a/lib/server/controller/page.js b/lib/server/controller/page.js
index 1832b4713..35fd086ea 100644
--- a/lib/server/controller/page.js
+++ b/lib/server/controller/page.js
@@ -15,8 +15,10 @@ import { LCDataService, TABLE_FILE_NAME } from '../service/common/data-service'
 import { POST_PAGE_CREATE, PUT_PAGE_UPDATE } from '../system-conf/operate-log'
 import { whereVersionLiteral } from '../model/common'
 import iamAppPermModel from '../model/iam-app-perm'
+import { logger } from '../logger'
 
 const fs = require('fs')
+const path = require('path')
 
 export const getPageList = async (ctx) => {
     try {
@@ -551,12 +553,72 @@ async function queryPageDeatail (pageId) {
     return detail
 }
 
+// 导入json文件并返回内容
+// 校验文件魔数（检查文件头是否为合法JSON）
+const validateJsonFileMagic = (filePath) => {
+    const buffer = Buffer.alloc(1024) // 读取前 1KB
+    const fd = fs.openSync(filePath, 'r')
+    try {
+        fs.readSync(fd, buffer, 0, 1024, 0)
+    } finally {
+        fs.closeSync(fd)
+    }
+    
+    // JSON 文件应以 {、[ 或空白符开头
+    const content = buffer.toString('utf8').trim()
+    if (!content.startsWith('{') && !content.startsWith('[')) {
+        throw new Error(global.i18n.t('文件格式不正确，必须是JSON格式'))
+    }
+}
+
 // 导入json文件并返回内容
 export const importJson = async (ctx) => {
+    let tempFilePath = null
+    
     try {
+        // 1. 文件存在性校验
         const file = ctx.request.files || {}
         const uploadFile = file.upload_file || {}
+        
+        if (!uploadFile || !uploadFile.path) {
+            throw new Error(global.i18n.t('未上传文件'))
+        }
+        
+        tempFilePath = uploadFile.path
+        
+        // 2. 文件大小限制 (15MB)
+        const MAX_FILE_SIZE = 15 * 1024 * 1024
+        const stats = fs.statSync(uploadFile.path)
+        if (stats.size > MAX_FILE_SIZE) {
+            throw new Error(global.i18n.t('文件大小超过限制(15MB)'))
+        }
+        
+        // 3. 文件类型校验 (MIME + 扩展名)
+        const allowedMimes = ['application/json', 'text/plain', 'text/json']
+        const fileName = uploadFile.name || uploadFile.filename || ''
+        const ext = path.extname(fileName).toLowerCase()
+        
+        if (ext !== '.json') {
+            throw new Error(global.i18n.t('仅支持 .json 文件'))
+        }
+        
+        if (uploadFile.type && !allowedMimes.includes(uploadFile.type)) {
+            throw new Error(global.i18n.t('文件MIME类型不正确，仅支持JSON格式'))
+        }
+        
+        // 4. 魔数校验（文件头检测）
+        validateJsonFileMagic(uploadFile.path)
+        
+        // 5. 读取文件内容
         const data = fs.readFileSync(uploadFile.path, 'utf8')
+        
+        // 6. JSON 格式校验
+        try {
+            JSON.parse(data)
+        } catch (e) {
+            throw new Error(global.i18n.t('JSON 格式不正确：{{n}}', { n: e.message }))
+        }
+        
         ctx.send({
             code: 0,
             message: 'OK',
@@ -566,6 +628,17 @@ export const importJson = async (ctx) => {
         ctx.throwError({
             message: global.i18n.t('上传失败：{{n}}', { n: err.message })
         })
+    } finally {
+        // 7. 清理临时文件
+        if (tempFilePath) {
+            try {
+                if (fs.existsSync(tempFilePath)) {
+                    fs.unlinkSync(tempFilePath)
+                }
+            } catch (e) {
+                logger.error(`Failed to clean temp file: ${tempFilePath}`, e)
+            }
+        }
     }
 }
 
@@ -606,9 +679,7 @@ const updagePageActiveInfo = async (pageId, activeUser) => {
         updateTime: currentPage.updateTime,
         updateUser: currentPage.updateUser
     }
-    await repository.update({
-        where: { id: currentPage.id }
-    }, updateFields)
+    await repository.update({ id: currentPage.id }, updateFields)
     return Object.assign(currentPage, updateFields)
 }
 
@@ -687,9 +758,7 @@ export const releasePage = async ctx => {
         const currentPage = await repository.findOne({ where: { id: pageId } }) || {}
 
         if (activeUser === currentPage.activeUser) {
-            await repository.update({
-                where: { id: currentPage.id }
-            }, {
+            await repository.update({ id: currentPage.id }, {
                 activeUser: null,
                 updateTime: currentPage.updateTime,
                 updateUser: currentPage.updateUser
diff --git a/lib/server/controller/project-code.js b/lib/server/controller/project-code.js
index d36eb9d08..4c2cf02ce 100644
--- a/lib/server/controller/project-code.js
+++ b/lib/server/controller/project-code.js
@@ -29,6 +29,12 @@ const ProjectCode = {
             let pathName = `bklesscode-project-${projectCode}-${projectId}${versionId ? `-${versionName}` : ''}`
             // 去除路径名中的./\符号
             pathName = pathName?.replace(/[./\\]/g, '_')
+            
+            // 确保 pathName 只包含安全字符
+            if (!/^[a-zA-Z0-9_-]+$/.test(pathName)) {
+                throw new Error('路径名包含非法字符')
+            }
+            
             await ProjectCodeModel.generateCode(projectId, versionId || undefined, pathName)
 
             const sourcePath = path.join(STATIC_URL, pathName)
diff --git a/lib/server/controller/project.js b/lib/server/controller/project.js
index 2ddb26ab7..0e1268571 100644
--- a/lib/server/controller/project.js
+++ b/lib/server/controller/project.js
@@ -165,24 +165,33 @@ module.exports = {
     // 导出应用
     async exportProject (ctx) {
         let projectId = ctx.request.query?.projectId
-        projectId = parseInt(projectId)
+        projectId = parseInt(projectId, 10)
+        
+        // 参数有效性校验
+        if (!projectId || isNaN(projectId) || projectId <= 0) {
+            ctx.throw(400, global.i18n.t('无效的项目ID'))
+        }
+        
         const versionId = null
 
         const pathName = `lesscode-project-${projectId}.json`
         const targetPath = path.join(STATIC_URL, pathName)
         
-        const exportData = await getExportProjectData(projectId, versionId)
-        const exportDataStr = JSON.stringify(exportData)
+        try {
+            const exportData = await getExportProjectData(projectId, versionId)
+            const exportDataStr = JSON.stringify(exportData)
 
-        await fse.ensureFile(targetPath).then(async () => {
+            await fse.ensureFile(targetPath)
             fse.writeFileSync(targetPath, exportDataStr, 'utf8')
             ctx.attachment(targetPath)
             await send(ctx, targetPath)
-            fse.remove(targetPath)
-        }).catch(err => {
+        } catch (err) {
             console.log('导出应用失败err', err)
             ctx.throw(global.i18n.t('导出应用失败'))
-        })
+        } finally {
+            // 确保清理临时文件
+            await fse.remove(targetPath).catch(() => {})
+        }
     },
 
     async queryProject (ctx) {
diff --git a/lib/server/utils/file-service/index.js b/lib/server/utils/file-service/index.js
index df159424f..b2cdbf400 100644
--- a/lib/server/utils/file-service/index.js
+++ b/lib/server/utils/file-service/index.js
@@ -1,212 +1,221 @@
-const fs = require('fs')
-const request = require('request')
-const path = require('path')
-
-// bk-repo.js配置文件不存在时赋值空对象
-let config
-try {
-    config = require('../../conf/bk-repo')
-} catch (_) {
-    config = {}
-}
-const headers = {
-    'Authorization': 'Basic ' + Buffer.from(config.BKREPO_USERNAME + ':' + config.BKREPO_PASSWORD).toString('base64')
-}
-
-const urlPrefix = `${config.BKREPO_ENDPOINT_URL}/generic/${config.BKREPO_PROJECT}`
-
-/**
- * 获取最终的接口调用地址
- * @param {string} path 接口路径
- * @param {boolean} isPublic 是否为公开
- * @returns {string} 最终的接口调用地址
- */
-const getUrl = (path, isPublic) => {
-    let prefix = urlPrefix
-    if (isPublic === undefined) {
-        prefix = `${prefix}/${config.BKREPO_BUCKET}`
-    } else {
-        prefix = `${prefix}/${isPublic ? config.BKREPO_PUBLIC_BUCKET : config.BKREPO_PRIVATE_BUCKET}`
-    }
-
-    let newPath = path
-    if (!newPath.startsWith('/')) {
-        newPath = '/' + newPath
-    }
-
-    return `${prefix}${newPath}`
-}
-
-const checkBkRepoSetting = (throwErr = true) => {
-    if (!config.BKREPO_USERNAME || !config.BKREPO_PROJECT || !config.BKREPO_ENDPOINT_URL) {
-        if (throwErr) {
-            throw new Error(global.i18n.t('bkRepo: 请先搭建bkRepo服务并确认配置信息已设置正确'))
-        } else {
-            return false
-        }
-    } else {
-        return true
-    }
-}
-
-const uploadFolder = async (folderPath, uploadKey) => {
-    checkBkRepoSetting()
-    const fileMap = []
-    const walkSync = (currentDirPath, prefixPath) => {
-        fs.readdirSync(currentDirPath).forEach(async (name) => {
-            const filePath = path.join(currentDirPath, name)
-            const stat = fs.statSync(filePath)
-            if (stat.isFile()) {
-                fileMap.push(uploadFile(filePath, `/${prefixPath}/`))
-            } else if (stat.isDirectory()) {
-                walkSync(filePath, `${prefixPath}/${name}`)
-            }
-        })
-    }
-    walkSync(folderPath, uploadKey)
-    return Promise.all(fileMap)
-}
-
-/*
-* @params
-* string targetFile: bkrepo上文件路径
-* string dest 下载文件的写入目录，为空则不会写到本地文件直接返回内容
-*/
-const downloadFile = (targetFile, dest) => {
-    checkBkRepoSetting()
-    const fse = require('fs-extra')
-
-    if (dest) {
-        const destParent = path.dirname(dest)
-        fse.ensureDirSync(destParent)
-    }
-
-    const options = {
-        url: getUrl(targetFile),
-        headers: headers
-    }
-
-    return new Promise((resolve, reject) => {
-        request.get(options, function (err, res, body) {
-            if (err || res.statusCode !== 200) {
-                console.log(err, res.statusCode, body)
-                reject(new Error(`${global.i18n.t('文件下载失败')}: ${err || res.statusCode}`))
-            } else {
-                if (dest) {
-                    fse.outputFileSync(dest, body)
-                    resolve()
-                } else {
-                    resolve(body)
-                }
-            }
-        })
-    })
-}
-
-const getSignUrl = async (fullPathSet = [], expireSeconds = 0) => {
-    checkBkRepoSetting()
-    const data = {
-        projectId: config.BKREPO_PROJECT,
-        repoName: config.BKREPO_BUCKET,
-        type: 'DOWNLOAD',
-        expireSeconds,
-        fullPathSet
-    }
-    const url = `${config.BKREPO_ENDPOINT_URL}/generic/temporary/url/create`
-    return new Promise((resolve, reject) => {
-        request.post({ url, body: data, json: true, headers }, function (err, res, body) {
-            if (err || res.statusCode !== 200) {
-                reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
-            } else if (typeof body === 'object' && body.code !== 0) {
-                reject(new Error(`${global.i18n.t('获取下载链接失败')}:${body.message}`))
-            } else {
-                if (body.data[0]?.url) {
-                    resolve(body.data[0]?.url)
-                } else {
-                    reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
-                }
-            }
-        })
-    })
-}
-
-const uploadFile = async (filePath, uploadKey, settings = {}) => {
-    checkBkRepoSetting()
-    const key = path.basename(filePath)
-    const fileStream = fs.createReadStream(filePath)
-    fileStream.on('error', err => {
-        return Promise.reject(err)
-    })
-    const res = await uploadRepoFile(`${uploadKey}${key}`, fileStream, settings)
-    return res
-}
-
-const uploadImage = async (filePath, uploadKey, settings = {}) => {
-    checkBkRepoSetting()
-    const key = path.basename(filePath)
-
-    let uploadPath = `${uploadKey}${key}`
-    if (settings.ensurePath) {
-        uploadPath = uploadKey
-    }
-
-    let fileStream
-    if (settings.fileStream) {
-        fileStream = settings.fileStream
-    } else {
-        fileStream = fs.createReadStream(filePath)
