refactor: 抽出 BackUrl::sanitizeForLinks 统一 back 安全护栏

2026-03-14 18:23:00 +00:00
parent 4aa44258f8
commit 3ffc87f78c
8 changed files with 44 additions and 36 deletions
--- a/resources/views/admin/site_subscriptions/show.blade.php
+++ b/resources/views/admin/site_subscriptions/show.blade.php
@@ -125,11 +125,7 @@
            // - 拒绝引号/尖括号
            // - 拒绝 nested back=（避免 URL 膨胀/绕过）
            // 说明：下方 href 采用原样输出以避免 &amp; 影响回链/断言。
-            $safeBackForLinks = (str_starts_with($incomingBack, '/')
-                && !preg_match('/["\'<>]/', $incomingBack)
-                && !preg_match('/(?:^|[?&])back=/', $incomingBack))
-                ? $incomingBack
-                : '';
+            $safeBackForLinks = \App\Support\BackUrl::sanitizeForLinks($incomingBack);
        @endphp

        @if($safeBackForLinks !== '')