fix: 全仓库逻辑合理性检修复 - 三阶段修复27项问题

Phase 1 - 安全与数据完整性:
- S1: WS IDOR 修复 (sync-service websocket.go)
- S2: WS channel panic 修复 (ws_connection/manager)
- S3: GORM FOR UPDATE 兼容 v2 (sync_helpers.go)
- S4: IPC 裸 handle 改为 safeHandle (ollama/local-asr/memory)
- S5: 路径遍历防护使用 path.relative (storageIpc/videoAnalyze)
- S6: 列名注入防护 (sqliteRepository + dbIpcHandlers)
- S8: resolve 空数据校验 (sync_resolve.go)
- S10: 限流+预算覆盖补齐 (rate_limit/budget)
- S12: JWT 竞态与 log.Fatal 修复 (auth.go)

Phase 2 - 数据一致性与稳定性:
- S7: ClearDataSection 36表全清 + crypto 安全清除
- S11: Logger WriteStream error 处理器
- M2: 流式取消真正中止 HTTP 请求 (gatewayStream + streamHandler)
- M8: 迁移完成后重建 FTS5 索引
- M10: 备份顺序修复 (先 checkpoint 再备份)
- M11: 番茄钟暂停时长排除 (pausedAt + totalPausedMs)
- M12: 打卡日期从 UTC 改为本地时区
- M14: useEffect 不自动打卡 + try/catch
- M19: SSE 缓冲上限 1MB

Phase 3 - 轻微问题:
- L1: 权限 handler 仅放行 media
- L2: removeAllListeners 改为 removeListener
- L4: Content-Length int 解析异常保护
- L6: template.format 防 params 覆盖
- L7: playBeep 参数交换修复
- L8: 墙钟校准 0s 立即完成 + 预警范围匹配
- L12: decryptField 失败日志
- L14: .env 行内注释剥离

Author: Aparencia

client/electron/ai/gatewayStream.ts

@@ -18,6 +18,8 @@ export async function* postJsonStream<TReq>(
   body: TReq,
   authToken?: string,
   timeoutMs: number = 300000,
+  /** 外部 AbortSignal（如用户取消流式请求），与内部超时 signal 组合 */
+  externalSignal?: AbortSignal,
 ): AsyncGenerator<string, void, unknown> {
   const base = gatewayUrl();
   if (!base) {
@@ -39,6 +41,15 @@ export async function* postJsonStream<TReq>(
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
 
+  // 组合外部 signal：如果外部 signal 被 abort，也 abort 内部 controller
+  if (externalSignal) {
+    if (externalSignal.aborted) {
+      controller.abort();
+    } else {
+      externalSignal.addEventListener('abort', () => controller.abort(), { once: true });
+    }
+  }
+
   let resp: Response;
   try {
     resp = await fetch(url, {
@@ -74,6 +85,8 @@ export async function* postJsonStream<TReq>(
   const reader = resp.body.getReader();
   const decoder = new TextDecoder();
   let buffer = '';
+  /** SSE 缓冲最大字节数，防止恶意服务端无分隔符输出耗尽内存 */
+  const MAX_BUFFER_SIZE = 1 * 1024 * 1024; // 1MB
 
   try {
     while (true) {
@@ -82,6 +95,11 @@ export async function* postJsonStream<TReq>(
 
       buffer += decoder.decode(value, { stream: true });
 
+      // 缓冲上限检查：防止恶意服务端无分隔符输出耗尽内存
+      if (buffer.length > MAX_BUFFER_SIZE) {
+        throw new Error(`SSE buffer exceeded ${MAX_BUFFER_SIZE} bytes, possible malicious stream`);
+      }
+
       // 按 \n\n 分割 SSE 事件
       const events = buffer.split('\n\n');
       buffer = events.pop() || '';

client/electron/ai/handlers/videoAnalyzeHandler.ts

@@ -46,11 +46,15 @@ function register(): void {
       }
 
       try {
-        // SEC: 路径安全校验 — 仅允许读取应用数据目录或临时目录（与 main.ts fs:read-file 保持一致）
+        // SEC: 路径安全校验 — 使用 path.relative 做路径边界检查
         const resolvedPath = path.resolve(args.filePath);
         const appDataPath = app.getPath('userData');
         const tempPath = app.getPath('temp');
-        if (!resolvedPath.startsWith(appDataPath) && !resolvedPath.startsWith(tempPath)) {
+        const relToApp = path.relative(appDataPath, resolvedPath);
+        const relToTemp = path.relative(tempPath, resolvedPath);
+        const isInApp = !relToApp.startsWith('..') && !path.isAbsolute(relToApp);
+        const isInTemp = !relToTemp.startsWith('..') && !path.isAbsolute(relToTemp);
+        if (!isInApp && !isInTemp) {
           throw new Error(`[AI] [video-analyze] File path not allowed: ${resolvedPath}`);
         }
 

