fix：上线漏洞

src/components/FilePreviewModal/DocxPreview.tsx

@@ -44,7 +44,7 @@ export const DocxPreview: React.FC<DocxPreviewProps> = ({ src, className = '', o
           onRendered?.()
         })
         .catch((error) => {
-          console.error('DOCX 渲染失败:', error)
+          console.error('DOCX 渲染失败:')
           onError?.(error)
         })
     }

src/pages/Chat/Chat.tsx

@@ -539,9 +539,9 @@ export const Chat: React.FC = () => {
           }, 2000)
         }
       })
-      .catch((error) => {
+      .catch(() => {
         // 流式请求出错时的处理
-        console.error('[Chat] 流式请求失败:', error)
+        console.error('[Chat] 流式请求失败:')
         // 清除自动调用标记
         isAutoSubmitQualityImprovementRef.current = false
         // 设置最后一条 AI 回答的 endAnswerFlag，用于停止打字效果

src/pages/ChatTactics/TacticsChat.tsx

@@ -598,9 +598,9 @@ export const TacticsChat: React.FC = () => {
           }, 2000)
         }
       })
-      .catch((error) => {
+      .catch(() => {
         // 流式请求出错时的处理
-        console.error('[TacticsChat] 流式请求失败:', error)
+        console.error('[TacticsChat] 流式请求失败:')
         // 设置最后一条 AI 回答的 endAnswerFlag，用于停止打字效果
         setAllItems((prevItems) => {
           const newItems = [...prevItems]

src/pages/Collect/Collect.tsx

@@ -8,12 +8,14 @@ import styles from './Collect.module.less'
 import { fetchQueryCollectionList } from '@/api/collect'
 import DeleteIcon from '@/assets/svg/delete.svg?react'
 import { fetchDelCollection } from '@/api/chat'
+import { fetchSessionConversationId } from '@/api/conversation'
 import { MarkdownDetail } from '@/components/MarkdownDetail'
 import AIcon from '@/assets/svg/aicon.svg?react'
 import QIcon from '@/assets/svg/qicon.svg?react'
 import EmptyIcon from '@/assets/svg/empty.svg?react'
 import ShineBorder from '@/components/ShineBorder'
 import SdreamLoading from '@/components/SdreamLoading'
+import { safeSessionStorageGetItem } from '@/lib/utils'
 
 export const Collect: React.FC = () => {
   const navigate = useNavigate()
@@ -84,22 +86,43 @@ export const Collect: React.FC = () => {
   }
 
   // 添加返回上一页的函数
-  const handleGoBack = () => {
+  const handleGoBack = async () => {
     // 设置标记，用于 Chat 组件检测从收藏页返回
     sessionStorage.setItem('fromCollect', 'true')
-    if (window.history.length > 1) {
+    // 仅允许回退到同源来源页，避免跳转到不可控外部页面
+    const isSameOriginReferrer = (() => {
+      if (!document.referrer) {
+        return false
+      }
+      try {
+        return new URL(document.referrer).origin === window.location.origin
+      }
+      catch {
+        return false
+      }
+    })()
+    if (window.history.length > 1 && isSameOriginReferrer) {
       navigate(-1)
       return
     }
-    const rawConversationId = sessionStorage.getItem('currentConversationId') || ''
-    // 仅允许常见会话 ID 字符，避免可控输入直接参与路由拼接
-    if (/^[\w-]+$/.test(rawConversationId)) {
-      const conversationId = encodeURIComponent(rawConversationId)
-      navigate(`/chat/${conversationId}`, { state: { fromCollect: true } })
+    try {
+      const currentToolId = safeSessionStorageGetItem('currentToolId') || ''
+      const sessionRes = await fetchSessionConversationId({ busiId: currentToolId })
+      const conversationId = sessionRes?.data?.conversationId
+      const isSafeConversationId
+        = typeof conversationId === 'string'
+          && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(conversationId)
+
+      if (isSafeConversationId) {
+        navigate(`/chat/${encodeURIComponent(conversationId)}`, { state: { fromCollect: true } })
         return
       }
-    // 无效 ID 时保持原有目标页（等价于 conversationId 为空时的 /chat/）
-    navigate('/chat/', { state: { fromCollect: true } })
+    }
+    catch (error) {
+      console.error('[Collect] 获取会话ID失败:', error)
+    }
+    // 无有效会话 ID 时，固定回到站内白名单页面
+    navigate('/home', { state: { fromCollect: true } })
   }
 
   useEffect(() => {