-        fileStream.on('error', err => {
-            return Promise.reject(err)
-        })
-    }
-    
-    const res = await uploadRepoFile(uploadPath, fileStream, settings)
-    return res
-}
-
-/**
- * 上传文件至bkrepo
- * @param {string} uploadPath 文件存储路径
- * @param {ReadStream} fileStream 文件内容
- * @param {object} settings 配置选项
- * @param {boolean} settings.isPublic 是否公开
- * @param {boolean} settings.fullUrl 是否返回完整url
- * @returns {Promise} 文件存储路径
- */
-const uploadRepoFile = async (uploadPath, fileStream, settings = {}) => {
-    // 把..过滤掉， 避免相对路径, 过滤危险字符
-    uploadPath = uploadPath?.replaceAll('..', '')
-    uploadPath = uploadPath?.replace(/(\||;|&|\\|\$|>|<|`|!|\s+)/gi, '')
-    const url = getUrl(uploadPath, settings.isPublic)
-    const options = {
-        url,
-        method: 'PUT',
-        headers: Object.assign({}, headers, { 'X-BKREPO-OVERWRITE': false }),
-        body: fileStream
-    }
-    return new Promise((resolve, reject) => {
-        request(options, function (err, res, body) {
-            if (typeof body === 'string') {
-                body = JSON.parse(body)
-            }
-            if (err || res.statusCode !== 200) {
-                reject(new Error(`${global.i18n.t('上传至repo失败')}: ${err || res.statusCode}`))
-            } else if (typeof body === 'object' && body.code > 0) {
-                reject(new Error(`${global.i18n.t('上传至repo失败')}： ${body.message}`))
-            } else if (body.code === 0) {
-                resolve(settings.fullUrl ? url : uploadPath)
-            } else {
-                reject(new Error(global.i18n.t('上传至repo失败')))
-            }
-        })
-    })
-}
-
-module.exports = {
-    checkBkRepoSetting,
-    uploadFile,
-    getSignUrl,
-    uploadFolder,
-    downloadFile,
-    uploadImage
-}
+import { sanitizeUploadPath } from '../../../shared/security/file-protection'
+
+const fs = require('fs')
+const request = require('request')
+const path = require('path')
+
+// bk-repo.js配置文件不存在时赋值空对象
+let config
+try {
+    config = require('../../conf/bk-repo')
+} catch (_) {
+    config = {}
+}
+const headers = {
+    'Authorization': 'Basic ' + Buffer.from(config.BKREPO_USERNAME + ':' + config.BKREPO_PASSWORD).toString('base64')
+}
+
+const urlPrefix = `${config.BKREPO_ENDPOINT_URL}/generic/${config.BKREPO_PROJECT}`
+
+/**
+ * 获取最终的接口调用地址
+ * @param {string} path 接口路径
+ * @param {boolean} isPublic 是否为公开
+ * @returns {string} 最终的接口调用地址
+ */
+const getUrl = (path, isPublic) => {
+    let prefix = urlPrefix
+    if (isPublic === undefined) {
+        prefix = `${prefix}/${config.BKREPO_BUCKET}`
+    } else {
+        prefix = `${prefix}/${isPublic ? config.BKREPO_PUBLIC_BUCKET : config.BKREPO_PRIVATE_BUCKET}`
+    }
+
+    let newPath = path
+    if (!newPath.startsWith('/')) {
+        newPath = '/' + newPath
+    }
+
+    return `${prefix}${newPath}`
+}
+
+const checkBkRepoSetting = (throwErr = true) => {
+    if (!config.BKREPO_USERNAME || !config.BKREPO_PROJECT || !config.BKREPO_ENDPOINT_URL) {
+        if (throwErr) {
+            throw new Error(global.i18n.t('bkRepo: 请先搭建bkRepo服务并确认配置信息已设置正确'))
+        } else {
+            return false
+        }
+    } else {
+        return true
+    }
+}
+
+const uploadFolder = async (folderPath, uploadKey) => {
+    checkBkRepoSetting()
+    const fileMap = []
+    const walkSync = (currentDirPath, prefixPath) => {
+        fs.readdirSync(currentDirPath).forEach(async (name) => {
+            const filePath = path.join(currentDirPath, name)
+            const stat = fs.statSync(filePath)
+            if (stat.isFile()) {
+                fileMap.push(uploadFile(filePath, `/${prefixPath}/`))
+            } else if (stat.isDirectory()) {
+                walkSync(filePath, `${prefixPath}/${name}`)
+            }
+        })
+    }
+    walkSync(folderPath, uploadKey)
+    return Promise.all(fileMap)
+}
+
+/*
+* @params
+* string targetFile: bkrepo上文件路径
+* string dest 下载文件的写入目录，为空则不会写到本地文件直接返回内容
+*/
+const downloadFile = (targetFile, dest) => {
+    checkBkRepoSetting()
+    const fse = require('fs-extra')
+
+    // 安全过滤 targetFile 路径
+    targetFile = sanitizeUploadPath(targetFile)
+    if (!targetFile) {
+        return Promise.reject(new Error(global.i18n.t('文件路径无效')))
+    }
+
+    if (dest) {
+        // 确保 dest 是规范化的绝对路径
+        dest = path.resolve(dest)
+        const destParent = path.dirname(dest)
+        fse.ensureDirSync(destParent)
+    }
+
+    const options = {
+        url: getUrl(targetFile),
+        headers: headers
+    }
+
+    return new Promise((resolve, reject) => {
+        request.get(options, function (err, res, body) {
+            if (err || res.statusCode !== 200) {
+                console.log(err, res.statusCode, body)
+                reject(new Error(`${global.i18n.t('文件下载失败')}: ${err || res.statusCode}`))
+            } else {
+                if (dest) {
+                    fse.outputFileSync(dest, body)
+                    resolve()
+                } else {
+                    resolve(body)
+                }
+            }
+        })
+    })
+}
+
+const getSignUrl = async (fullPathSet = [], expireSeconds = 0) => {
+    checkBkRepoSetting()
+    const data = {
+        projectId: config.BKREPO_PROJECT,
+        repoName: config.BKREPO_BUCKET,
+        type: 'DOWNLOAD',
+        expireSeconds,
+        fullPathSet
+    }
+    const url = `${config.BKREPO_ENDPOINT_URL}/generic/temporary/url/create`
+    return new Promise((resolve, reject) => {
+        request.post({ url, body: data, json: true, headers }, function (err, res, body) {
+            if (err || res.statusCode !== 200) {
+                reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
+            } else if (typeof body === 'object' && body.code !== 0) {
+                reject(new Error(`${global.i18n.t('获取下载链接失败')}:${body.message}`))
+            } else {
+                if (body.data[0]?.url) {
+                    resolve(body.data[0]?.url)
+                } else {
+                    reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
+                }
+            }
+        })
+    })
+}
+
+const uploadFile = async (filePath, uploadKey, settings = {}) => {
+    checkBkRepoSetting()
+    const key = path.basename(filePath)
+    const fileStream = fs.createReadStream(filePath)
+    fileStream.on('error', err => {
+        return Promise.reject(err)
+    })
+    const res = await uploadRepoFile(`${uploadKey}${key}`, fileStream, settings)
+    return res
+}
+
+const uploadImage = async (filePath, uploadKey, settings = {}) => {
+    checkBkRepoSetting()
+    const key = path.basename(filePath)
+
+    let uploadPath = `${uploadKey}${key}`
+    if (settings.ensurePath) {
+        uploadPath = uploadKey
+    }
+
+    let fileStream
+    if (settings.fileStream) {
+        fileStream = settings.fileStream
+    } else {
+        fileStream = fs.createReadStream(filePath)
+        fileStream.on('error', err => {
+            return Promise.reject(err)
+        })
+    }
+    
+    const res = await uploadRepoFile(uploadPath, fileStream, settings)
+    return res
+}
+
+/**
+ * 上传文件至bkrepo
+ * @param {string} uploadPath 文件存储路径
+ * @param {ReadStream} fileStream 文件内容
+ * @param {object} settings 配置选项
+ * @param {boolean} settings.isPublic 是否公开
+ * @param {boolean} settings.fullUrl 是否返回完整url
+ * @returns {Promise} 文件存储路径
+ */
+const uploadRepoFile = async (uploadPath, fileStream, settings = {}) => {
+    // 安全过滤上传路径
+    uploadPath = sanitizeUploadPath(uploadPath)
+    const url = getUrl(uploadPath, settings.isPublic)
+    const options = {
+        url,
+        method: 'PUT',
+        headers: Object.assign({}, headers, { 'X-BKREPO-OVERWRITE': false }),
+        body: fileStream
+    }
+    return new Promise((resolve, reject) => {
+        request(options, function (err, res, body) {
+            if (typeof body === 'string') {
+                body = JSON.parse(body)
+            }
+            if (err || res.statusCode !== 200) {
+                reject(new Error(`${global.i18n.t('上传至repo失败')}: ${err || res.statusCode}`))
+            } else if (typeof body === 'object' && body.code > 0) {
+                reject(new Error(`${global.i18n.t('上传至repo失败')}： ${body.message}`))
+            } else if (body.code === 0) {
+                resolve(settings.fullUrl ? url : uploadPath)
+            } else {
+                reject(new Error(global.i18n.t('上传至repo失败')))
+            }
+        })
+    })
+}
+
+module.exports = {
+    checkBkRepoSetting,
+    uploadFile,
+    getSignUrl,
+    uploadFolder,
+    downloadFile,
+    uploadImage
+}
diff --git a/lib/shared/security/file-protection.js b/lib/shared/security/file-protection.js
new file mode 100644
index 000000000..308abd949
--- /dev/null
+++ b/lib/shared/security/file-protection.js
@@ -0,0 +1,197 @@
+/**
+ * 文件安全保护模块
+ * 对 noStrictExts 中的文件类型进行安全验证
+ */
+
+import fs from 'fs'
+import FileType from 'file-type'
+import { JSDOM } from 'jsdom'
+import DOMPurify from 'dompurify'
+
+/**
+ * 安全过滤上传路径
+ * @param {string} uploadPath - 原始路径
+ * @returns {string} 过滤后的安全路径
+ */
+export function sanitizeUploadPath (uploadPath) {
+    if (!uploadPath) return ''
+    
+    // 移除所有路径遍历尝试
+    uploadPath = uploadPath.replace(/\.\./g, '')
+    uploadPath = uploadPath.replace(/[\/\\]+/g, '/') // 统一路径分隔符
+    uploadPath = uploadPath.replace(/^\/+/, '') // 移除开头的斜杠
+    
+    // 过滤危险字符（包括控制字符）
+    // eslint-disable-next-line no-control-regex
+    uploadPath = uploadPath.replace(/[\x00-\x1f\x7f-\x9f]/g, '') // 控制字符
+    uploadPath = uploadPath.replace(/[|;&\\$><`!%\s]/g, '') // 危险字符
+    
+    return uploadPath
+}
+
+/**
+ * 验证 noStrictExts 文件类型的安全性
+ * @param {string} filePath - 文件路径
+ * @param {string} ext - 文件扩展名
+ * @param {string} mime - MIME 类型
+ * @throws {Error} 验证失败时抛出错误
+ */
+export async function validateNoStrictFile (filePath, ext, mime) {
+    if (!filePath || !fs.existsSync(filePath)) {
+        throw new Error('文件不存在或路径无效')
+    }
+
+    switch (ext.toLowerCase()) {
+        case 'svg':
+            await validateSvgFile(filePath)
+            break
+        case 'csv':
+            await validateCsvFile(filePath)
+            break
+        case 'doc':
+        case 'xls':
+        case 'ppt':
+            await validateOfficeFile(filePath, ext)
+            break
+        default:
+            // 对于其他 noStrictExts 中的文件类型，进行基本验证
+            break
+    }
+}
+
+/**
+ * 验证 SVG 文件安全性
+ * @param {string} filePath - SVG 文件路径
+ */
+async function validateSvgFile (filePath) {
+    try {
+        const svgContent = fs.readFileSync(filePath, 'utf-8')
+        
+        // 检查 SVG 复杂度（防止 DoS 攻击）
+        const elementCount = (svgContent.match(/<[^>]+>/g) || []).length
+        if (elementCount > 1000) {
+            throw new Error('SVG 文件过于复杂，可能存在 DoS 风险')
+        }
+        
+        // 使用 DOMPurify 进行清理
+        const window = new JSDOM('').window
+        const purify = DOMPurify(window)
+        const cleanSvg = purify.sanitize(svgContent)
+        
+        // 将清理后的内容写回文件
+        fs.writeFileSync(filePath, cleanSvg)
+    } catch (error) {
+        if (error.message.includes('SVG')) {
+            throw error
+        }
+        throw new Error('SVG 文件格式验证失败')
+    }
+}
+
+/**
+ * 验证 CSV 文件安全性
+ * @param {string} filePath - CSV 文件路径
+ */
+async function validateCsvFile (filePath) {
+    try {
+        const csvContent = fs.readFileSync(filePath, 'utf-8')
+        
+        // 检查 CSV 注入攻击模式
+        const injectionPatterns = [
+            /^[\s]*[=@+\-]/gm, // 公式注入
+            /cmd\s*\|/gi, // 命令注入
+            /powershell/gi, // PowerShell 命令
+            /\|.*calc/gi, // 计算器调用
+            /\|.*notepad/gi // 记事本调用
+        ]
+        
+        for (const pattern of injectionPatterns) {