client/electron/ai/local-asr/index.ts

@@ -11,7 +11,8 @@
  * 渲染进程 asrTranscriber.ts 无需任何改动即可切换引擎。
  */
 
-import { ipcMain, BrowserWindow } from 'electron';
+import { BrowserWindow } from 'electron';
+import { safeHandle } from '../../ipcUtils.js';
 import { logger } from '../../logger.js';
 import {
   getLocalAsrConfig,
@@ -41,7 +42,7 @@ export function registerLocalAsrHandlers(): void {
   // ── 转写（核心接口，渲染进程 asrTranscriber.ts 调用） ──
   // TODO(P1-3): 本 IPC payload 暂未含可选 hotwords 字段——SenseVoice/Paraformer
   // 不支持热词（详见 SherpaAsrService.ts 的 TODO 结论），届时新增字段须保持旧载荷兼容
-  ipcMain.handle(
+  safeHandle(
     'local_asr_transcribe',
     async (_event, args: {
       audioBase64: string;
@@ -62,16 +63,16 @@ export function registerLocalAsrHandlers(): void {
   );
 
   // ── 配置 ──
-  ipcMain.handle('local_asr_get_config', () => {
+  safeHandle('local_asr_get_config', async () => {
     return getLocalAsrConfig();
   });
 
-  ipcMain.handle('local_asr_update_config', async (_event, partial: Partial<LocalAsrConfig>) => {
+  safeHandle('local_asr_update_config', async (_event, partial: Partial<LocalAsrConfig>) => {
     return updateLocalAsrConfig(partial);
   });
 
   // ── 可用性检测 ──
-  ipcMain.handle('local_asr_check_available', async () => {
+  safeHandle('local_asr_check_available', async () => {
     const available = await checkLocalAsrAvailable();
     const config = getLocalAsrConfig();
     return {
@@ -84,13 +85,13 @@ export function registerLocalAsrHandlers(): void {
 
   // ── 真流式 ASR（Paraformer 在线，课堂 smart 采集实时转录） ──
   // 渲染进程据此决定是否走真流式链路（否则回退按段转写）
-  ipcMain.handle('local_asr_stream_available', () => {
+  safeHandle('local_asr_stream_available', async () => {
     return { available: isStreamingAsrAvailable() };
   });
 
   // 启动真流式：创建在线流，后续音频块经 mediaCaptureHandlers 喂入，
   // partial/final 结果经 asr_stream_partial / asr_stream_final 事件推回渲染进程
-  ipcMain.handle(
+  safeHandle(
     'local_asr_stream_start',
     async (event, args: { sampleRate?: number }) => {
       const win = BrowserWindow.fromWebContents(event.sender);
@@ -101,20 +102,20 @@ export function registerLocalAsrHandlers(): void {
     },
   );
 
-  ipcMain.handle('local_asr_stream_stop', async () => {
+  safeHandle('local_asr_stream_stop', async () => {
     stopStreamingAsr();
     return { success: true };
   });
 
   // ── 模型管理 ──
-  ipcMain.handle('local_asr_get_models', () => {
+  safeHandle('local_asr_get_models', async () => {
     return {
       models: getModelsStatus(),
       download: getDownloadStatus(),
     };
   });
 
-  ipcMain.handle(
+  safeHandle(
     'local_asr_download_model',
     async (_event, args: { engine: AsrEngine }) => {
       logger.info(`[LocalASR] IPC download request: engine=${args.engine}`);
@@ -123,7 +124,7 @@ export function registerLocalAsrHandlers(): void {
     },
   );
 
