fix(admin platform orders form): escape regex and block nested back

2026-03-14 10:15:04 +00:00
parent 26d74cbb41
commit 2afe7dc8b7
1 changed files with 4 additions and 1 deletions
--- a/resources/views/admin/platform_orders/form.blade.php
+++ b/resources/views/admin/platform_orders/form.blade.php
@@ -127,7 +127,10 @@
            $incomingBack = (string) ($defaults['back'] ?? '');
            // 为避免 & 被 Blade escape 成 &amp; 导致回退上下文丢失，这里需要原样输出 href。
            // 安全护栏：必须为站内相对路径，并拒绝引号/尖括号，降低 XSS 风险。
-            $safeBack = (str_starts_with($incomingBack, '/') && !preg_match('/["\'<>]/', $incomingBack))
+            $safeBack = (str_starts_with($incomingBack, '/')
+            && !preg_match('/["\'<>]/', $incomingBack)
+            // back 本身不应再包含 back（避免无限嵌套导致 URL 膨胀）
+            && !preg_match('/(?:^|[?&])back=/', $incomingBack))
                ? $incomingBack
                : '';
        @endphp