+            if (pattern.test(csvContent)) {
+                throw new Error('CSV 文件包含潜在的注入攻击内容')
+            }
+        }
+        
+        // 检查是否包含可疑的公式
+        const lines = csvContent.split('\n')
+        for (const line of lines) {
+            const cells = line.split(',')
+            for (const cell of cells) {
+                const trimmedCell = cell.trim()
+                if (trimmedCell.startsWith('=') || trimmedCell.startsWith('@')
+                    || trimmedCell.startsWith('+') || trimmedCell.startsWith('-')) {
+                    // 进一步检查是否为恶意公式
+                    if (/\b(cmd|powershell|calc|notepad|system|exec)\b/i.test(trimmedCell)) {
+                        throw new Error('CSV 文件包含恶意公式')
+                    }
+                }
+            }
+        }
+    } catch (error) {
+        if (error.message.includes('CSV')) {
+            throw error
+        }
+        throw new Error('CSV 文件格式验证失败')
+    }
+}
+
+/**
+ * 验证 Office 文档安全性
+ * @param {string} filePath - Office 文档路径
+ * @param {string} ext - 文件扩展名
+ */
+async function validateOfficeFile (filePath, ext) {
+    try {
+        // 使用 file-type 库验证文件的真实类型
+        const typeResult = await FileType.fromFile(filePath)
+        
+        if (!typeResult) {
+            throw new Error(`无法识别 ${ext.toUpperCase()} 文件的真实类型`)
+        }
+        
+        // 验证文件头是否符合预期的 Office 文档格式
+        const validMimeTypes = {
+            'doc': ['application/msword'],
+            'xls': ['application/vnd.ms-excel'],
+            'ppt': ['application/vnd.ms-powerpoint']
+        }
+        
+        const expectedMimes = validMimeTypes[ext.toLowerCase()]
+        if (expectedMimes && !expectedMimes.includes(typeResult.mime)) {
+            // 对于新版本的 Office 文档，检查是否为 ZIP 格式（docx, xlsx, pptx 的基础格式）
+            if (typeResult.mime !== 'application/zip') {
+                throw new Error(`${ext.toUpperCase()} 文件类型验证失败，实际类型为 ${typeResult.mime}`)
+            }
+        }
+        
+        // 读取文件头进行进一步验证
+        const buffer = fs.readFileSync(filePath)
+        const header = buffer.slice(0, 8)
+        
+        // 检查 Office 文档的魔数
+        const officeSignatures = {
+            'doc': [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1], // OLE2 格式
+            'xls': [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1], // OLE2 格式
+            'ppt': [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1] // OLE2 格式
+        }
+        
+        const expectedSignature = officeSignatures[ext.toLowerCase()]
+        if (expectedSignature) {
+            const headerMatches = expectedSignature.every((byte, index) => header[index] === byte)
+            
+            // 如果不是 OLE2 格式，检查是否为 ZIP 格式（新版本 Office 文档）
+            if (!headerMatches) {
+                const zipSignature = [0x50, 0x4B, 0x03, 0x04] // ZIP 文件头
+                const isZip = zipSignature.every((byte, index) => header[index] === byte)
+                
+                if (!isZip) {
+                    throw new Error(`${ext.toUpperCase()} 文件头验证失败`)
+                }
+            }
+        }
+    } catch (error) {
+        if (error.message.includes('文件') || error.message.includes('类型') || error.message.includes('验证')) {
+            throw error
+        }
+        throw new Error(`${ext.toUpperCase()} 文件安全验证失败`)
+    }
+}

From abb5cdf0f6e9a0fcf7bb31a9ce51eb83d7fff82c Mon Sep 17 00:00:00 2001
From: LivySara <1936808975@qq.com>
Date: Mon, 2 Feb 2026 10:28:01 +0800
Subject: [PATCH 4/4] =?UTF-8?q?feat=EF=BC=9Acrlf=E5=8F=98=E6=88=90lf=20---?=
 =?UTF-8?q?story=3D130244258=20#=20Reviewed,=20transaction=20id:=2073272?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../lib/server/service/data-source.js         | 586 +++++++++---------
 .../lib/server/service/open-api.js            | 214 +++----
 .../lib/server/service/data-source.js         | 586 +++++++++---------
 .../lib/server/service/open-api.js            | 214 +++----
 lib/server/utils/file-service/index.js        | 442 ++++++-------
 5 files changed, 1021 insertions(+), 1021 deletions(-)

diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js b/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
index ae0049a47..0f6b25aaa 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/service/data-source.js
@@ -1,293 +1,293 @@
-import {
-    validateData
-} from '../../shared/form/validate'
-import {
-    formMap
-} from '../../shared/form/index'
-import {
-    isEmpty
-} from '../../shared/util'
-import {
-    NO_LENGTH_ORM_KEY
-} from '../../shared/data-source/constant'
-import {
-    splitSql,
-    uuid
-} from '../util'
-import dataService, {
-    Like,
-    getDataService as getThirdPartDataService
-} from './data-service'
-import dayjs from 'dayjs'
-import DayJSUtcPlugin from 'dayjs/plugin/utc'
-import thirdPartDBConfs from '../conf/third-part-db'
-import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
-import { RequestContext } from '../middleware/request-context'
-import { decode } from 'js-base64'
-
-dayjs.extend(DayJSUtcPlugin)
-
-// 数据源入库校验
-export const validate = async (formId, data) => {
-    // 如果有 formId，执行 nocode 校验
-    if (formId) {
-        const formData = formMap[formId]
-        if (!formData) {
-            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
-        }
-        const validateResult = await validateData(
-            formData.content,
-            data,
-            formData,
-            dataService
-        )
-        if (!validateResult.result) {
-            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
-        }
-    }
-}
-
-// 数据在入库前进行转换
-export const transferData = (formId, data) => {
-    let result = data
-    // 如果有 formId，执行 nocode 转换
-    if (formId) {
-        result = {}
-        data.forEach(({ key, value }) => {
-            result[key] = value
-        })
-    }
-
-    return result
-}
-
-// 根据时区转换时间
-export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
-    if (isEmpty(data)) {
-        return data
-    }
-    const transferList = Array.isArray(data) ? data : [data]
-    columns.forEach((column) => {
-        if (column.type === 'datetime') {
-            transferList.forEach((transferItem) => {
-                if (transferItem[column.propertyName] && timezoneOffset) {
-                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
-                        .utcOffset(-timezoneOffset)
-                        .format('YYYY-MM-DD HH:mm:ss')
-                }
-            })
-        }
-    })
-    return Array.isArray(data) ? transferList : transferList[0]
-}
-
-// 只能是查询语句检查 - 增强版本
-export const querySqlCheck = (sql) => {
-    if (!sql || typeof sql !== 'string') {
-        throw new Error('SQL语句不能为空')
-    }
-
-    const trimmedSql = sql.trim()
-    
-    if (!/;$/.test(trimmedSql)) {
-        throw new Error('Sql 语句不完整，需要是【;】号结尾')
-    }
-
-    // 基础检查列表（保持原有逻辑）
-    const checkList = [
-        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
-        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
-        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
-        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
-        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
-        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
-        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
-        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
-    ]
-
-    // 增强的安全检查列表
-    const enhancedCheckList = [
-        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
-        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
-        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
-        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
-        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
-        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
-        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
-        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
-        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
-        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
-        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
-        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
-        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
-        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
-        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
-        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
-        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
-        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
-        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
-        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
-        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
-        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
-        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
-        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
-    ]
-
-    const sqlArr = splitSql(sql)
-    sqlArr.forEach((sqlStr) => {
-        const lowerCaseSql = sqlStr.trim().toLowerCase()
-        if (lowerCaseSql) {
-            // 执行原有检查
-            checkList.forEach((checkItem) => {
-                if (checkItem.check(lowerCaseSql)) {
-                    throw new Error(checkItem.message)
-                }
-            })
-
-            // 执行增强检查
-            enhancedCheckList.forEach((checkItem) => {
-                if (checkItem.check(lowerCaseSql)) {
-                    throw new Error(checkItem.message)
-                }
-            })
-        }
-    })
-}
-
-// sql 解码
-export const decodeSql = (sql, params) => {
-    try {
-        let decodedSql = decode(sql)
-
-        if (!decodedSql || typeof decodedSql !== 'string') {
-            throw new Error('无效的SQL语句')
-        }
-        
-        const paramKeys = Object.keys(params || {})
-        if (paramKeys.length > 0) {
-            paramKeys.forEach((paramKey) => {
-                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
-                decodedSql = decodedSql.replace(reg, params[paramKey])
-            })
-        }
-        return decodedSql
-    } catch (error) {
-        throw new Error(`SQL解码失败: ${error.message}`)
-    }
-}
-
-@EventSubscriber()
-class PreviewSubscriber {
-    beforeInsert ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.createUser = currentUser.username || entity.createUser
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.createTime = new Date()
-        entity.updateTime = new Date()
-    }
-
-    beforeUpdate ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.updateTime = new Date()
-    }
-}
-
-/**
- * 获取 dataservice
- * @param {*} thirdPartDBName 第三方db name
- * @returns dataService
- */
-export const getDataService = async (thirdPartDBName) => {
-    if (thirdPartDBName) {
-        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
-        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
-            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
-                const { length, ...rest } = cur
-                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
-                return acc
-            }, {})
-            const entity = new EntitySchema({
-                name: cur.tableName,
-                columns
-            })
-            acc.entities.push(entity)
-            acc.entityMap[cur.tableName] = entity
-            return acc
-        }, { entities: [], entityMap: {} })
-        const ormConfig = {
-            name: uuid(),
-            type: 'mysql',
-            host: thirdPartDB.host,
-            port: thirdPartDB.port,
-            username: thirdPartDB.username,
-            password: thirdPartDB.password,
