fix security and import validation

server/routes/records.js

@@ -2,7 +2,17 @@ const express = require('express');
 const db = require('../db');
 const config = require('../config');
 const logger = require('../utils/logger');
-const { getMonthRange, AppError, validateRequired, validateNumber, validateInList } = require('../utils/helpers');
+const {
+  getMonthRange,
+  AppError,
+  validateRequired,
+  validateNumber,
+  validateInList,
+  validatePage,
+  validateLimit,
+  validateIsoDate,
+  optionalString
+} = require('../utils/helpers');
 
 const router = express.Router();
 
@@ -18,13 +28,34 @@ router.post('/', (req, res, next) => {
     const allCategories = [...config.categories.income, ...config.categories.expense];
     validateInList(category, 'category', allCategories);
 
-    const validatedAmount = validateNumber(amount, '金额', 0);
+    // 派单的返点可为负数，因此金额也允许为负数
+    const validatedAmount = category === '派单'
+      ? validateNumber(amount, '金额')
+      : validateNumber(amount, '金额', 0);
+    const validatedQuantity = quantity === undefined || quantity === null || quantity === '' ? null : validateNumber(quantity, '数量', 0);
+    const validatedUnitPrice = unit_price === undefined || unit_price === null || unit_price === '' ? null : validateNumber(unit_price, '单价', 0);
+    const validatedRebate = rebate === undefined || rebate === null || rebate === '' ? null : validateNumber(rebate, '返点');
+    const validatedCreatedAt = validateIsoDate(created_at, '创建时间');
 
     const stmt = db.prepare(`
       INSERT INTO records (user_id, type, category, amount, quantity, unit_price, rebate, boss, partner, source, destination, note, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
-    const result = stmt.run(req.user.id, type, category, validatedAmount, quantity || null, unit_price || null, rebate || null, boss || null, partner || null, source || null, destination || null, note || null, created_at || new Date().toISOString());
+    const result = stmt.run(
+      req.user.id,
+      type,
+      category,
+      validatedAmount,
+      validatedQuantity,
+      validatedUnitPrice,
+      validatedRebate,
+      optionalString(boss, '老板', 100),
+      optionalString(partner, '陪玩', 100),
+      optionalString(source, '来源', 100),
+      optionalString(destination, '去向', 100),
+      optionalString(note, '备注', 500),
+      validatedCreatedAt
+    );
 
     logger.info(`用户 ${req.user.username} 新增记录: ${category} ${validatedAmount}`);
     res.json({ id: result.lastInsertRowid });
@@ -35,8 +66,9 @@ router.post('/', (req, res, next) => {
 
 // 通用分页查询函数
 function queryPagedRecords(userId, year, month, options) {
-  const { page = 1, limit = 20 } = options;
-  const offset = (Number(page) - 1) * Number(limit);
+  const page = validatePage(options.page, 1);
+  const limit = validateLimit(options.limit, config.pagination.defaultLimit, config.pagination.maxLimit);
+  const offset = (page - 1) * limit;
   const { startDate, endDate } = getMonthRange(year, month);
 
   let whereClause = `user_id = ? AND DATE(created_at, 'localtime') >= ? AND DATE(created_at, 'localtime') < ?`;
@@ -61,9 +93,9 @@ function queryPagedRecords(userId, year, month, options) {
 
   const records = db.prepare(
     `SELECT * FROM records WHERE ${whereClause} ORDER BY created_at DESC LIMIT ? OFFSET ?`
-  ).all(...params, Number(limit), offset);
+  ).all(...params, limit, offset);
 
-  return { records, total, page: Number(page), limit: Number(limit) };
+  return { records, total, page, limit };
 }
 
 // 接单列表
@@ -122,7 +154,9 @@ router.get('/dispatches', (req, res) => {
 // 获取记录列表
 router.get('/', (req, res) => {
   const { type, page = 1, limit = 20 } = req.query;
-  const offset = (page - 1) * limit;
+  const validatedPage = validatePage(page, 1);
+  const validatedLimit = validateLimit(limit, config.pagination.defaultLimit, config.pagination.maxLimit);
+  const offset = (validatedPage - 1) * validatedLimit;
   let sql = 'SELECT * FROM records WHERE user_id = ?';
   const params = [req.user.id];
   if (type) {
@@ -130,7 +164,7 @@ router.get('/', (req, res) => {
     params.push(type);
   }
   sql += ' ORDER BY created_at DESC LIMIT ? OFFSET ?';
-  params.push(Number(limit), Number(offset));
+  params.push(validatedLimit, offset);
   res.json(db.prepare(sql).all(...params));
 });
 
@@ -144,12 +178,37 @@ router.put('/:id', (req, res, next) => {
       throw new AppError('无效的记录ID', 400);
     }
 
-    const validatedAmount = validateNumber(amount, '金额', 0);
+    // 获取原有记录以判断类别（派单允许负数金额）
+    const existing = db.prepare('SELECT category FROM records WHERE id = ? AND user_id = ?').get(id, req.user.id);
+    if (!existing) {
+      throw new AppError('记录不存在', 404);
+    }
+
+    const validatedAmount = existing.category === '派单'
+      ? validateNumber(amount, '金额')
+      : validateNumber(amount, '金额', 0);
+    const validatedQuantity = quantity === undefined || quantity === null || quantity === '' ? null : validateNumber(quantity, '数量', 0);
+    const validatedUnitPrice = unit_price === undefined || unit_price === null || unit_price === '' ? null : validateNumber(unit_price, '单价', 0);
+    const validatedRebate = rebate === undefined || rebate === null || rebate === '' ? null : validateNumber(rebate, '返点');
+    const validatedCreatedAt = validateIsoDate(created_at, '创建时间');
 
     db.prepare(`
       UPDATE records SET quantity = ?, unit_price = ?, rebate = ?, amount = ?, boss = ?, partner = ?, source = ?, destination = ?, note = ?, created_at = ?
       WHERE id = ? AND user_id = ?
-    `).run(quantity || null, unit_price || null, rebate || null, validatedAmount, boss || null, partner || null, source || null, destination || null, note || null, created_at || null, id, req.user.id);
+    `).run(
+      validatedQuantity,
+      validatedUnitPrice,
+      validatedRebate,
+      validatedAmount,
+      optionalString(boss, '老板', 100),
+      optionalString(partner, '陪玩', 100),
+      optionalString(source, '来源', 100),
+      optionalString(destination, '去向', 100),
+      optionalString(note, '备注', 500),
+      validatedCreatedAt,
+      id,
+      req.user.id
+    );
 
     logger.debug(`用户 ${req.user.username} 更新记录: ${id}`);
     res.json({ success: true });