fix: 保持官方资源 adapter URL 错误契约

2026-09-18 06:34:54 +08:00 · 2026-08-02 22:44:09 +08:00
parent 8b64cc94f3
commit 6442c7661d
1 changed files with 6 additions and 1 deletions
@@ -133,7 +133,12 @@ fn sanitize_component(component: &str, url: &str) -> Result<String, String> {
    if component == "." || component == ".." || component.is_empty() {
        return Err(format!("官方 URL 包含不安全路径片段：{url}"));
    }
-    if component.contains('?') || component.contains('#') || component.contains('\\') {
+    if component.contains('?') || component.contains('#') {
+        return Err(format!(
+            "官方资源 URL 包含 query 或 fragment 等不安全路径字符：{url}"
+        ));
+    }
+    if component.contains('\\') {
        return Err(format!("官方资源 URL 包含不安全路径字符：{url}"));
    }
    Ok(component.to_string())