-            database: thirdPartDB.dbName,
-            entities,
-            subscribers: [PreviewSubscriber],
-            synchronize: false,
-            migrationsRun: false,
-            extra: {
-                connectionLimit: 5
-            }
-        }
-        const con = await createConnection(ormConfig)
-        const thirdPartDataService = {
-            ...getThirdPartDataService(ormConfig.name, entityMap),
-            close () {
-                return new Promise((resolve, reject) => {
-                    if (con.isConnected) {
-                        con.close().then(resolve, reject)
-                    } else {
-                        resolve()
-                    }
-                })
-            }
-        }
-        return thirdPartDataService
-    }
-
-    return dataService
-}
-
-/**
- * 获取有权限的数据
- * @param {*} queryData 查询条件
- * @param {*} tableFileName 表文件名
- * @param {*} timezoneOffset 时区偏移
- * @returns 表数据
- */
-export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
-    const {
-        page,
-        pageSize,
-        bkSortKey,
-        bkSortValue,
-        bkDataSourceType,
-        ...others
-    } = queryData
-    const order = bkSortKey
-        ? {
-            [bkSortKey]: bkSortValue
-        }
-        : {
-            id: 'DESC'
-        }
-    const query = Object
-        .keys(others)
-        .reduce((acc, cur) => {
-            acc[cur] = Like(`%${others[cur]}%`)
-            return acc
-        }, {})
-    const dataService = await getDataService(thirdPartDBName)
-    const result = await dataService.get({
-        tableFileName,
-        page,
-        pageSize,
-        order,
-        query
-    })
-    const { columns } = dataService.getTableMetadata(tableFileName)
-    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
-    return result
-}
+import {
+    validateData
+} from '../../shared/form/validate'
+import {
+    formMap
+} from '../../shared/form/index'
+import {
+    isEmpty
+} from '../../shared/util'
+import {
+    NO_LENGTH_ORM_KEY
+} from '../../shared/data-source/constant'
+import {
+    splitSql,
+    uuid
+} from '../util'
+import dataService, {
+    Like,
+    getDataService as getThirdPartDataService
+} from './data-service'
+import dayjs from 'dayjs'
+import DayJSUtcPlugin from 'dayjs/plugin/utc'
+import thirdPartDBConfs from '../conf/third-part-db'
+import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
+import { RequestContext } from '../middleware/request-context'
+import { decode } from 'js-base64'
+
+dayjs.extend(DayJSUtcPlugin)
+
+// 数据源入库校验
+export const validate = async (formId, data) => {
+    // 如果有 formId，执行 nocode 校验
+    if (formId) {
+        const formData = formMap[formId]
+        if (!formData) {
+            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
+        }
+        const validateResult = await validateData(
+            formData.content,
+            data,
+            formData,
+            dataService
+        )
+        if (!validateResult.result) {
+            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
+        }
+    }
+}
+
+// 数据在入库前进行转换
+export const transferData = (formId, data) => {
+    let result = data
+    // 如果有 formId，执行 nocode 转换
+    if (formId) {
+        result = {}
+        data.forEach(({ key, value }) => {
+            result[key] = value
+        })
+    }
+
+    return result
+}
+
+// 根据时区转换时间
+export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
+    if (isEmpty(data)) {
+        return data
+    }
+    const transferList = Array.isArray(data) ? data : [data]
+    columns.forEach((column) => {
+        if (column.type === 'datetime') {
+            transferList.forEach((transferItem) => {
+                if (transferItem[column.propertyName] && timezoneOffset) {
+                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
+                        .utcOffset(-timezoneOffset)
+                        .format('YYYY-MM-DD HH:mm:ss')
+                }
+            })
+        }
+    })
+    return Array.isArray(data) ? transferList : transferList[0]
+}
+
+// 只能是查询语句检查 - 增强版本
+export const querySqlCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    
+    if (!/;$/.test(trimmedSql)) {
+        throw new Error('Sql 语句不完整，需要是【;】号结尾')
+    }
+
+    // 基础检查列表（保持原有逻辑）
+    const checkList = [
+        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
+        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
+        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
+        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
+        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
+        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
+        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
+        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
+    ]
+
+    // 增强的安全检查列表
+    const enhancedCheckList = [
+        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
+        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
+        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
+        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
+        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
+        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
+        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
+        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
+        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
+        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
+        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
+        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
+        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
+        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
+        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
+        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
+        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
+        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
+        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
+        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
+        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
+        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
+        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
+        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
+    ]
+
+    const sqlArr = splitSql(sql)
+    sqlArr.forEach((sqlStr) => {
+        const lowerCaseSql = sqlStr.trim().toLowerCase()
+        if (lowerCaseSql) {
+            // 执行原有检查
+            checkList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+
+            // 执行增强检查
+            enhancedCheckList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+        }
+    })
+}
+
+// sql 解码
+export const decodeSql = (sql, params) => {
+    try {
+        let decodedSql = decode(sql)
+
+        if (!decodedSql || typeof decodedSql !== 'string') {
+            throw new Error('无效的SQL语句')
+        }
+        
+        const paramKeys = Object.keys(params || {})
+        if (paramKeys.length > 0) {
+            paramKeys.forEach((paramKey) => {
+                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
+                decodedSql = decodedSql.replace(reg, params[paramKey])
+            })
+        }
+        return decodedSql
+    } catch (error) {
+        throw new Error(`SQL解码失败: ${error.message}`)
+    }
+}
+
+@EventSubscriber()
+class PreviewSubscriber {
+    beforeInsert ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.createUser = currentUser.username || entity.createUser
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.createTime = new Date()
+        entity.updateTime = new Date()
+    }
+
+    beforeUpdate ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.updateTime = new Date()
+    }
+}
+
+/**
+ * 获取 dataservice
+ * @param {*} thirdPartDBName 第三方db name
+ * @returns dataService
+ */
+export const getDataService = async (thirdPartDBName) => {
+    if (thirdPartDBName) {
+        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
+        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
+            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
+                const { length, ...rest } = cur
+                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
+                return acc
+            }, {})
+            const entity = new EntitySchema({
+                name: cur.tableName,
+                columns
+            })
+            acc.entities.push(entity)
+            acc.entityMap[cur.tableName] = entity
+            return acc
+        }, { entities: [], entityMap: {} })
+        const ormConfig = {
+            name: uuid(),
+            type: 'mysql',
+            host: thirdPartDB.host,
+            port: thirdPartDB.port,
+            username: thirdPartDB.username,
+            password: thirdPartDB.password,
+            database: thirdPartDB.dbName,
+            entities,
+            subscribers: [PreviewSubscriber],
+            synchronize: false,
+            migrationsRun: false,
+            extra: {
+                connectionLimit: 5
+            }
+        }
+        const con = await createConnection(ormConfig)
+        const thirdPartDataService = {
+            ...getThirdPartDataService(ormConfig.name, entityMap),
+            close () {
+                return new Promise((resolve, reject) => {
+                    if (con.isConnected) {
+                        con.close().then(resolve, reject)
+                    } else {
+                        resolve()
+                    }
+                })
+            }
+        }
+        return thirdPartDataService
+    }
+
+    return dataService
+}
+
+/**
+ * 获取有权限的数据
+ * @param {*} queryData 查询条件
+ * @param {*} tableFileName 表文件名
+ * @param {*} timezoneOffset 时区偏移
+ * @returns 表数据
+ */
+export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
+    const {
+        page,
+        pageSize,
+        bkSortKey,
+        bkSortValue,
+        bkDataSourceType,
+        ...others
+    } = queryData
+    const order = bkSortKey
+        ? {
+            [bkSortKey]: bkSortValue
+        }
+        : {
+            id: 'DESC'
+        }
+    const query = Object
+        .keys(others)
+        .reduce((acc, cur) => {
+            acc[cur] = Like(`%${others[cur]}%`)
+            return acc
+        }, {})
+    const dataService = await getDataService(thirdPartDBName)
+    const result = await dataService.get({
+        tableFileName,
+        page,
+        pageSize,
+        order,
+        query
+    })
+    const { columns } = dataService.getTableMetadata(tableFileName)
+    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
+    return result
+}
diff --git a/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js b/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
index 973e4d02f..400f878cc 100644
--- a/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
+++ b/lib/server/project-template/vue2/project-init-code/lib/server/service/open-api.js
@@ -1,107 +1,107 @@
-import bkToken from '../conf/token'
-import {
-    decodeToken
-} from '@bkui/apigateway-nodejs-sdk'
-
-/**
- * 增强的SQL安全检查函数
- * @param {string} sql SQL语句
- * @throws {Error} 如果检测到危险模式
- */
-export const enhancedSqlSecurityCheck = (sql) => {
-    if (!sql || typeof sql !== 'string') {
-        throw new Error('SQL语句不能为空')
-    }
-
-    const trimmedSql = sql.trim()
-    const upperCaseSql = trimmedSql.toUpperCase()
-
-    // 基本检查：必须以SELECT开头
-    if (!upperCaseSql.startsWith('SELECT')) {
-        throw new Error('仅支持SELECT查询语句')
-    }
-
-    // 危险关键词检查（更全面）
-    const dangerousKeywords = [
-        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
