diff --git a/patch_v2/meowpanel/meowpanel.c b/patch_v2/meowpanel/meowpanel.c index df9e5c0..4b508c3 100644 --- a/patch_v2/meowpanel/meowpanel.c +++ b/patch_v2/meowpanel/meowpanel.c @@ -1682,12 +1682,17 @@ static int api_overview(int sock) sA(&s, ",\"svcd\":"); svcd_fill(&s); sA(&s, "}"); - /* 服务端自校验:发出前 jv_parse 自查,坏了留证+回 500(防「非 JSON 响应」破页,2026-09-02 间歇性事故) */ + /* 服务端自校验:发出前 jv_parse 自查,坏了留证+回 500(防「非 JSON 响应」破页,2026-09-02 间歇性事故) + * 加严:内嵌 NUL(strlen 截断浏览器收残体)/非法 UTF-8(浏览器 JSON.parse 拒收,宽松解析器放行)*/ jv_t *chk = jv_parse(s.b ? s.b : "{}", (int)(s.b ? s.n : 2)); + size_t slen = s.b ? strlen(s.b) : 0; + int nul_inside = s.b && (slen != s.n); /* 内嵌 NUL:strlen < s.n */ + int utf8_bad = s.b && !utf8_valid_n(s.b, s.n); + if (s.b && (nul_inside || utf8_bad)) { chk = NULL; } if (!chk && s.b) { FILE *df = fopen("/tmp/overview_bad.json", "w"); if (df) { fwrite(s.b, 1, s.n, df); fclose(df); } - panel_log("overview: SELF-CHECK json invalid, raw dumped /tmp/overview_bad.json (%zu bytes)", s.n); + panel_log("overview: SELF-CHECK fail (nul=%d utf8_bad=%d n=%zu strlen=%zu), raw dumped /tmp/overview_bad.json", nul_inside, utf8_bad, s.n, slen); sbuf_free(&s); return send_err(sock, 500, "INTERNAL", "overview 聚合输出未通过 JSON 自校验(原始数据已留 /tmp/overview_bad.json)"); }