-  ipcMain.handle(
+  safeHandle(
     'local_asr_delete_model',
     async (_event, args: { engine: AsrEngine }) => {
       await deleteModel(args.engine);

client/electron/ai/ollama/index.ts

@@ -9,7 +9,8 @@
  * @ai-context: Ollama 模块 IPC 注册出口（状态/配置/模型管理通道）。
  */
 
-import { ipcMain, BrowserWindow } from 'electron';
+import { BrowserWindow } from 'electron';
+import { safeHandle } from '../../ipcUtils.js';
 import { logger } from '../../logger.js';
 import { getOllamaStatus, pullModel, deleteModel, initOllamaDetection } from './OllamaService.js';
 import { loadOllamaConfig, updateOllamaConfig, getOllamaConfig } from './config.js';
@@ -26,7 +27,7 @@ export function registerOllamaHandlers(): void {
   logger.info('[Ollama] Registering IPC handlers...');
 
   // ---- 获取状态 ----
-  ipcMain.handle('ollama:get-status', async (_event, forceRefresh?: boolean) => {
+  safeHandle('ollama:get-status', async (_event, forceRefresh?: boolean) => {
     try {
       const status = await getOllamaStatus(forceRefresh ?? false);
       const config = getOllamaConfig();
@@ -41,7 +42,7 @@ export function registerOllamaHandlers(): void {
   });
 
   // ---- 更新配置 ----
-  ipcMain.handle('ollama:set-config', async (_event, partial: Record<string, unknown>) => {
+  safeHandle('ollama:set-config', async (_event, partial: Record<string, unknown>) => {
     try {
       const updated = await updateOllamaConfig(partial);
       logger.info(`[Ollama] Config updated via IPC: enabled=${updated.enabled}`);
@@ -53,7 +54,7 @@ export function registerOllamaHandlers(): void {
   });
 
   // ---- 拉取模型 ----
-  ipcMain.handle('ollama:pull-model', async (event, modelName: string) => {
+  safeHandle('ollama:pull-model', async (event, modelName: string) => {
     if (!modelName || typeof modelName !== 'string') {
       throw new Error('Invalid model name');
     }
@@ -88,7 +89,7 @@ export function registerOllamaHandlers(): void {
   });
 
   // ---- 删除模型 ----
-  ipcMain.handle('ollama:delete-model', async (_event, modelName: string) => {
+  safeHandle('ollama:delete-model', async (_event, modelName: string) => {
     if (!modelName || typeof modelName !== 'string') {
       throw new Error('Invalid model name');
     }

client/electron/ai/streamHandler.ts

@@ -81,6 +81,8 @@ export function registerStreamHandler(): void {
           method,
           payload,
           authToken,
+          undefined,
+          abortController.signal,
         );
 
         for await (const chunk of stream) {

client/electron/db/dbIpcHandlers.ts

@@ -135,7 +135,9 @@ export function registerDbIpcHandlers(): void {
   safeHandle('db:insert', async (_event, params: { table: string; item: Record<string, unknown> }) => {
     const tableName = resolveTable(params.table);
     const repo = new SqliteRepository<SqliteRow>(tableName);
-    const result = await repo.create(params.item as SqliteRow);
+    // SEC: 过滤非法列名，防止列名注入
+    const sanitized = repo.filterAllowedColumns(params.item as SqliteRow);
+    const result = await repo.create(sanitized as Omit<SqliteRow, 'id'> & { id: string });
 
     // 增量索引维护：对含 title/content 字段的表自动更新 FTS5 索引
     // 在插入成功后同步执行，确保搜索索引与业务数据保持一致
@@ -156,7 +158,9 @@ export function registerDbIpcHandlers(): void {
   safeHandle('db:update', async (_event, params: { table: string; id: string; changes: Record<string, unknown> }) => {
     const tableName = resolveTable(params.table);
     const repo = new SqliteRepository<SqliteRow>(tableName);
-    const result = await repo.update(params.id, params.changes as Partial<SqliteRow>);
+    // SEC: 过滤非法列名，防止列名注入
+    const sanitized = repo.filterAllowedColumns(params.changes as Partial<SqliteRow>);
+    const result = await repo.update(params.id, sanitized);
 
     // 增量索引维护：更新操作需要重新读取完整行数据（changes 可能只包含部分字段），
     // 然后更新 FTS5 索引中的对应文档

client/electron/db/migration.ts

@@ -9,6 +9,7 @@
 
 import type Database from 'better-sqlite3';
 import { getConnection } from './sqliteService.js';
+import { rebuildIndex, collectIndexableData } from './fts5Search.js';
 import { isImportableTable } from './importWhitelist.js';
 import { logger } from '../logger.js';
 