-        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
-        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
-        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
-    ]
-    
-    for (const keyword of dangerousKeywords) {
-        if (upperCaseSql.includes(keyword)) {
-            throw new Error(`检测到危险关键词: ${keyword}`)
-        }
-    }
-
-    // 危险模式检查
-    const dangerousPatterns = [
-        /UNION\s+SELECT/i, // UNION注入
-        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
-        /XP_CMDSHELL/i, // SQL Server命令执行
-        /SP_EXECUTESQL/i, // SQL Server动态SQL
-        /EXEC\s*\(/i, // 执行函数
-        /EXECUTE\s*\(/i, // 执行函数
-        /INFORMATION_SCHEMA/i, // 信息模式
-        /PERFORMANCE_SCHEMA/i, // 性能模式
-        /MYSQL\./i, // MySQL系统表
-        /\@\@/, // 系统变量
-        /DATABASE\(\)/i, // 数据库函数
-        /USER\(\)/i, // 用户函数
-        /VERSION\(\)/i, // 版本函数
-        /BENCHMARK\s*\(/i, // 基准测试函数
-        /SLEEP\s*\(/i, // 延时函数
-        /WAITFOR\s+DELAY/i, // SQL Server延时
-        /PG_SLEEP\s*\(/i, // PostgreSQL延时
-        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
-        /INTO\s+OUTFILE/i, // 文件写入
-        /INTO\s+DUMPFILE/i, // 文件转储
-        /LOAD_FILE\s*\(/i, // 文件读取
-        /CHAR\s*\(/i, // 字符编码绕过
-        /ASCII\s*\(/i, // ASCII编码绕过
-        /HEX\s*\(/i, // 十六进制编码绕过
-        /UNHEX\s*\(/i, // 反十六进制编码
-        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
-        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
-        /MID\s*\(/i, // 中间字符串
-        /LEFT\s*\(/i, // 左侧字符串
-        /RIGHT\s*\(/i, // 右侧字符串
-        /IF\s*\(/i, // 条件函数（可能用于盲注）
-        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
-        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
-        /UPDATEXML\s*\(/i, // XML更新函数
-        /NAME_CONST\s*\(/i, // 名称常量函数
-        /MULTIPOINT\s*\(/i, // 几何函数
-        /POLYGON\s*\(/i, // 多边形函数
-        /MULTIPOLYGON\s*\(/i, // 多多边形函数
-        /LINESTRING\s*\(/i, // 线字符串函数
-        /MULTILINESTRING\s*\(/i // 多线字符串函数
-    ]
-
-    for (const pattern of dangerousPatterns) {
-        if (pattern.test(sql)) {
-            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
-        }
-    }
-}
-
-export const getUserFromApiGW = async (jwt) => {
-    const { user } = await decodeToken(jwt, bkToken)
-    if (!user) {
-        throw new Error('未解析到用户名，请修改后再试')
-    }
-    return user
-}
-
-export const getAuthQuerySubfix = (cookies) => {
-    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
-}
-
-export const getAuthPostParams = (cookies) => {
-    return {
-        bk_app_code: bkToken?.bk_app_code,
-        bk_app_secret: bkToken?.bk_app_secret,
-        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
-    }
-}
+import bkToken from '../conf/token'
+import {
+    decodeToken
+} from '@bkui/apigateway-nodejs-sdk'
+
+/**
+ * 增强的SQL安全检查函数
+ * @param {string} sql SQL语句
+ * @throws {Error} 如果检测到危险模式
+ */
+export const enhancedSqlSecurityCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    const upperCaseSql = trimmedSql.toUpperCase()
+
+    // 基本检查：必须以SELECT开头
+    if (!upperCaseSql.startsWith('SELECT')) {
+        throw new Error('仅支持SELECT查询语句')
+    }
+
+    // 危险关键词检查（更全面）
+    const dangerousKeywords = [
+        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
+        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
+        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
+        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
+    ]
+    
+    for (const keyword of dangerousKeywords) {
+        if (upperCaseSql.includes(keyword)) {
+            throw new Error(`检测到危险关键词: ${keyword}`)
+        }
+    }
+
+    // 危险模式检查
+    const dangerousPatterns = [
+        /UNION\s+SELECT/i, // UNION注入
+        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
+        /XP_CMDSHELL/i, // SQL Server命令执行
+        /SP_EXECUTESQL/i, // SQL Server动态SQL
+        /EXEC\s*\(/i, // 执行函数
+        /EXECUTE\s*\(/i, // 执行函数
+        /INFORMATION_SCHEMA/i, // 信息模式
+        /PERFORMANCE_SCHEMA/i, // 性能模式
+        /MYSQL\./i, // MySQL系统表
+        /\@\@/, // 系统变量
+        /DATABASE\(\)/i, // 数据库函数
+        /USER\(\)/i, // 用户函数
+        /VERSION\(\)/i, // 版本函数
+        /BENCHMARK\s*\(/i, // 基准测试函数
+        /SLEEP\s*\(/i, // 延时函数
+        /WAITFOR\s+DELAY/i, // SQL Server延时
+        /PG_SLEEP\s*\(/i, // PostgreSQL延时
+        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
+        /INTO\s+OUTFILE/i, // 文件写入
+        /INTO\s+DUMPFILE/i, // 文件转储
+        /LOAD_FILE\s*\(/i, // 文件读取
+        /CHAR\s*\(/i, // 字符编码绕过
+        /ASCII\s*\(/i, // ASCII编码绕过
+        /HEX\s*\(/i, // 十六进制编码绕过
+        /UNHEX\s*\(/i, // 反十六进制编码
+        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
+        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
+        /MID\s*\(/i, // 中间字符串
+        /LEFT\s*\(/i, // 左侧字符串
+        /RIGHT\s*\(/i, // 右侧字符串
+        /IF\s*\(/i, // 条件函数（可能用于盲注）
+        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
+        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
+        /UPDATEXML\s*\(/i, // XML更新函数
+        /NAME_CONST\s*\(/i, // 名称常量函数
+        /MULTIPOINT\s*\(/i, // 几何函数
+        /POLYGON\s*\(/i, // 多边形函数
+        /MULTIPOLYGON\s*\(/i, // 多多边形函数
+        /LINESTRING\s*\(/i, // 线字符串函数
+        /MULTILINESTRING\s*\(/i // 多线字符串函数
+    ]
+
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(sql)) {
+            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
+        }
+    }
+}
+
+export const getUserFromApiGW = async (jwt) => {
+    const { user } = await decodeToken(jwt, bkToken)
+    if (!user) {
+        throw new Error('未解析到用户名，请修改后再试')
+    }
+    return user
+}
+
+export const getAuthQuerySubfix = (cookies) => {
+    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
+}
+
+export const getAuthPostParams = (cookies) => {
+    return {
+        bk_app_code: bkToken?.bk_app_code,
+        bk_app_secret: bkToken?.bk_app_secret,
+        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
+    }
+}
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js b/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
index ae0049a47..0f6b25aaa 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/service/data-source.js
@@ -1,293 +1,293 @@
-import {
-    validateData
-} from '../../shared/form/validate'
-import {
-    formMap
-} from '../../shared/form/index'
-import {
-    isEmpty
-} from '../../shared/util'
-import {
-    NO_LENGTH_ORM_KEY
-} from '../../shared/data-source/constant'
-import {
-    splitSql,
-    uuid
-} from '../util'
-import dataService, {
-    Like,
-    getDataService as getThirdPartDataService
-} from './data-service'
-import dayjs from 'dayjs'
-import DayJSUtcPlugin from 'dayjs/plugin/utc'
-import thirdPartDBConfs from '../conf/third-part-db'
-import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
-import { RequestContext } from '../middleware/request-context'
-import { decode } from 'js-base64'
-
-dayjs.extend(DayJSUtcPlugin)
-
-// 数据源入库校验
-export const validate = async (formId, data) => {
-    // 如果有 formId，执行 nocode 校验
-    if (formId) {
-        const formData = formMap[formId]
-        if (!formData) {
-            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
-        }
-        const validateResult = await validateData(
-            formData.content,
-            data,
-            formData,
-            dataService
-        )
-        if (!validateResult.result) {
-            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
-        }
-    }
-}
-
-// 数据在入库前进行转换
-export const transferData = (formId, data) => {
-    let result = data
-    // 如果有 formId，执行 nocode 转换
-    if (formId) {
-        result = {}
-        data.forEach(({ key, value }) => {
-            result[key] = value
-        })
-    }
-
-    return result
-}
-
-// 根据时区转换时间
-export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
-    if (isEmpty(data)) {
-        return data
-    }
-    const transferList = Array.isArray(data) ? data : [data]
-    columns.forEach((column) => {
-        if (column.type === 'datetime') {
-            transferList.forEach((transferItem) => {
-                if (transferItem[column.propertyName] && timezoneOffset) {
-                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
-                        .utcOffset(-timezoneOffset)
-                        .format('YYYY-MM-DD HH:mm:ss')
-                }
-            })
-        }
-    })
-    return Array.isArray(data) ? transferList : transferList[0]
-}
-
-// 只能是查询语句检查 - 增强版本
-export const querySqlCheck = (sql) => {
-    if (!sql || typeof sql !== 'string') {
-        throw new Error('SQL语句不能为空')
-    }
-
-    const trimmedSql = sql.trim()
-    
-    if (!/;$/.test(trimmedSql)) {
-        throw new Error('Sql 语句不完整，需要是【;】号结尾')
-    }
-
-    // 基础检查列表（保持原有逻辑）
-    const checkList = [
-        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
-        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
-        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
-        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
-        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
-        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
-        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
-        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
-    ]
-
-    // 增强的安全检查列表
-    const enhancedCheckList = [
-        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
-        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
-        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
-        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
-        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
-        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
-        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
-        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
-        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
-        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
-        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
-        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
-        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
-        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
-        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
-        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
-        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
-        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
-        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
-        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
-        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
-        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
-        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
-        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
-    ]
-
-    const sqlArr = splitSql(sql)
-    sqlArr.forEach((sqlStr) => {
-        const lowerCaseSql = sqlStr.trim().toLowerCase()
-        if (lowerCaseSql) {
-            // 执行原有检查
-            checkList.forEach((checkItem) => {
-                if (checkItem.check(lowerCaseSql)) {
-                    throw new Error(checkItem.message)
-                }
-            })
-
-            // 执行增强检查
-            enhancedCheckList.forEach((checkItem) => {
-                if (checkItem.check(lowerCaseSql)) {
-                    throw new Error(checkItem.message)
-                }
-            })
-        }
-    })
-}
-
-// sql 解码
-export const decodeSql = (sql, params) => {
-    try {
-        let decodedSql = decode(sql)
-
-        if (!decodedSql || typeof decodedSql !== 'string') {
