fix(bat-api): 完成 issue #19 同机 live 联调

internal/api/middleware.go

@@ -4,6 +4,7 @@ import (
 	"crypto/subtle"
 	"net"
 	"net/http"
+	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -15,9 +16,35 @@ func (s *Server) wrapHandler(next http.Handler) http.Handler {
 	handler = s.rateLimitMiddleware(handler)
 	handler = s.securityHeadersMiddleware(handler)
 	handler = s.accessLogMiddleware(handler)
+	// Check before ServeMux can clean dot segments and route an escaped path
+	// to a different host-shaped endpoint.
+	handler = rejectDotSegmentsMiddleware(handler)
 	return handler
 }
 
+func rejectDotSegmentsMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if hasDotPathSegment(r.URL.Path) || (r.URL.RawPath != "" && hasDotPathSegment(r.URL.RawPath)) {
+			http.NotFound(w, r)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func hasDotPathSegment(rawPath string) bool {
+	decoded, err := url.PathUnescape(rawPath)
+	if err != nil {
+		return true
+	}
+	for _, segment := range strings.Split(decoded, "/") {
+		if segment == "." || segment == ".." {
+			return true
+		}
+	}
+	return false
+}
+
 func (s *Server) securityHeadersMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("X-Content-Type-Options", "nosniff")