diff --git a/adapters/src/official/backend.rs b/adapters/src/official/backend.rs index e48fa03..f45454f 100644 --- a/adapters/src/official/backend.rs +++ b/adapters/src/official/backend.rs @@ -133,7 +133,12 @@ fn sanitize_component(component: &str, url: &str) -> Result { if component == "." || component == ".." || component.is_empty() { return Err(format!("官方 URL 包含不安全路径片段:{url}")); } - if component.contains('?') || component.contains('#') || component.contains('\\') { + if component.contains('?') || component.contains('#') { + return Err(format!( + "官方资源 URL 包含 query 或 fragment 等不安全路径字符:{url}" + )); + } + if component.contains('\\') { return Err(format!("官方资源 URL 包含不安全路径字符:{url}")); } Ok(component.to_string())