-            throw new Error('无效的SQL语句')
-        }
-        
-        const paramKeys = Object.keys(params || {})
-        if (paramKeys.length > 0) {
-            paramKeys.forEach((paramKey) => {
-                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
-                decodedSql = decodedSql.replace(reg, params[paramKey])
-            })
-        }
-        return decodedSql
-    } catch (error) {
-        throw new Error(`SQL解码失败: ${error.message}`)
-    }
-}
-
-@EventSubscriber()
-class PreviewSubscriber {
-    beforeInsert ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.createUser = currentUser.username || entity.createUser
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.createTime = new Date()
-        entity.updateTime = new Date()
-    }
-
-    beforeUpdate ({ entity }) {
-        const currentUser = RequestContext.getCurrentUser() || {}
-        entity.updateUser = currentUser.username || entity.updateUser
-        entity.updateTime = new Date()
-    }
-}
-
-/**
- * 获取 dataservice
- * @param {*} thirdPartDBName 第三方db name
- * @returns dataService
- */
-export const getDataService = async (thirdPartDBName) => {
-    if (thirdPartDBName) {
-        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
-        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
-            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
-                const { length, ...rest } = cur
-                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
-                return acc
-            }, {})
-            const entity = new EntitySchema({
-                name: cur.tableName,
-                columns
-            })
-            acc.entities.push(entity)
-            acc.entityMap[cur.tableName] = entity
-            return acc
-        }, { entities: [], entityMap: {} })
-        const ormConfig = {
-            name: uuid(),
-            type: 'mysql',
-            host: thirdPartDB.host,
-            port: thirdPartDB.port,
-            username: thirdPartDB.username,
-            password: thirdPartDB.password,
-            database: thirdPartDB.dbName,
-            entities,
-            subscribers: [PreviewSubscriber],
-            synchronize: false,
-            migrationsRun: false,
-            extra: {
-                connectionLimit: 5
-            }
-        }
-        const con = await createConnection(ormConfig)
-        const thirdPartDataService = {
-            ...getThirdPartDataService(ormConfig.name, entityMap),
-            close () {
-                return new Promise((resolve, reject) => {
-                    if (con.isConnected) {
-                        con.close().then(resolve, reject)
-                    } else {
-                        resolve()
-                    }
-                })
-            }
-        }
-        return thirdPartDataService
-    }
-
-    return dataService
-}
-
-/**
- * 获取有权限的数据
- * @param {*} queryData 查询条件
- * @param {*} tableFileName 表文件名
- * @param {*} timezoneOffset 时区偏移
- * @returns 表数据
- */
-export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
-    const {
-        page,
-        pageSize,
-        bkSortKey,
-        bkSortValue,
-        bkDataSourceType,
-        ...others
-    } = queryData
-    const order = bkSortKey
-        ? {
-            [bkSortKey]: bkSortValue
-        }
-        : {
-            id: 'DESC'
-        }
-    const query = Object
-        .keys(others)
-        .reduce((acc, cur) => {
-            acc[cur] = Like(`%${others[cur]}%`)
-            return acc
-        }, {})
-    const dataService = await getDataService(thirdPartDBName)
-    const result = await dataService.get({
-        tableFileName,
-        page,
-        pageSize,
-        order,
-        query
-    })
-    const { columns } = dataService.getTableMetadata(tableFileName)
-    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
-    return result
-}
+import {
+    validateData
+} from '../../shared/form/validate'
+import {
+    formMap
+} from '../../shared/form/index'
+import {
+    isEmpty
+} from '../../shared/util'
+import {
+    NO_LENGTH_ORM_KEY
+} from '../../shared/data-source/constant'
+import {
+    splitSql,
+    uuid
+} from '../util'
+import dataService, {
+    Like,
+    getDataService as getThirdPartDataService
+} from './data-service'
+import dayjs from 'dayjs'
+import DayJSUtcPlugin from 'dayjs/plugin/utc'
+import thirdPartDBConfs from '../conf/third-part-db'
+import { EntitySchema, createConnection, EventSubscriber } from 'typeorm'
+import { RequestContext } from '../middleware/request-context'
+import { decode } from 'js-base64'
+
+dayjs.extend(DayJSUtcPlugin)
+
+// 数据源入库校验
+export const validate = async (formId, data) => {
+    // 如果有 formId，执行 nocode 校验
+    if (formId) {
+        const formData = formMap[formId]
+        if (!formData) {
+            throw new global.BusinessError(`暂未查询到【ID: ${formId}】的 Form 数据，请修改后再试`, 404, 404)
+        }
+        const validateResult = await validateData(
+            formData.content,
+            data,
+            formData,
+            dataService
+        )
+        if (!validateResult.result) {
+            throw new global.BusinessError(`数据入库校验失败：【${validateResult.errorMsg}】，请修改后再试`, 400, 400)
+        }
+    }
+}
+
+// 数据在入库前进行转换
+export const transferData = (formId, data) => {
+    let result = data
+    // 如果有 formId，执行 nocode 转换
+    if (formId) {
+        result = {}
+        data.forEach(({ key, value }) => {
+            result[key] = value
+        })
+    }
+
+    return result
+}
+
+// 根据时区转换时间
+export const transferTimeByTimezoneOffset = (columns, data, timezoneOffset) => {
+    if (isEmpty(data)) {
+        return data
+    }
+    const transferList = Array.isArray(data) ? data : [data]
+    columns.forEach((column) => {
+        if (column.type === 'datetime') {
+            transferList.forEach((transferItem) => {
+                if (transferItem[column.propertyName] && timezoneOffset) {
+                    transferItem[column.propertyName] = dayjs(transferItem[column.propertyName])
+                        .utcOffset(-timezoneOffset)
+                        .format('YYYY-MM-DD HH:mm:ss')
+                }
+            })
+        }
+    })
+    return Array.isArray(data) ? transferList : transferList[0]
+}
+
+// 只能是查询语句检查 - 增强版本
+export const querySqlCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    
+    if (!/;$/.test(trimmedSql)) {
+        throw new Error('Sql 语句不完整，需要是【;】号结尾')
+    }
+
+    // 基础检查列表（保持原有逻辑）
+    const checkList = [
+        { check: (val) => !/^select/.test(val), message: '仅支持 SELECT 查询语句，请修改后再试' },
+        { check: (val) => /database\(\)/i.test(val), message: '不允许出现 database() 函数' },
+        { check: (val) => /user\(\)/i.test(val), message: '不允许出现 user() 函数' },
+        { check: (val) => /version\(\)/i.test(val), message: '不允许出现 version() 函数' },
+        { check: (val) => /INFORMATION_SCHEMA/i.test(val), message: '不允许查询 INFORMATION_SCHEMA 相关数据' },
+        { check: (val) => /PERFORMANCE_SCHEMA/i.test(val), message: '不允许查询 PERFORMANCE_SCHEMA 相关数据' },
+        { check: (val) => /MYSQL\./i.test(val), message: '不允许查询 MYSQL 内置表相关数据' },
+        { check: (val) => /\@\@/i.test(val), message: '不允许出现@@符号' }
+    ]
+
+    // 增强的安全检查列表
+    const enhancedCheckList = [
+        { check: (val) => /union\s+select/i.test(val), message: '不允许使用 UNION SELECT 语句' },
+        { check: (val) => /;\s*(drop|delete|update|insert|alter|create|grant|revoke)/i.test(val), message: '检测到多语句注入尝试' },
+        { check: (val) => /--/.test(val), message: '不允许使用 SQL 注释符号 --' },
+        { check: (val) => /\/\*/.test(val), message: '不允许使用多行注释 /*' },
+        { check: (val) => /\*\//.test(val), message: '不允许使用多行注释 */' },
+        { check: (val) => /xp_cmdshell/i.test(val), message: '不允许使用 xp_cmdshell 函数' },
+        { check: (val) => /sp_executesql/i.test(val), message: '不允许使用 sp_executesql 函数' },
+        { check: (val) => /exec\s*\(/i.test(val), message: '不允许使用 EXEC 函数' },
+        { check: (val) => /execute\s*\(/i.test(val), message: '不允许使用 EXECUTE 函数' },
+        { check: (val) => /load_file\s*\(/i.test(val), message: '不允许使用 LOAD_FILE 函数' },
+        { check: (val) => /into\s+outfile/i.test(val), message: '不允许使用 INTO OUTFILE 语句' },
+        { check: (val) => /into\s+dumpfile/i.test(val), message: '不允许使用 INTO DUMPFILE 语句' },
+        { check: (val) => /benchmark\s*\(/i.test(val), message: '不允许使用 BENCHMARK 函数' },
+        { check: (val) => /sleep\s*\(/i.test(val), message: '不允许使用 SLEEP 函数' },
+        { check: (val) => /waitfor\s+delay/i.test(val), message: '不允许使用 WAITFOR DELAY 语句' },
+        { check: (val) => /pg_sleep\s*\(/i.test(val), message: '不允许使用 PG_SLEEP 函数' },
+        { check: (val) => /extractvalue\s*\(/i.test(val), message: '不允许使用 EXTRACTVALUE 函数' },
+        { check: (val) => /updatexml\s*\(/i.test(val), message: '不允许使用 UPDATEXML 函数' },
+        { check: (val) => /name_const\s*\(/i.test(val), message: '不允许使用 NAME_CONST 函数' },
+        { check: (val) => /multipoint\s*\(/i.test(val), message: '不允许使用 MULTIPOINT 函数' },
+        { check: (val) => /polygon\s*\(/i.test(val), message: '不允许使用 POLYGON 函数' },
+        { check: (val) => /multipolygon\s*\(/i.test(val), message: '不允许使用 MULTIPOLYGON 函数' },
+        { check: (val) => /linestring\s*\(/i.test(val), message: '不允许使用 LINESTRING 函数' },
+        { check: (val) => /multilinestring\s*\(/i.test(val), message: '不允许使用 MULTILINESTRING 函数' }
+    ]
+
+    const sqlArr = splitSql(sql)
+    sqlArr.forEach((sqlStr) => {
+        const lowerCaseSql = sqlStr.trim().toLowerCase()
+        if (lowerCaseSql) {
+            // 执行原有检查
+            checkList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+
+            // 执行增强检查
+            enhancedCheckList.forEach((checkItem) => {
+                if (checkItem.check(lowerCaseSql)) {
+                    throw new Error(checkItem.message)
+                }
+            })
+        }
+    })
+}
+
+// sql 解码
+export const decodeSql = (sql, params) => {
+    try {
+        let decodedSql = decode(sql)
+
+        if (!decodedSql || typeof decodedSql !== 'string') {
+            throw new Error('无效的SQL语句')
+        }
+        
+        const paramKeys = Object.keys(params || {})
+        if (paramKeys.length > 0) {
+            paramKeys.forEach((paramKey) => {
+                const reg = new RegExp(`\\$\\{${paramKey}\\}`, 'g')
+                decodedSql = decodedSql.replace(reg, params[paramKey])
+            })
+        }
+        return decodedSql
+    } catch (error) {
+        throw new Error(`SQL解码失败: ${error.message}`)
+    }
+}
+
+@EventSubscriber()
+class PreviewSubscriber {
+    beforeInsert ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.createUser = currentUser.username || entity.createUser
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.createTime = new Date()
+        entity.updateTime = new Date()
+    }
+
+    beforeUpdate ({ entity }) {
+        const currentUser = RequestContext.getCurrentUser() || {}
+        entity.updateUser = currentUser.username || entity.updateUser
+        entity.updateTime = new Date()
+    }
+}
+
+/**
+ * 获取 dataservice
+ * @param {*} thirdPartDBName 第三方db name
+ * @returns dataService
+ */
+export const getDataService = async (thirdPartDBName) => {
+    if (thirdPartDBName) {
+        const thirdPartDB = thirdPartDBConfs[thirdPartDBName]
+        const { entities, entityMap } = thirdPartDB.tableList.reduce((acc, cur) => {
+            const columns = JSON.parse(cur.columns || '[]').reduce((acc, cur) => {
+                const { length, ...rest } = cur
+                acc[cur.name] = NO_LENGTH_ORM_KEY.includes(cur.type) ? rest : cur
+                return acc
+            }, {})
