From eeaf1d9c730fe834e8f9e163159fcc53a89630bb Mon Sep 17 00:00:00 2001 From: Sean Du Date: Tue, 28 Apr 2026 11:03:59 +0800 Subject: [PATCH] Validate decoded query and required params Signed-off-by: Sean Du --- internal/handler/ghome/account/login.go | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/internal/handler/ghome/account/login.go b/internal/handler/ghome/account/login.go index 1e87cd7..c92239a 100644 --- a/internal/handler/ghome/account/login.go +++ b/internal/handler/ghome/account/login.go @@ -3,6 +3,7 @@ package account import ( "encoding/base64" "encoding/json" + "errors" "fmt" unitmodel "honoka-chan/internal/model/unit" usermodel "honoka-chan/internal/model/user" @@ -43,9 +44,19 @@ func login(ctx *gin.Context) { return } - queryStr, _ := url.QueryUnescape(string(decryptedData)) - params, _ := url.ParseQuery(queryStr) - phone, password := params.Get("phone"), params.Get("password") + queryStr, err := url.QueryUnescape(string(decryptedData)) + if ss.CheckErr(err) { + return + } + params, err := url.ParseQuery(queryStr) + if ss.CheckErr(err) { + return + } + phone, password := strings.TrimSpace(params.Get("phone")), params.Get("password") + if phone == "" || password == "" { + ss.Abort(errors.New("invalid login params")) + return + } var userID int var pass, autoKey, ticket string