fix(security): 禁止html上传并加固剩余上传入口

移除html/htm白名单，补齐qw-api与商城CommonScrm上传校验，清洗知识库文件名。

Co-authored-by: Cursor <cursoragent@cursor.com>

fs-admin/src/main/java/com/fs/chat/controller/ChatDatasetFileController.java

@@ -157,10 +157,20 @@ public class ChatDatasetFileController extends BaseController
         int dotIndex = nameWithExtension.lastIndexOf(".");
 
         // 检查文件名是否有扩展名
+        String name;
         if (dotIndex > 0 && dotIndex < nameWithExtension.length() - 1) {
-            return nameWithExtension.substring(0, dotIndex);
+            name = nameWithExtension.substring(0, dotIndex);
+        } else {
+            name = nameWithExtension;
         }
-
-        return nameWithExtension;
+        // 文件名字符白名单，防止路径穿越/特殊字符注入（不影响正常中英文名）
+        name = name.replaceAll("[^a-zA-Z0-9_\\-\\u4e00-\\u9fa5]", "");
+        if (name.length() > 50) {
+            name = name.substring(0, 50);
+        }
+        if (name.isEmpty()) {
+            name = "file";
+        }
+        return name;
     }
 }

fs-common/src/main/java/com/fs/common/utils/file/MimeTypeUtils.java

@@ -29,8 +29,8 @@ public class MimeTypeUtils
     public static final String[] DEFAULT_ALLOWED_EXTENSION = {
             // 图片
             "bmp", "gif", "jpg", "jpeg", "png",
-            // word excel powerpoint
-            "doc", "docx", "xls", "xlsx", "ppt", "pptx", "html", "htm", "txt",
+            // word excel powerpoint（已移除 html/htm，避免存储型 XSS）
+            "doc", "docx", "xls", "xlsx", "ppt", "pptx", "txt",
             // 压缩文件
             "rar", "zip", "gz", "bz2",
             // 视频格式

fs-company/src/main/java/com/fs/chat/controller/ChatDatasetFileController.java

@@ -168,10 +168,20 @@ public class ChatDatasetFileController extends BaseController
         int dotIndex = nameWithExtension.lastIndexOf(".");
 
         // 检查文件名是否有扩展名
+        String name;
         if (dotIndex > 0 && dotIndex < nameWithExtension.length() - 1) {
-            return nameWithExtension.substring(0, dotIndex);
+            name = nameWithExtension.substring(0, dotIndex);
+        } else {
+            name = nameWithExtension;
         }
-
-        return nameWithExtension;
+        // 文件名字符白名单，防止路径穿越/特殊字符注入（不影响正常中英文名）
+        name = name.replaceAll("[^a-zA-Z0-9_\\-\\u4e00-\\u9fa5]", "");
+        if (name.length() > 50) {
+            name = name.substring(0, 50);
+        }
+        if (name.isEmpty()) {
+            name = "file";
+        }
+        return name;
     }
 }

fs-qw-api/src/main/java/com/fs/app/controller/CommonController.java

@@ -2,6 +2,7 @@ package com.fs.app.controller;
 
 import com.fs.common.core.domain.R;
 import com.fs.common.exception.file.OssException;
+import com.fs.common.utils.security.OssUploadSecurityUtils;
 import com.fs.course.param.UserCourseComplaintRecordParam;
 import com.fs.course.service.IFsUserCourseComplaintTypeService;
 import com.fs.course.vo.FsUserCourseComplaintTypeListVO;
@@ -37,9 +38,8 @@ public class CommonController {
         {
             throw new OssException("上传文件不能为空");
         }
-        // 上传文件
-        String fileName = file.getOriginalFilename();
-        String suffix = fileName.substring(fileName.lastIndexOf("."));
+        // 上传文件（后缀白名单，不影响正常图片/文档/音视频上传）
+        String suffix = OssUploadSecurityUtils.validateAndGetDotSuffix(file);
         CloudStorageService storage = OSSFactory.build();
         String url = storage.uploadSuffix(file.getBytes(), suffix);
         return R.ok().put("url",url);

fs-user-app/src/main/java/com/fs/app/controller/store/CommonScrmController.java

@@ -11,6 +11,7 @@ import com.fs.app.utils.JwtUtils;
 import com.fs.common.config.FSSysConfig;
 import com.fs.common.core.domain.R;
 import com.fs.common.exception.file.OssException;
+import com.fs.common.utils.security.OssUploadSecurityUtils;
 import com.fs.company.service.ICompanyMoneyLogsService;
 import com.fs.company.service.ICompanyService;
 import com.fs.company.service.ICompanyUserService;
@@ -362,9 +363,8 @@ public class CommonScrmController extends AppBaseController {
         if (file.isEmpty()) {
             throw new OssException("上传文件不能为空");
         }
-        // 上传文件
-        String fileName = file.getOriginalFilename();
-        String suffix = fileName.substring(fileName.lastIndexOf("."));
+        // 上传文件（后缀白名单，不影响正常图片/文档/音视频上传）
+        String suffix = OssUploadSecurityUtils.validateAndGetDotSuffix(file);
         CloudStorageService storage = OSSFactory.build();
         String url = storage.uploadSuffix(file.getBytes(), suffix);
         return R.ok().put("url", url);