+            const entity = new EntitySchema({
+                name: cur.tableName,
+                columns
+            })
+            acc.entities.push(entity)
+            acc.entityMap[cur.tableName] = entity
+            return acc
+        }, { entities: [], entityMap: {} })
+        const ormConfig = {
+            name: uuid(),
+            type: 'mysql',
+            host: thirdPartDB.host,
+            port: thirdPartDB.port,
+            username: thirdPartDB.username,
+            password: thirdPartDB.password,
+            database: thirdPartDB.dbName,
+            entities,
+            subscribers: [PreviewSubscriber],
+            synchronize: false,
+            migrationsRun: false,
+            extra: {
+                connectionLimit: 5
+            }
+        }
+        const con = await createConnection(ormConfig)
+        const thirdPartDataService = {
+            ...getThirdPartDataService(ormConfig.name, entityMap),
+            close () {
+                return new Promise((resolve, reject) => {
+                    if (con.isConnected) {
+                        con.close().then(resolve, reject)
+                    } else {
+                        resolve()
+                    }
+                })
+            }
+        }
+        return thirdPartDataService
+    }
+
+    return dataService
+}
+
+/**
+ * 获取有权限的数据
+ * @param {*} queryData 查询条件
+ * @param {*} tableFileName 表文件名
+ * @param {*} timezoneOffset 时区偏移
+ * @returns 表数据
+ */
+export const getTableDatas = async (queryData, tableFileName, timezoneOffset, thirdPartDBName) => {
+    const {
+        page,
+        pageSize,
+        bkSortKey,
+        bkSortValue,
+        bkDataSourceType,
+        ...others
+    } = queryData
+    const order = bkSortKey
+        ? {
+            [bkSortKey]: bkSortValue
+        }
+        : {
+            id: 'DESC'
+        }
+    const query = Object
+        .keys(others)
+        .reduce((acc, cur) => {
+            acc[cur] = Like(`%${others[cur]}%`)
+            return acc
+        }, {})
+    const dataService = await getDataService(thirdPartDBName)
+    const result = await dataService.get({
+        tableFileName,
+        page,
+        pageSize,
+        order,
+        query
+    })
+    const { columns } = dataService.getTableMetadata(tableFileName)
+    result.list = transferTimeByTimezoneOffset(columns, result.list, timezoneOffset)
+    return result
+}
diff --git a/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js b/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
index 973e4d02f..400f878cc 100644
--- a/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
+++ b/lib/server/project-template/vue3/project-init-code/lib/server/service/open-api.js
@@ -1,107 +1,107 @@
-import bkToken from '../conf/token'
-import {
-    decodeToken
-} from '@bkui/apigateway-nodejs-sdk'
-
-/**
- * 增强的SQL安全检查函数
- * @param {string} sql SQL语句
- * @throws {Error} 如果检测到危险模式
- */
-export const enhancedSqlSecurityCheck = (sql) => {
-    if (!sql || typeof sql !== 'string') {
-        throw new Error('SQL语句不能为空')
-    }
-
-    const trimmedSql = sql.trim()
-    const upperCaseSql = trimmedSql.toUpperCase()
-
-    // 基本检查：必须以SELECT开头
-    if (!upperCaseSql.startsWith('SELECT')) {
-        throw new Error('仅支持SELECT查询语句')
-    }
-
-    // 危险关键词检查（更全面）
-    const dangerousKeywords = [
-        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
-        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
-        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
-        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
-    ]
-    
-    for (const keyword of dangerousKeywords) {
-        if (upperCaseSql.includes(keyword)) {
-            throw new Error(`检测到危险关键词: ${keyword}`)
-        }
-    }
-
-    // 危险模式检查
-    const dangerousPatterns = [
-        /UNION\s+SELECT/i, // UNION注入
-        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
-        /XP_CMDSHELL/i, // SQL Server命令执行
-        /SP_EXECUTESQL/i, // SQL Server动态SQL
-        /EXEC\s*\(/i, // 执行函数
-        /EXECUTE\s*\(/i, // 执行函数
-        /INFORMATION_SCHEMA/i, // 信息模式
-        /PERFORMANCE_SCHEMA/i, // 性能模式
-        /MYSQL\./i, // MySQL系统表
-        /\@\@/, // 系统变量
-        /DATABASE\(\)/i, // 数据库函数
-        /USER\(\)/i, // 用户函数
-        /VERSION\(\)/i, // 版本函数
-        /BENCHMARK\s*\(/i, // 基准测试函数
-        /SLEEP\s*\(/i, // 延时函数
-        /WAITFOR\s+DELAY/i, // SQL Server延时
-        /PG_SLEEP\s*\(/i, // PostgreSQL延时
-        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
-        /INTO\s+OUTFILE/i, // 文件写入
-        /INTO\s+DUMPFILE/i, // 文件转储
-        /LOAD_FILE\s*\(/i, // 文件读取
-        /CHAR\s*\(/i, // 字符编码绕过
-        /ASCII\s*\(/i, // ASCII编码绕过
-        /HEX\s*\(/i, // 十六进制编码绕过
-        /UNHEX\s*\(/i, // 反十六进制编码
-        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
-        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
-        /MID\s*\(/i, // 中间字符串
-        /LEFT\s*\(/i, // 左侧字符串
-        /RIGHT\s*\(/i, // 右侧字符串
-        /IF\s*\(/i, // 条件函数（可能用于盲注）
-        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
-        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
-        /UPDATEXML\s*\(/i, // XML更新函数
-        /NAME_CONST\s*\(/i, // 名称常量函数
-        /MULTIPOINT\s*\(/i, // 几何函数
-        /POLYGON\s*\(/i, // 多边形函数
-        /MULTIPOLYGON\s*\(/i, // 多多边形函数
-        /LINESTRING\s*\(/i, // 线字符串函数
-        /MULTILINESTRING\s*\(/i // 多线字符串函数
-    ]
-
-    for (const pattern of dangerousPatterns) {
-        if (pattern.test(sql)) {
-            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
-        }
-    }
-}
-
-export const getUserFromApiGW = async (jwt) => {
-    const { user } = await decodeToken(jwt, bkToken)
-    if (!user) {
-        throw new Error('未解析到用户名，请修改后再试')
-    }
-    return user
-}
-
-export const getAuthQuerySubfix = (cookies) => {
-    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
-}
-
-export const getAuthPostParams = (cookies) => {
-    return {
-        bk_app_code: bkToken?.bk_app_code,
-        bk_app_secret: bkToken?.bk_app_secret,
-        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
-    }
-}
+import bkToken from '../conf/token'
+import {
+    decodeToken
+} from '@bkui/apigateway-nodejs-sdk'
+
+/**
+ * 增强的SQL安全检查函数
+ * @param {string} sql SQL语句
+ * @throws {Error} 如果检测到危险模式
+ */
+export const enhancedSqlSecurityCheck = (sql) => {
+    if (!sql || typeof sql !== 'string') {
+        throw new Error('SQL语句不能为空')
+    }
+
+    const trimmedSql = sql.trim()
+    const upperCaseSql = trimmedSql.toUpperCase()
+
+    // 基本检查：必须以SELECT开头
+    if (!upperCaseSql.startsWith('SELECT')) {
+        throw new Error('仅支持SELECT查询语句')
+    }
+
+    // 危险关键词检查（更全面）
+    const dangerousKeywords = [
+        'DROP DATABASE', 'TRUNCATE TABLE', 'DROP TABLE', 'CREATE TABLE',
+        'DELETE FROM', 'ALTER TABLE', 'INSERT INTO', 'UPDATE SET',
+        'GRANT', 'REVOKE', 'CREATE USER', 'DROP USER', 'SET PASSWORD',
+        'LOAD DATA', 'OUTFILE', 'DUMPFILE', 'LOAD_FILE'
+    ]
+    
+    for (const keyword of dangerousKeywords) {
+        if (upperCaseSql.includes(keyword)) {
+            throw new Error(`检测到危险关键词: ${keyword}`)
+        }
+    }
+
+    // 危险模式检查
+    const dangerousPatterns = [
+        /UNION\s+SELECT/i, // UNION注入
+        /;\s*(DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|GRANT|REVOKE)/i, // 多语句注入
+        /XP_CMDSHELL/i, // SQL Server命令执行
+        /SP_EXECUTESQL/i, // SQL Server动态SQL
+        /EXEC\s*\(/i, // 执行函数
+        /EXECUTE\s*\(/i, // 执行函数
+        /INFORMATION_SCHEMA/i, // 信息模式
+        /PERFORMANCE_SCHEMA/i, // 性能模式
+        /MYSQL\./i, // MySQL系统表
+        /\@\@/, // 系统变量
+        /DATABASE\(\)/i, // 数据库函数
+        /USER\(\)/i, // 用户函数
+        /VERSION\(\)/i, // 版本函数
+        /BENCHMARK\s*\(/i, // 基准测试函数
+        /SLEEP\s*\(/i, // 延时函数
+        /WAITFOR\s+DELAY/i, // SQL Server延时
+        /PG_SLEEP\s*\(/i, // PostgreSQL延时
+        /DBMS_PIPE\.RECEIVE_MESSAGE/i, // Oracle延时
+        /INTO\s+OUTFILE/i, // 文件写入
+        /INTO\s+DUMPFILE/i, // 文件转储
+        /LOAD_FILE\s*\(/i, // 文件读取
+        /CHAR\s*\(/i, // 字符编码绕过
+        /ASCII\s*\(/i, // ASCII编码绕过
+        /HEX\s*\(/i, // 十六进制编码绕过
+        /UNHEX\s*\(/i, // 反十六进制编码
+        /CONCAT\s*\(/i, // 字符串拼接（可能用于绕过）
+        /SUBSTRING\s*\(/i, // 子字符串（可能用于盲注）
+        /MID\s*\(/i, // 中间字符串
+        /LEFT\s*\(/i, // 左侧字符串
+        /RIGHT\s*\(/i, // 右侧字符串
+        /IF\s*\(/i, // 条件函数（可能用于盲注）
+        /CASE\s+WHEN/i, // CASE语句（可能用于盲注）
+        /EXTRACTVALUE\s*\(/i, // XML函数（可能用于报错注入）
+        /UPDATEXML\s*\(/i, // XML更新函数
+        /NAME_CONST\s*\(/i, // 名称常量函数
+        /MULTIPOINT\s*\(/i, // 几何函数
+        /POLYGON\s*\(/i, // 多边形函数
+        /MULTIPOLYGON\s*\(/i, // 多多边形函数
+        /LINESTRING\s*\(/i, // 线字符串函数
+        /MULTILINESTRING\s*\(/i // 多线字符串函数
+    ]
+
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(sql)) {
+            throw new Error(`检测到危险的SQL模式: ${pattern.source}`)
+        }
+    }
+}
+
+export const getUserFromApiGW = async (jwt) => {
+    const { user } = await decodeToken(jwt, bkToken)
+    if (!user) {
+        throw new Error('未解析到用户名，请修改后再试')
+    }
+    return user
+}
+
+export const getAuthQuerySubfix = (cookies) => {
+    return `bk_app_code=${bkToken?.bk_app_code}&bk_app_secret=${encodeURI(bkToken?.bk_app_secret)}&${global.AUTH_NAME}=${cookies.get(global.AUTH_NAME)}`
+}
+
+export const getAuthPostParams = (cookies) => {
+    return {
+        bk_app_code: bkToken?.bk_app_code,
+        bk_app_secret: bkToken?.bk_app_secret,
+        [global.AUTH_NAME]: cookies.get(global.AUTH_NAME)
+    }
+}
diff --git a/lib/server/utils/file-service/index.js b/lib/server/utils/file-service/index.js
index b2cdbf400..3a05a54fe 100644
--- a/lib/server/utils/file-service/index.js
+++ b/lib/server/utils/file-service/index.js
@@ -1,221 +1,221 @@
-import { sanitizeUploadPath } from '../../../shared/security/file-protection'
-
-const fs = require('fs')
-const request = require('request')
-const path = require('path')
-
-// bk-repo.js配置文件不存在时赋值空对象
-let config
-try {
-    config = require('../../conf/bk-repo')
-} catch (_) {
-    config = {}
-}
-const headers = {
-    'Authorization': 'Basic ' + Buffer.from(config.BKREPO_USERNAME + ':' + config.BKREPO_PASSWORD).toString('base64')
-}
-
-const urlPrefix = `${config.BKREPO_ENDPOINT_URL}/generic/${config.BKREPO_PROJECT}`
-
-/**
- * 获取最终的接口调用地址
- * @param {string} path 接口路径
- * @param {boolean} isPublic 是否为公开
- * @returns {string} 最终的接口调用地址
- */
-const getUrl = (path, isPublic) => {
-    let prefix = urlPrefix
-    if (isPublic === undefined) {
-        prefix = `${prefix}/${config.BKREPO_BUCKET}`
-    } else {
-        prefix = `${prefix}/${isPublic ? config.BKREPO_PUBLIC_BUCKET : config.BKREPO_PRIVATE_BUCKET}`
-    }
-
-    let newPath = path
-    if (!newPath.startsWith('/')) {
-        newPath = '/' + newPath
-    }
-
-    return `${prefix}${newPath}`
-}
-
-const checkBkRepoSetting = (throwErr = true) => {
-    if (!config.BKREPO_USERNAME || !config.BKREPO_PROJECT || !config.BKREPO_ENDPOINT_URL) {
-        if (throwErr) {
-            throw new Error(global.i18n.t('bkRepo: 请先搭建bkRepo服务并确认配置信息已设置正确'))
-        } else {
-            return false
-        }
-    } else {
-        return true
-    }
-}
-
-const uploadFolder = async (folderPath, uploadKey) => {
-    checkBkRepoSetting()
-    const fileMap = []
-    const walkSync = (currentDirPath, prefixPath) => {
-        fs.readdirSync(currentDirPath).forEach(async (name) => {
-            const filePath = path.join(currentDirPath, name)
-            const stat = fs.statSync(filePath)
-            if (stat.isFile()) {
-                fileMap.push(uploadFile(filePath, `/${prefixPath}/`))
-            } else if (stat.isDirectory()) {
