Upload 15 files

models.py

@@ -2,6 +2,7 @@
 import re
 from pydantic import BaseModel, Field, field_validator  # 🧹 P2修复：pydantic v2 已废弃 v1 风格 validator
 from typing import Optional, List, Literal
+from profile_media import normalize_profile_media
 
 def _validate_email_format(email: str) -> str:
     """邮箱格式校验"""
@@ -48,6 +49,11 @@ class UserRegister(BaseModel):
     def _check_email(cls, v):
         return _validate_email_format(v)
 
+    @field_validator('avatarDataUrl')
+    @classmethod
+    def _check_avatar_url(cls, value):
+        return normalize_profile_media(value)
+
 class UserLogin(BaseModel):
     account: str   
     password: str
@@ -69,6 +75,11 @@ class UserUpdate(BaseModel):
     avatarDataUrl: Optional[str] = None
     bannerUrl: Optional[str] = None         # 🚀 个人资料卡背景图云端URL
 
+    @field_validator('avatarDataUrl', 'bannerUrl')
+    @classmethod
+    def _check_media_url(cls, value):
+        return normalize_profile_media(value)
+
 class SettingsPrivacy(BaseModel):
     model_config = {"extra": "forbid"}
     follows: bool = Field(strict=True)

profile_media.py

@@ -0,0 +1,85 @@
+"""资料持久媒体地址准入；不解析DNS、不下载内容。"""
+import ipaddress
+import re
+from urllib.parse import unquote, urlsplit
+from deployment_config import PUBLIC_API_BASE_URL
+
+MAX_PROFILE_MEDIA_URL_BYTES = 16384
+LOCAL_IMAGE_PREFIX = "/community_hub/image?url="
+COMPLETE_IMAGE_SUFFIX = "&require_complete=1"
+INVALID_MEDIA = "invalid_profile_media_url"
+
+
+def _host(parts):
+    host = parts.hostname
+    if not host or "%" in host:
+        raise ValueError(INVALID_MEDIA)
+    host = host.removesuffix(".").lower()
+    if not host:
+        raise ValueError(INVALID_MEDIA)
+    try:
+        address = ipaddress.ip_address(host)
+    except ValueError:
+        ascii_host = host.encode("idna").decode("ascii")
+        labels = ascii_host.split(".")
+        if (len(ascii_host) > 253 or not all(re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", label) for label in labels)):
+            raise ValueError(INVALID_MEDIA)
+        return ascii_host, None
+    return address.compressed, address
+
+
+def normalize_profile_media(value):
+    if value is None:
+        return None
+    if not isinstance(value, str):
+        raise ValueError(INVALID_MEDIA)
+    if value == "":
+        return ""
+    if value.strip() != value or any(ord(char) < 32 or ord(char) == 127 for char in value):
+        raise ValueError(INVALID_MEDIA)
+    if value[:5].lower() in {"data:", "blob:"}:
+        return None
+    if len(value.encode("utf-8")) > MAX_PROFILE_MEDIA_URL_BYTES or "\\" in value:
+        raise ValueError(INVALID_MEDIA)
+    source = value
+    layers = 0
+    while source.startswith(LOCAL_IMAGE_PREFIX):
+        layers += 1
+        if layers > 10:
+            raise ValueError(INVALID_MEDIA)
+        encoded = source[len(LOCAL_IMAGE_PREFIX):]
+        if encoded.endswith(COMPLETE_IMAGE_SUFFIX):
+            encoded = encoded[:-len(COMPLETE_IMAGE_SUFFIX)]
+        if re.search(r"%(?![a-fA-F0-9]{2})", encoded):
+            raise ValueError(INVALID_MEDIA)
+        source = unquote(encoded, errors="strict")
+    if source.strip() != source or "\\" in source or any(ord(char) < 32 or ord(char) == 127 for char in source):
+        raise ValueError(INVALID_MEDIA)
+    if not re.match(r"^https?://", source, re.I):
+        raise ValueError(INVALID_MEDIA)
+    try:
+        parsed = urlsplit(source)
+        if parsed.username is not None or parsed.password is not None or parsed.netloc.endswith(":"):
+            raise ValueError(INVALID_MEDIA)
+        if parsed.port is not None and not 1 <= parsed.port <= 65535:
+            raise ValueError(INVALID_MEDIA)
+        port = parsed.port or (443 if parsed.scheme == "https" else 80)
+        host, address = _host(parsed)
+        base = urlsplit(PUBLIC_API_BASE_URL)
+        base_host, _ = _host(base)
+        if host == base_host:
+            base_port = base.port or (443 if base.scheme == "https" else 80)
+            if parsed.scheme != base.scheme or port != base_port or parsed.path != base.path.rstrip("/") + "/api/image_proxy":
+                raise ValueError(INVALID_MEDIA)
+            return source
+        if address:
+            if (not address.is_global or address.is_multicast or (address.version == 6
+                    and (address.ipv4_mapped is not None or int(address) >> 125 != 1))):
+                raise ValueError(INVALID_MEDIA)
+        elif (host == "localhost" or host.endswith((".localhost", ".local")) or "." not in host
+                or re.fullmatch(r"(?:0x[0-9a-f]+|[0-9]+)(?:\.(?:0x[0-9a-f]+|[0-9]+))*", host, re.I)
+                or re.fullmatch(r"(?:0x[0-9a-f]+|[0-9]+)", host.rsplit(".", 1)[-1], re.I)):
+            raise ValueError(INVALID_MEDIA)
+        return source
+    except (ValueError, UnicodeError):
+        raise ValueError(INVALID_MEDIA) from None