@@ -195,6 +196,14 @@ export function registerMigrationHandlers(
   safeHandle('migration:complete', async () => {
     try {
       const result = completeMigration(db);
+      // 迁移完成后重建 FTS5 全文索引（迁移数据绕过业务写入路径，未触发增量索引维护）
+      try {
+        const indexData = collectIndexableData(db);
+        rebuildIndex(indexData);
+        logger.info(`[Migration] FTS5 index rebuilt: ${indexData.reduce((sum, t) => sum + t.rows.length, 0)} documents`);
+      } catch (ftsErr) {
+        logger.warn(`[Migration] FTS5 index rebuild failed (non-fatal): ${ftsErr instanceof Error ? ftsErr.message : String(ftsErr)}`);
+      }
       return { success: result.ok, integrity: result.integrity };
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);

client/electron/db/sqliteRepository.ts

@@ -103,7 +103,24 @@ function entityToRow(entity: Record<string, unknown>, meta: TableMeta): Record<s
 
 /** 用双引号包裹列名，防止 SQLite 保留字冲突 */
 function q(col: string): string {
-  return `"${col}"`;
+  // SEC: 转义列名中的双引号，防止列名注入（如 `a" --` 闭合引号后注释掉剩余 SQL）
+  return `"${col.replace(/"/g, '""')}"`;
+}
+
+/** 缓存每张表的列名白名单 */
+const columnCache = new Map<string, Set<string>>();
+
+/**
+ * 获取表的合法列名集合（从 PRAGMA table_info 查询并缓存）
+ */
+function getTableColumns(tableName: string): Set<string> {
+  const cached = columnCache.get(tableName);
+  if (cached) return cached;
+  const db = getConnection();
+  const rows = db.prepare(`PRAGMA table_info("${tableName.replace(/"/g, '""')}")`).all() as Array<{ name: string }>;
+  const cols = new Set(rows.map((r) => r.name));
+  columnCache.set(tableName, cols);
+  return cols;
 }
 
 // ================================================================
@@ -123,6 +140,21 @@ export default class SqliteRepository<T extends { id: string }> implements IRepo
     return getConnection();
   }
 
+  /**
+   * 过滤非法列名，仅保留表中真实存在的列
+   * SEC: 防止列名注入（防御纵深：配合 q() 的双引号转义）
+   */
+  filterAllowedColumns(data: Record<string, unknown>): Record<string, unknown> {
+    const allowed = getTableColumns(this.tableName);
+    const result: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(data)) {
+      if (allowed.has(key)) {
+        result[key] = value;
+      }
+    }
+    return result;
+  }
+
   async getAll(): Promise<T[]> {
     const rows = this.db.prepare(`SELECT * FROM ${this.tableName}`).all() as Record<string, unknown>[];
     return rows.map((r) => rowToEntity<T>(r, this.meta));

client/electron/envLoader.ts

@@ -27,6 +27,26 @@ function loadEnvFile(filePath: string, overrideKeys: Set<string>): void {
       if (eqIdx === -1) continue;
       const key = trimmed.slice(0, eqIdx).trim();
       let value = trimmed.slice(eqIdx + 1).trim();
+      // 移除行内注释（# 号，但需跳过引号内的 #）
+      if (value.includes('#')) {
+        // 简单处理：不在引号内的 # 视为注释起始
+        let inQuote = false;
+        let quoteChar = '';
+        let commentIdx = -1;
+        for (let i = 0; i < value.length; i++) {
+          const ch = value[i];
+          if ((ch === '"' || ch === "'") && (!inQuote || ch === quoteChar)) {
+            inQuote = !inQuote;
+            quoteChar = inQuote ? ch : '';
+          } else if (ch === '#' && !inQuote) {
+            commentIdx = i;
+            break;
+          }
+        }
+        if (commentIdx >= 0) {
+          value = value.slice(0, commentIdx).trimEnd();
+        }
+      }
       // 移除首尾引号
       if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
         value = value.slice(1, -1);

client/electron/logger.ts

@@ -29,6 +29,10 @@ class Logger {
       const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
       const logFile = path.join(logsDir, `app-${timestamp}.log`);
       this.stream = fs.createWriteStream(logFile, { flags: 'a' });
+      this.stream.on('error', (err) => {
+        console.error('[Logger] Write stream error, falling back to console:', err);
+        this.stream = null;
+      });
       this.stream.write(`# EntropyDecrease log started at ${new Date().toISOString()}\n`);
     } catch (err) {
       console.error('[Logger] Failed to initialize file logger:', err);