-                walkSync(filePath, `${prefixPath}/${name}`)
-            }
-        })
-    }
-    walkSync(folderPath, uploadKey)
-    return Promise.all(fileMap)
-}
-
-/*
-* @params
-* string targetFile: bkrepo上文件路径
-* string dest 下载文件的写入目录，为空则不会写到本地文件直接返回内容
-*/
-const downloadFile = (targetFile, dest) => {
-    checkBkRepoSetting()
-    const fse = require('fs-extra')
-
-    // 安全过滤 targetFile 路径
-    targetFile = sanitizeUploadPath(targetFile)
-    if (!targetFile) {
-        return Promise.reject(new Error(global.i18n.t('文件路径无效')))
-    }
-
-    if (dest) {
-        // 确保 dest 是规范化的绝对路径
-        dest = path.resolve(dest)
-        const destParent = path.dirname(dest)
-        fse.ensureDirSync(destParent)
-    }
-
-    const options = {
-        url: getUrl(targetFile),
-        headers: headers
-    }
-
-    return new Promise((resolve, reject) => {
-        request.get(options, function (err, res, body) {
-            if (err || res.statusCode !== 200) {
-                console.log(err, res.statusCode, body)
-                reject(new Error(`${global.i18n.t('文件下载失败')}: ${err || res.statusCode}`))
-            } else {
-                if (dest) {
-                    fse.outputFileSync(dest, body)
-                    resolve()
-                } else {
-                    resolve(body)
-                }
-            }
-        })
-    })
-}
-
-const getSignUrl = async (fullPathSet = [], expireSeconds = 0) => {
-    checkBkRepoSetting()
-    const data = {
-        projectId: config.BKREPO_PROJECT,
-        repoName: config.BKREPO_BUCKET,
-        type: 'DOWNLOAD',
-        expireSeconds,
-        fullPathSet
-    }
-    const url = `${config.BKREPO_ENDPOINT_URL}/generic/temporary/url/create`
-    return new Promise((resolve, reject) => {
-        request.post({ url, body: data, json: true, headers }, function (err, res, body) {
-            if (err || res.statusCode !== 200) {
-                reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
-            } else if (typeof body === 'object' && body.code !== 0) {
-                reject(new Error(`${global.i18n.t('获取下载链接失败')}:${body.message}`))
-            } else {
-                if (body.data[0]?.url) {
-                    resolve(body.data[0]?.url)
-                } else {
-                    reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
-                }
-            }
-        })
-    })
-}
-
-const uploadFile = async (filePath, uploadKey, settings = {}) => {
-    checkBkRepoSetting()
-    const key = path.basename(filePath)
-    const fileStream = fs.createReadStream(filePath)
-    fileStream.on('error', err => {
-        return Promise.reject(err)
-    })
-    const res = await uploadRepoFile(`${uploadKey}${key}`, fileStream, settings)
-    return res
-}
-
-const uploadImage = async (filePath, uploadKey, settings = {}) => {
-    checkBkRepoSetting()
-    const key = path.basename(filePath)
-
-    let uploadPath = `${uploadKey}${key}`
-    if (settings.ensurePath) {
-        uploadPath = uploadKey
-    }
-
-    let fileStream
-    if (settings.fileStream) {
-        fileStream = settings.fileStream
-    } else {
-        fileStream = fs.createReadStream(filePath)
-        fileStream.on('error', err => {
-            return Promise.reject(err)
-        })
-    }
-    
-    const res = await uploadRepoFile(uploadPath, fileStream, settings)
-    return res
-}
-
-/**
- * 上传文件至bkrepo
- * @param {string} uploadPath 文件存储路径
- * @param {ReadStream} fileStream 文件内容
- * @param {object} settings 配置选项
- * @param {boolean} settings.isPublic 是否公开
- * @param {boolean} settings.fullUrl 是否返回完整url
- * @returns {Promise} 文件存储路径
- */
-const uploadRepoFile = async (uploadPath, fileStream, settings = {}) => {
-    // 安全过滤上传路径
-    uploadPath = sanitizeUploadPath(uploadPath)
-    const url = getUrl(uploadPath, settings.isPublic)
-    const options = {
-        url,
-        method: 'PUT',
-        headers: Object.assign({}, headers, { 'X-BKREPO-OVERWRITE': false }),
-        body: fileStream
-    }
-    return new Promise((resolve, reject) => {
-        request(options, function (err, res, body) {
-            if (typeof body === 'string') {
-                body = JSON.parse(body)
-            }
-            if (err || res.statusCode !== 200) {
-                reject(new Error(`${global.i18n.t('上传至repo失败')}: ${err || res.statusCode}`))
-            } else if (typeof body === 'object' && body.code > 0) {
-                reject(new Error(`${global.i18n.t('上传至repo失败')}： ${body.message}`))
-            } else if (body.code === 0) {
-                resolve(settings.fullUrl ? url : uploadPath)
-            } else {
-                reject(new Error(global.i18n.t('上传至repo失败')))
-            }
-        })
-    })
-}
-
-module.exports = {
-    checkBkRepoSetting,
-    uploadFile,
-    getSignUrl,
-    uploadFolder,
-    downloadFile,
-    uploadImage
-}
+import { sanitizeUploadPath } from '../../../shared/security/file-protection'
+
+const fs = require('fs')
+const request = require('request')
+const path = require('path')
+
+// bk-repo.js配置文件不存在时赋值空对象
+let config
+try {
+    config = require('../../conf/bk-repo')
+} catch (_) {
+    config = {}
+}
+const headers = {
+    'Authorization': 'Basic ' + Buffer.from(config.BKREPO_USERNAME + ':' + config.BKREPO_PASSWORD).toString('base64')
+}
+
+const urlPrefix = `${config.BKREPO_ENDPOINT_URL}/generic/${config.BKREPO_PROJECT}`
+
+/**
+ * 获取最终的接口调用地址
+ * @param {string} path 接口路径
+ * @param {boolean} isPublic 是否为公开
+ * @returns {string} 最终的接口调用地址
+ */
+const getUrl = (path, isPublic) => {
+    let prefix = urlPrefix
+    if (isPublic === undefined) {
+        prefix = `${prefix}/${config.BKREPO_BUCKET}`
+    } else {
+        prefix = `${prefix}/${isPublic ? config.BKREPO_PUBLIC_BUCKET : config.BKREPO_PRIVATE_BUCKET}`
+    }
+
+    let newPath = path
+    if (!newPath.startsWith('/')) {
+        newPath = '/' + newPath
+    }
+
+    return `${prefix}${newPath}`
+}
+
+const checkBkRepoSetting = (throwErr = true) => {
+    if (!config.BKREPO_USERNAME || !config.BKREPO_PROJECT || !config.BKREPO_ENDPOINT_URL) {
+        if (throwErr) {
+            throw new Error(global.i18n.t('bkRepo: 请先搭建bkRepo服务并确认配置信息已设置正确'))
+        } else {
+            return false
+        }
+    } else {
+        return true
+    }
+}
+
+const uploadFolder = async (folderPath, uploadKey) => {
+    checkBkRepoSetting()
+    const fileMap = []
+    const walkSync = (currentDirPath, prefixPath) => {
+        fs.readdirSync(currentDirPath).forEach(async (name) => {
+            const filePath = path.join(currentDirPath, name)
+            const stat = fs.statSync(filePath)
+            if (stat.isFile()) {
+                fileMap.push(uploadFile(filePath, `/${prefixPath}/`))
+            } else if (stat.isDirectory()) {
+                walkSync(filePath, `${prefixPath}/${name}`)
+            }
+        })
+    }
+    walkSync(folderPath, uploadKey)
+    return Promise.all(fileMap)
+}
+
+/*
+* @params
+* string targetFile: bkrepo上文件路径
+* string dest 下载文件的写入目录，为空则不会写到本地文件直接返回内容
+*/
+const downloadFile = (targetFile, dest) => {
+    checkBkRepoSetting()
+    const fse = require('fs-extra')
+
+    // 安全过滤 targetFile 路径
+    targetFile = sanitizeUploadPath(targetFile)
+    if (!targetFile) {
+        return Promise.reject(new Error(global.i18n.t('文件路径无效')))
+    }
+
+    if (dest) {
+        // 确保 dest 是规范化的绝对路径
+        dest = path.resolve(dest)
+        const destParent = path.dirname(dest)
+        fse.ensureDirSync(destParent)
+    }
+
+    const options = {
+        url: getUrl(targetFile),
+        headers: headers
+    }
+
+    return new Promise((resolve, reject) => {
+        request.get(options, function (err, res, body) {
+            if (err || res.statusCode !== 200) {
+                console.log(err, res.statusCode, body)
+                reject(new Error(`${global.i18n.t('文件下载失败')}: ${err || res.statusCode}`))
+            } else {
+                if (dest) {
+                    fse.outputFileSync(dest, body)
+                    resolve()
+                } else {
+                    resolve(body)
+                }
+            }
+        })
+    })
+}
+
+const getSignUrl = async (fullPathSet = [], expireSeconds = 0) => {
+    checkBkRepoSetting()
+    const data = {
+        projectId: config.BKREPO_PROJECT,
+        repoName: config.BKREPO_BUCKET,
+        type: 'DOWNLOAD',
+        expireSeconds,
+        fullPathSet
+    }
+    const url = `${config.BKREPO_ENDPOINT_URL}/generic/temporary/url/create`
+    return new Promise((resolve, reject) => {
+        request.post({ url, body: data, json: true, headers }, function (err, res, body) {
+            if (err || res.statusCode !== 200) {
+                reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
+            } else if (typeof body === 'object' && body.code !== 0) {
+                reject(new Error(`${global.i18n.t('获取下载链接失败')}:${body.message}`))
+            } else {
+                if (body.data[0]?.url) {
+                    resolve(body.data[0]?.url)
+                } else {
+                    reject(new Error(`${global.i18n.t('获取下载链接失败')}: ${err || res.statusCode}`))
+                }
+            }
+        })
+    })
+}
+
+const uploadFile = async (filePath, uploadKey, settings = {}) => {
+    checkBkRepoSetting()
+    const key = path.basename(filePath)
+    const fileStream = fs.createReadStream(filePath)
+    fileStream.on('error', err => {
+        return Promise.reject(err)
+    })
+    const res = await uploadRepoFile(`${uploadKey}${key}`, fileStream, settings)
+    return res
+}
+
+const uploadImage = async (filePath, uploadKey, settings = {}) => {
+    checkBkRepoSetting()
+    const key = path.basename(filePath)
+
+    let uploadPath = `${uploadKey}${key}`
+    if (settings.ensurePath) {
+        uploadPath = uploadKey
+    }
+
+    let fileStream
+    if (settings.fileStream) {
+        fileStream = settings.fileStream
+    } else {
+        fileStream = fs.createReadStream(filePath)
+        fileStream.on('error', err => {
+            return Promise.reject(err)
+        })
+    }
+    
+    const res = await uploadRepoFile(uploadPath, fileStream, settings)
+    return res
+}
+
+/**
+ * 上传文件至bkrepo
+ * @param {string} uploadPath 文件存储路径
+ * @param {ReadStream} fileStream 文件内容
+ * @param {object} settings 配置选项
+ * @param {boolean} settings.isPublic 是否公开
+ * @param {boolean} settings.fullUrl 是否返回完整url
+ * @returns {Promise} 文件存储路径
+ */
+const uploadRepoFile = async (uploadPath, fileStream, settings = {}) => {
+    // 安全过滤上传路径
+    uploadPath = sanitizeUploadPath(uploadPath)
+    const url = getUrl(uploadPath, settings.isPublic)
+    const options = {
+        url,
+        method: 'PUT',
+        headers: Object.assign({}, headers, { 'X-BKREPO-OVERWRITE': false }),
+        body: fileStream
+    }
+    return new Promise((resolve, reject) => {
+        request(options, function (err, res, body) {
+            if (typeof body === 'string') {
+                body = JSON.parse(body)
+            }
+            if (err || res.statusCode !== 200) {
+                reject(new Error(`${global.i18n.t('上传至repo失败')}: ${err || res.statusCode}`))
+            } else if (typeof body === 'object' && body.code > 0) {
+                reject(new Error(`${global.i18n.t('上传至repo失败')}： ${body.message}`))
+            } else if (body.code === 0) {
+                resolve(settings.fullUrl ? url : uploadPath)
+            } else {
+                reject(new Error(global.i18n.t('上传至repo失败')))
+            }
+        })
+    })
+}
+
+module.exports = {
+    checkBkRepoSetting,
+    uploadFile,
+    getSignUrl,
+    uploadFolder,
+    downloadFile,
+    uploadImage
+}