rate_limit.py

@@ -2,6 +2,7 @@
 
 from datetime import datetime
 from functools import wraps
+from inspect import iscoroutinefunction
 import hashlib
 import hmac
 import logging
@@ -171,6 +172,7 @@ def shared_limit(limit: int):
 
     def decorate(endpoint):
         scope = f"{endpoint.__module__}.{endpoint.__name__}"
+        is_async = iscoroutinefunction(endpoint)
 
         @wraps(endpoint)
         async def wrapped(*args, **kwargs):
@@ -181,7 +183,9 @@ def shared_limit(limit: int):
                 raise RuntimeError(f"{scope} requires a FastAPI Request parameter")
             identity = await run_in_threadpool(get_rate_limit_key, request)
             await run_in_threadpool(_consume_shared_limit, identity, scope, limit)
-            return await endpoint(*args, **kwargs)
+            if is_async:
+                return await endpoint(*args, **kwargs)
+            return await run_in_threadpool(endpoint, *args, **kwargs)
 
         return wrapped
 

user_store.py

@@ -5,6 +5,7 @@ import time
 
 from fastapi import HTTPException
 import 数据库连接 as db
+from profile_media import normalize_profile_media
 
 logger = logging.getLogger(__name__)
 PROFILE_FIELDS = frozenset({"account", "name", "avatar", "avatarDataUrl", "bannerUrl", "intro", "gender", "age",
@@ -17,7 +18,14 @@ PRIVACY_FIELDS = frozenset({"follows", "likes", "favorites", "downloads"})
 
 def project_profile(record, owner=False):
     fields = PROFILE_FIELDS | OWNER_FIELDS if owner else PROFILE_FIELDS
-    return copy.deepcopy({key: value for key, value in record.items() if key in fields})
+    result = copy.deepcopy({key: value for key, value in record.items() if key in fields})
+    for field in ('avatar', 'avatarDataUrl', 'bannerUrl'):
+        if field in result:
+            try:
+                result[field] = normalize_profile_media(result[field]) or ''
+            except (ValueError, TypeError):
+                result[field] = ''
+    return result
 
 
 def _user(data, account):
@@ -63,12 +71,27 @@ def attach_profile_counts(record, items):
     return result
 
 
-def update_profile(account, updates):
-    # 路由已经过 UserUpdate 校验；这里再限定字段，避免未来调用方扩散写入范围。
+def _profile_patch(updates):
     patch = copy.deepcopy({key: value for key, value in updates.items()
                           if key in EDITABLE_FIELDS and value is not None})
-    if isinstance(patch.get("avatarDataUrl"), str) and patch["avatarDataUrl"].startswith("data:"):
-        del patch["avatarDataUrl"]
+    for field in ('avatarDataUrl', 'bannerUrl'):
+        if field not in patch:
+            continue
+        try:
+            value = normalize_profile_media(patch[field])
+        except (ValueError, TypeError):
+            raise HTTPException(status_code=422, detail=[{'loc': ['body', field],
+                'type': 'value_error', 'msg': 'invalid_profile_media_url'}]) from None
+        if value is None:
+            del patch[field]
+        else:
+            patch[field] = value
+    return patch
+
+
+def update_profile(account, updates):
+    # 路由已经过 UserUpdate 校验；这里再限定字段，避免未来调用方扩散写入范围。
+    patch = _profile_patch(updates)
 
     def updater(data):
         record = _user(data, account)
@@ -82,10 +105,7 @@ def update_settings(account, updates, privacy):
     if not isinstance(privacy, dict) or set(privacy) != PRIVACY_FIELDS or any(type(value) is not bool for value in privacy.values()):
         raise HTTPException(status_code=400, detail="隐私设置不正确")
     settings = copy.deepcopy(privacy)
-    patch = copy.deepcopy({key: value for key, value in updates.items()
-                           if key in EDITABLE_FIELDS and value is not None})
-    if isinstance(patch.get("avatarDataUrl"), str) and patch["avatarDataUrl"].startswith("data:"):
-        del patch["avatarDataUrl"]
+    patch = _profile_patch(updates)
 
     def updater(data):
         record = _user(data, account)
@@ -169,6 +189,9 @@ def check_registration(account, email, phone):
 
 def create_user(record):
     incoming = copy.deepcopy(record)
+    for field in ('avatarDataUrl', 'bannerUrl'):
+        if field in incoming:
+            incoming[field] = _profile_patch({field: incoming[field]}).get(field, '')
     def updater(data):
         _registration_available(data, incoming["account"], incoming.get("email"), incoming.get("phone"))
         data[incoming["account"]] = incoming