fix(security): 第三轮审计P1修复 - 音色克隆SSRF防护 + 支付接口异常信息脱敏 #388
Merged
xiaoxia
merged 1 commits from 2026-07-16 12:58:51 +08:00
fix/voice-clone-ssrf into develop
1 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 CI Bot
|
c6d1ac9796 |
fix(security): 第三轮审计P1修复 - 音色克隆SSRF防护 + 支付接口异常信息脱敏
CI Build & Deploy Pipeline / Build Staging API Image (push) Has been skipped
CI Build & Deploy Pipeline / Build Staging Web Image (push) Has been skipped
CI Build & Deploy Pipeline / Build Staging Worker Image (push) Has been skipped
CI Build & Deploy Pipeline / Build Production API Image (push) Has been skipped
CI Build & Deploy Pipeline / Build Production Web Image (push) Has been skipped
CI Build & Deploy Pipeline / Build Production Worker Image (push) Has been skipped
CI Build & Deploy Pipeline / Deploy Staging (Watchtower auto-deploy) (push) Has been skipped
CI Build & Deploy Pipeline / Build Staging API Image (pull_request) Has been skipped
CI Build & Deploy Pipeline / Build Staging Web Image (pull_request) Has been skipped
CI Build & Deploy Pipeline / Build Staging Worker Image (pull_request) Has been skipped
CI/CD Pipeline / Frontend Lint (push) Successful in 56s
CI Build & Deploy Pipeline / Deploy Production (push) Has been skipped
CI Build & Deploy Pipeline / Staging E2E Tests (push) Has been skipped
CI Build & Deploy Pipeline / Staging API Integration Tests (push) Has been skipped
CI Build & Deploy Pipeline / Build Production API Image (pull_request) Has been skipped
CI Build & Deploy Pipeline / Build Production Web Image (pull_request) Has been skipped
CI Build & Deploy Pipeline / Build Production Worker Image (pull_request) Has been skipped
CI Build & Deploy Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
CI Build & Deploy Pipeline / Production Browser E2E (push) Has been skipped
CI Build & Deploy Pipeline / Deploy Production (pull_request) Has been skipped
CI Build & Deploy Pipeline / Staging E2E Tests (pull_request) Has been skipped
CI Build & Deploy Pipeline / Staging API Integration Tests (pull_request) Has been skipped
CI Build & Deploy Pipeline / Production Browser E2E (pull_request) Has been skipped
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 57s
CI/CD Pipeline / Unit Tests (push) Successful in 2m54s
CI/CD Pipeline / Unit Tests (pull_request) Successful in 2m11s
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 13m56s
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 15m27s
CI/CD Pipeline / Integration Tests (push) Successful in 2m41s
CI/CD Pipeline / Integration Tests (pull_request) Successful in 2m28s
P1-1: 音色克隆 source_audio_url 增加 SSRF 防护 - start_clone 和 retry_clone 均调用 validate_url_safety 校验 URL - 校验失败标记为 failed，错误信息明确，不提交到 CosyVoice - 新增 4 个单元测试覆盖 start_clone + retry_clone 的 SSRF 场景 P1-2: 订阅支付回调接口异常信息脱敏 - payment_callback 异常时不再返回原始异常信息 - 改为返回通用提示'支付处理失败，请稍后重试' - 详细错误记录到服务端日志 |