From 0ae3329613995331edf6ec9e88f24de5925766e9 Mon Sep 17 00:00:00 2001
From: Cheri Wen <Cheri8014@163.com>
Date: Tue, 2 Jun 2026 00:46:29 +0800
Subject: [PATCH] fix: sanitize API key name with html.EscapeString to prevent
 stored XSS (CWE-79)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HTML-encode user-supplied key names in both Create and Update
endpoints. Previously, names were stored verbatim — an attacker
could inject script tags that would execute in admin panels or
any view using innerHTML/v-html rendering.

Fixes: CWE-79 (Stored Cross-Site Scripting)
---
 backend/internal/service/api_key_service.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/backend/internal/service/api_key_service.go b/backend/internal/service/api_key_service.go
index 48e0ab2f3b..b53c2ec150 100644
--- a/backend/internal/service/api_key_service.go
+++ b/backend/internal/service/api_key_service.go
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
+	"html"
 	"strconv"
 	"strings"
 	"sync"
@@ -399,7 +400,7 @@ func (s *APIKeyService) Create(ctx context.Context, userID int64, req CreateAPIK
 	apiKey := &APIKey{
 		UserID:      userID,
 		Key:         key,
-		Name:        req.Name,
+		Name:        html.EscapeString(req.Name),
 		GroupID:     req.GroupID,
 		Status:      StatusActive,
 		IPWhitelist: req.IPWhitelist,
@@ -538,7 +539,7 @@ func (s *APIKeyService) Update(ctx context.Context, id int64, userID int64, req
 
 	// 更新字段
 	if req.Name != nil {
-		apiKey.Name = *req.Name
+		apiKey.Name = html.EscapeString(*req.Name)
 	}
 
 	if req.GroupID != nil {