fix：代码漏洞

91c11f7b · Liu · d376992e · 91c11f7b · 91c11f7b · 91c11f7b
Commit 91c11f7b authored Apr 17, 2026 by Liu
6 changed files
--- a/src/components/ChatEditor/index.tsx
+++ b/src/components/ChatEditor/index.tsx
@@ -101,7 +101,9 @@ const ChatEditorBase: React.FC<ChatEditorProps & WithAuthProps> = ({ checkAuth, 
    // 监听 storage 事件（跨标签页）
    window.addEventListener('storage', checkTokenChange)
    // 轮询检查（同标签页）
-    const interval = setInterval(checkTokenChange, 100)
+    const interval = window.setInterval(() => {
+      checkTokenChange()
+    }, 100)
    // 等待最多 1 秒，检测 token 是否变化
    const waitForChange = new Promise<void>((resolve) => {

--- a/src/pages/Chat/Chat.tsx
+++ b/src/pages/Chat/Chat.tsx
@@ -759,12 +759,6 @@ export const Chat: React.FC = () => {
  useEffect(() => {
    if (id) {
-      console.log('[Chat] 路由变化检查:', {
-        id,
-        currentIdRef: currentIdRef.current,
-        locationState: location.state,
-        toolHistoryLoadedId: toolHistoryLoadedRef.current.conversationId,
-      })
      // 检查是否已通过 toolHistoryLoaded 事件加载过相同会话的数据
      // 如果已加载，跳过接口调用，避免重复请求
      if (toolHistoryLoadedRef.current.conversationId === id) {

--- a/src/pages/ChatTactics/TacticsChat.tsx
+++ b/src/pages/ChatTactics/TacticsChat.tsx
@@ -29,18 +29,6 @@ export const TacticsChat: React.FC = () => {
  const { id } = useParams<{ id: string }>()
  const location = useLocation()
  const navigate = useNavigate()
-  const logFullUrl = useCallback((reason?: string) => {
-    console.log('[TacticsChat] full url snapshot', {
-      reason,
-      href: window.location.href,
-      pathname: location.pathname,
-      search: location.search,
-      state: location.state,
-    })
-  }, [location.pathname, location.search, location.state])
-  useEffect(() => {
-    logFullUrl('mount or location change')
-  }, [logFullUrl])
  const [isLoading, setIsLoading] = useState(false)
  const [allItems, setAllItems] = useState<ChatRecord[]>([])
  const [historyDividers, setHistoryDividers] = useState<{ index: number, time: string }[]>([])
@@ -120,12 +108,10 @@ export const TacticsChat: React.FC = () => {
      return undefined
    }
    // 打印完整链接
-    console.log('[TacticsChat] from=tactics&place=order 完整链接:', window.location.href)
    const workOrderIds = searchParams.get('workOrderIds')
    const result = {
      workOrderIds: workOrderIds !== null ? workOrderIds : undefined,
    }
-    console.log('[TacticsChat] orderMeta result:', result)
    // 如果 URL 中有 workOrderIds 参数（包括空字符串），则使用它；否则为 undefined
    return result
  }, [searchParams])
@@ -133,7 +119,6 @@ export const TacticsChat: React.FC = () => {
  // 仅用于创建会话的额外参数（create_conversation）
  const getConversationExtra = useCallback(() => {
    if (orderMeta) {
-      console.log('orderMeta', orderMeta)
      // 从 localStorage 读取 userId
      const userIdFromStorage = safeLocalStorageGetItem('__USER_NAME__')
      let userId = ''
@@ -840,10 +825,9 @@ export const TacticsChat: React.FC = () => {
    // 重新拉取会话列表，保持原有行为
    await dispatch(fetchTacticsConversations())
    if (currentIdRef.current) {
-      logFullUrl('before navigate reanalyze')
      navigate(`/tactics/chat/${currentIdRef.current}${location.search}`)
    }
-  }, [dispatch, navigate, handleSubmitQuestion, orderMeta, userMeta, getNumberTypeWithUserMeta, isLoading, isAsking, logFullUrl, location.search])
+  }, [dispatch, navigate, handleSubmitQuestion, orderMeta, userMeta, getNumberTypeWithUserMeta, isLoading, isAsking, location.search])
  const handleCancelClear = useCallback(() => {
    setShowClearConfirm(false)
@@ -988,7 +972,6 @@ export const TacticsChat: React.FC = () => {
  // 创建新会话成功后跳转到新会话页面
  useEffect(() => {
    if (shouldNavigateToNewConversation && currentConversationId) {
-      logFullUrl('before navigate create new conversation')
      navigate(`/tactics/chat/${currentConversationId}${location.search}`, {
        state: {
          shouldSendQuestion: shouldSendQuestionFromState,
@@ -997,7 +980,7 @@ export const TacticsChat: React.FC = () => {
      })
      dispatch(clearTacticsNavigationFlag())
    }
-  }, [shouldNavigateToNewConversation, currentConversationId, navigate, dispatch, shouldSendQuestionFromState, location.search, logFullUrl])
+  }, [shouldNavigateToNewConversation, currentConversationId, navigate, dispatch, shouldSendQuestionFromState, location.search])
  // 处理shouldSendQuestion的变化 - 自动发送问题
  useEffect(() => {

--- a/src/pages/ChatTactics/components/TacticsWelcome/index.tsx
+++ b/src/pages/ChatTactics/components/TacticsWelcome/index.tsx
@@ -15,17 +15,6 @@ export const TacticsWelcome: React.FC<TacticsWelcomeProps> = ({ cleared }) => {
  const from = searchParams.get('from')
  const place = searchParams.get('place')
  const isOrderPlace = from === 'tactics' && place === 'order'
-  // 打印路由参数
-  console.log('TacticsWelcome 路由参数:', {
-    searchParams: Object.fromEntries(searchParams.entries()),
-    from,
-    place,
-    isOrderPlace,
-    cleared,
-    url: window.location.href,
-  })
  const welcomeText = cleared
    ? '暂无分析记录，点击右上方按钮开始新的分析吧!'
    : isOrderPlace

--- a/src/pages/Collect/Collect.tsx
+++ b/src/pages/Collect/Collect.tsx
@@ -91,8 +91,15 @@ export const Collect: React.FC = () => {
      navigate(-1)
      return
    }
-    const conversationId = sessionStorage.getItem('currentConversationId') || ''
+    const rawConversationId = sessionStorage.getItem('currentConversationId') || ''
+    // 仅允许常见会话 ID 字符，避免可控输入直接参与路由拼接
+    if (/^[\w-]+$/.test(rawConversationId)) {
+      const conversationId = encodeURIComponent(rawConversationId)
      navigate(`/chat/${conversationId}`, { state: { fromCollect: true } })
+      return
+    }
+    // 无效 ID 时保持原有目标页（等价于 conversationId 为空时的 /chat/）
+    navigate('/chat/', { state: { fromCollect: true } })
  }
  useEffect(() => {

--- a/src/pages/Home/HomeNew.tsx
+++ b/src/pages/Home/HomeNew.tsx
@@ -305,8 +305,8 @@ export const Home: React.FC = () => {
        setIsDataLoaded(false)
        fetchBusinessInsightQuestions()
-          .catch((error) => {
+          .catch(() => {
-            console.error('[HomeNew] 业务洞察常见问题获取失败:', error)
+            console.error('[HomeNew] 业务洞察常见问题获取失败')
          })
          .finally(() => {
            setIsDataLoaded(true)