fix: 查重上传接口错误信息不再泄露内部异常（安全审计 P1） #82

2026-06-28T18:24:52+08:00

xiaoxia commented

2026-06-28 18:24:52 +08:00

修复内容

apps/api/app/api/routes/duplication.py 中两处 HTTPException.detail 使用 f-string 将内部异常直接暴露给用户：

位置	修复前	修复后
L150（文件读取失败）	`detail=f"读取文件失败: {exc}"`	`detail="文件读取失败，请稍后重试"`
L162（OSS 上传失败）	`detail=f"文件上传失败: {exc}"`	`detail="文件上传失败，请稍后重试"`

同时添加 logger.error(..., exc_info=True) 记录完整异常堆栈，方便内部排查。

## 修复内容 `apps/api/app/api/routes/duplication.py` 中两处 `HTTPException.detail` 使用 f-string 将内部异常直接暴露给用户： | 位置 | 修复前 | 修复后 | |---|---|---| | L150（文件读取失败） | `detail=f"读取文件失败: {exc}"` | `detail="文件读取失败，请稍后重试"` | | L162（OSS 上传失败） | `detail=f"文件上传失败: {exc}"` | `detail="文件上传失败，请稍后重试"` | 同时添加 `logger.error(..., exc_info=True)` 记录完整异常堆栈，方便内部排查。

xiaoxia added 1 commit 2026-06-28 18:24:53 +08:00

fix: 查重上传接口错误信息不再泄露内部异常

CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Has been cancelled

Details

CI/CD Pipeline / Frontend Lint (pull_request) Has been cancelled

Details

22196198bb

- L150: detail=f"读取文件失败: {exc}" → detail="文件读取失败，请稍后重试"
- L162: detail=f"文件上传失败: {exc}" → detail="文件上传失败，请稍后重试"
- 添加 logger.error 记录完整异常信息供内部排查

xiaoxia merged commit ce25bacbac into develop

2026-06-28 18:35:42 +08:00

xiaoxia referenced this issue from a commit

2026-06-28 18:35:42 +08:00

Merge pull request 'fix: 查重上传接口错误信息不再泄露内部异常（安全审计 P1）' (#82) from fix/p1-duplication-error-info-leak into develop

xiaoxia referenced this pull request

2026-06-28 18:42:51 +08:00

测试: 订阅管理 API + 查重上传错误处理单元测试 (63用例) #83

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#82