fix(review): 内网/回环 SSRF 边界 + 校对会话门控与建议长度护栏

Author: Aparencia

app/src-tauri/src/ai_proofread.rs

@@ -136,7 +136,9 @@ pub fn parse_suggestions(raw: &str, expected: &[String]) -> Vec<ProofreadSuggest
         .filter(|s| {
             let orig_norm = normalize_for_match(&s.original);
             let sugg = s.suggestion.trim();
-            !sugg.is_empty()
+            // 审查 L3：建议长度护栏（≤2000 字符——防模型失控超长回文）
+            sugg.chars().count() <= 2000
+                && !sugg.is_empty()
                 && sugg != s.original.trim()
                 && expected_norm.iter().any(|e| *e == orig_norm)
         })

app/src-tauri/src/commands_proofread.rs

@@ -125,6 +125,15 @@ pub async fn proofread_run(
         return Err("无效的会话 id".to_string());
     }
     let st: AppState = (*state).clone();
+    // 审查 L3：会话存在性 + 非 recording 门控（与 second_pass 同口径——
+    // 幽灵/进行中会话不得零成本成功还记账）
+    {
+        let s = st.db.get_session(session_id).map_err(|e| e.to_string())?;
+        let Some(session) = s else { return Err("会话不存在".to_string()) };
+        if session.status == "recording" {
+            return Err("会话进行中——结束捕获后方可校对".to_string());
+        }
+    }
     let (settings, model) = model_and_settings(&st)?;
     settings.proofread_gate()?;
     if !authorized {

app/src-tauri/src/commands_web.rs

@@ -18,7 +18,7 @@ use tauri::State;
 use crate::commands::AppState;
 use crate::db_web::WebPage;
 use crate::types::NewNote;
-use crate::web_capture::{extract_page, host_of};
+use crate::web_capture::{extract_page, host_of, is_blocked_host};
 
 /// 抓取体量上限（防超大响应拖垮内存/耗时）。
 const FETCH_MAX_BYTES: usize = 5 * 1024 * 1024;
@@ -57,6 +57,11 @@ pub async fn web_capture_url(
 }
 
 fn capture_inner(st: &AppState, url: &str) -> Result<WebCaptureView, String> {
+    // 审查 M2：内网/回环/链路本地拒绝（页面重定向链无法在客户端逐跳验证——
+    // 首跳阻断 + 注释明示局限；另由 ureq redirects 上限约束跳数）
+    if is_blocked_host(url) {
+        return Err("目标为内网/回环地址（SSRF 边界拒绝；如确需本机页面请用图文采集）".to_string());
+    }
     let agent = ureq::AgentBuilder::new()
         .timeout(FETCH_TIMEOUT)
         .redirects(5)
@@ -242,6 +247,10 @@ pub async fn web_snapshot_export(
             if assets >= SNAPSHOT_MAX_ASSETS {
                 return None;
             }
+            // 审查 M2：子资源同样拒绝内网主机（恶意页面植入的内网地址不得随快照带出）
+            if is_blocked_host(url) {
+                return None;
+            }
             let bytes = fetch_bytes(url, SNAPSHOT_ASSET_CAP)?;
             assets += 1;
             total_bytes += bytes.len();

app/src-tauri/src/commands_web_inbox.rs

@@ -285,6 +285,12 @@ fn ingest_from_extension(
     app: Option<&tauri::AppHandle>,
     p: &IngestPayload,
 ) -> Result<i64, String> {
+    // 审查 M2：投递 URL 拒绝内网主机（扩展可能位于内网/本地页面语境）
+    if let Some(u) = &p.url {
+        if crate::web_capture::is_blocked_host(u) {
+            return Err("投递 URL 为内网/回环地址（SSRF 边界拒绝）".to_string());
+        }
+    }
     let now = crate::db::unix_seconds();
     let session = db
         .create_session(&crate::types::NewSession {

app/src-tauri/src/web_capture.rs

@@ -89,17 +89,43 @@ fn extract_title(html: &str) -> String {
     String::new()
 }
 
-/// URL 主机名（会话标题兜底；纯函数）。
+/// URL 主机名（会话标题兜底；纯函数；剥 userinfo——审查 M2：凭证不得入库）。
 pub fn host_of(url: &str) -> Option<String> {
     let rest = url.split("://").nth(1)?;
-    Some(
-        rest.split(['/', '?', '#'])
-            .next()
-            .unwrap_or("")
-            .chars()
-            .take(100)
-            .collect(),
-    )
+    let authority = rest.split(['/', '?', '#']).next().unwrap_or("");
+    let host = authority.rsplit('@').next().unwrap_or("").to_string();
+    Some(host.chars().take(100).collect())
+}
+
+/// 内网/回环/链路本地主机拦截（审查 M2：SSRF-lite 边界——公网页面的跳转与
+/// 子资源不得把本机/内网内容拉入产物）。局限注明：不做 DNS 再解析（域名解析
+/// 到内网 IP 的场景留待 resolver 级防护迭代）。
+pub fn is_blocked_host(url: &str) -> bool {
+    let Some(host) = host_of(url) else { return true };
+    let host = host.trim().to_ascii_lowercase();
+    let host = host.trim_start_matches('[').trim_end_matches(']');
+    if host.is_empty() {
+        return true;
+    }
+    if host == "localhost" || host.contains(':') || host.contains('%') {
+        return true; // 含冒号=IPv6 字面量（::1/fe80 等回环与链路本地一并拦截）
+    }
+    if host == "0.0.0.0"
+        || host.starts_with("127.")
+        || host.starts_with("10.")
+        || host.starts_with("169.254.")
+        || host.starts_with("192.168.")
+    {
+        return true;
+    }
+    if let Some(rest) = host.strip_prefix("172.") {
+        if let Some(second) = rest.split('.').next().and_then(|s| s.parse::<u32>().ok()) {
+            if (16..=31).contains(&second) {
+                return true;
+            }
+        }
+    }
+    false
 }
 
 /// HTML → Markdown 正文（轻量规则：script/style 剔除；块级换行；标题/列表/

app/src-tauri/src/web_capture_tests.rs

@@ -39,6 +39,21 @@ fn entity_decode_and_collapse() {
     assert!(page.markdown.contains("甲 & 乙 丙"));
 }
 
+#[test]
+fn host_guard_blocks_private_and_linklocal() {
+    assert!(is_blocked_host("http://127.0.0.1:8080/x"));
+    assert!(is_blocked_host("http://localhost/a"));
+    assert!(is_blocked_host("http://10.1.2.3/a"));
+    assert!(is_blocked_host("http://192.168.1.1/a"));
+    assert!(is_blocked_host("http://172.16.5.5/a"));
+    assert!(is_blocked_host("http://172.32.5.5/a") == false, "172.32 为公网段");
+    assert!(is_blocked_host("http://169.254.169.254/latest/meta-data/"));
+    assert!(is_blocked_host("http://[::1]/"));
+    assert!(!is_blocked_host("https://example.com/x"));
+    // userinfo 剥除（标题兜底与拦截判断同源）
+    assert_eq!(host_of("https://user:pass@example.com/x").as_deref(), Some("example.com"));
+}
+
 #[test]
 fn body_too_short_marks_fail() {
     let page = extract_page("<html><head><title>仅标题</title></head><body><p>短</p></body></html>");