From cbae58b0c0b7891e197a121206e62df4b21b4d01 Mon Sep 17 00:00:00 2001 From: cf-art Date: Thu, 13 Aug 2026 18:37:05 +0800 Subject: [PATCH] =?UTF-8?q?fix(evaluation):=20=E4=BF=AE=E5=A4=8D=E8=AF=84?= =?UTF-8?q?=E4=BC=B0=E6=95=B0=E6=8D=AE=E9=9B=86=E4=B8=8A=E4=BC=A0=E7=9A=84?= =?UTF-8?q?=E5=AD=98=E5=82=A8=E5=9E=8B=20XSS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 评估上传接口直接信任客户端传入的 Content-Type 并存入 MinIO， 攻击者可在合法 CSV 中伪造 Content-Type: text/html， 导致 presigned 下载 URL 被浏览器当作 HTML 渲染执行， 形成存储型 XSS（7 天匿名可访问）。 该接口已通过 pd.read_csv + 列名校验确保文件为 CSV， 强制硬编码 content_type="text/csv"。 --- .../bisheng/evaluation/domain/services/evaluation_service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/backend/bisheng/evaluation/domain/services/evaluation_service.py b/src/backend/bisheng/evaluation/domain/services/evaluation_service.py index 9296de47ba..fd7125dbaa 100644 --- a/src/backend/bisheng/evaluation/domain/services/evaluation_service.py +++ b/src/backend/bisheng/evaluation/domain/services/evaluation_service.py @@ -139,7 +139,7 @@ def upload_file(cls, file: UploadFile): file_ext = os.path.basename(file.filename).split(".")[-1] file_path = f"evaluation/dataset/{file_id}.{file_ext}" minio_client.put_object_sync( - bucket_name=minio_client.bucket, object_name=file_path, file=file.file, content_type=file.content_type + bucket_name=minio_client.bucket, object_name=file_path, file=file.file, content_type="text/csv" ) return file_name, file_path