fix:相关漏洞修复

src/utils/other.ts

@@ -167,13 +167,13 @@ export const openWindow = (url: string, title: string, w: number, h: number) =>
 	const width = window.innerWidth
 		? window.innerWidth
 		: document.documentElement.clientWidth
-			? document.documentElement.clientWidth
-			: screen.width
+		? document.documentElement.clientWidth
+		: screen.width
 	const height = window.innerHeight
 		? window.innerHeight
 		: document.documentElement.clientHeight
-			? document.documentElement.clientHeight
-			: screen.height
+		? document.documentElement.clientHeight
+		: screen.height
 
 	const left = width / 2 - w / 2 + dualScreenLeft
 	const top = height / 2 - h / 2 + dualScreenTop
@@ -181,13 +181,13 @@ export const openWindow = (url: string, title: string, w: number, h: number) =>
 		url,
 		title,
 		"toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=no, resizable=yes, copyhistory=no, width=" +
-		w +
-		", height=" +
-		h +
-		", top=" +
-		top +
-		", left=" +
-		left,
+			w +
+			", height=" +
+			h +
+			", top=" +
+			top +
+			", left=" +
+			left,
 	)
 }
 
@@ -290,25 +290,93 @@ export function postDownBlobFile(url: any, data: any, fileName: string) {
  */
 export function handleBlobFile(response: any, fileName: string) {
 	// 处理返回的文件流
-	const blob = response
-	if (blob && blob.size === 0) {
-		useMessage().error("内容为空，无法下载")
+	// const blob = response
+	// if (blob && blob.size === 0) {
+	// 	useMessage().error("内容为空，无法下载")
+	// 	return
+	// }
+	// const link = document.createElement("a")
+
+	// // 兼容一下 入参不是 File Blob 类型情况
+	// var binaryData = [] as any
+	// binaryData.push(response)
+	// link.href = window.URL.createObjectURL(new Blob(binaryData))
+	// link.download = fileName
+	// document.body.appendChild(link)
+	// link.click()
+	// window.setTimeout(function () {
+	// 	// @ts-ignore
+	// 	URL.revokeObjectURL(blob)
+	// 	document.body.removeChild(link)
+	// }, 0)
+
+	// 1. 验证response类型和结构
+	if (!response || typeof response !== "object" || response.size === 0) {
+		useMessage().error("无效的响应数据")
 		return
 	}
-	const link = document.createElement("a")
 
-	// 兼容一下 入参不是 File Blob 类型情况
-	var binaryData = [] as any
-	binaryData.push(response)
-	link.href = window.URL.createObjectURL(new Blob(binaryData))
-	link.download = fileName
+	// 2. 验证blob类型
+	let blob: Blob
+	try {
+		if (response instanceof Blob) {
+			blob = response
+		} else if (response instanceof File) {
+			blob = response
+		} else if (response.data && response.data instanceof Blob) {
+			blob = response.data
+		} else {
+			// 尝试构造安全的blob
+			const safeData = Array.isArray(response) ? response : [response]
+			blob = new Blob(safeData, { type: "application/octet-stream" })
+		}
+	} catch (error) {
+		useMessage().error("文件数据格式错误")
+		return
+	}
+
+	// 3. 验证文件大小 (防止过大文件)
+	const MAX_FILE_SIZE = 100 * 1024 * 1024 // 100MB限制
+	if (blob.size > MAX_FILE_SIZE) {
+		useMessage().error("文件过大，无法下载")
+		return
+	}
+
+	// 4. 验证文件类型 (白名单)
+	const allowedTypes = [
+		"application/pdf",
+		"application/msword",
+		"application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+		"application/vnd.ms-excel",
+		"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+		"text/plain",
+		"image/jpeg",
+		"image/png",
+	]
+
+	if (!allowedTypes.includes(blob.type) && blob.type !== "") {
+		useMessage().error("不支持的文件类型")
+		return
+	}
+
+	// 5. 安全的文件下载
+	const link = document.createElement("a")
+	link.href = window.URL.createObjectURL(blob)
+	link.download = fileName.replace(/[<>:"/\\|?*]/g, "_").substring(0, 255) // 文件名清理，移除危险字符
+	link.style.display = "none" // 隐藏链接
+
 	document.body.appendChild(link)
 	link.click()
-	window.setTimeout(function () {
-		// @ts-ignore
-		URL.revokeObjectURL(blob)
-		document.body.removeChild(link)
-	}, 0)
+
+	// 6. 安全的清理操作
+	setTimeout(() => {
+		try {
+			window.URL.revokeObjectURL(link.href)
+			document.body.removeChild(link)
+		} catch (error) {
+			// 静默处理清理错误
+		}
+	}, 10)
 }
 
 /**