From 67aa5fc7a8648ea682cbcf02c88326e6a02a930b Mon Sep 17 00:00:00 2001
From: AskaEth <i@yeij.top>
Date: Wed, 2 Sep 2026 08:12:47 +0800
Subject: [PATCH] =?UTF-8?q?feat(panel):=20overview=20=E8=87=AA=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C=E5=8A=A0=E4=B8=A5=E2=80=94=E2=80=94=E5=86=85=E5=B5=8C?=
 =?UTF-8?q?=20NUL/=E9=9D=9E=E6=B3=95=20UTF-8/strlen=E2=89=A0n=20=E5=85=A8?=
 =?UTF-8?q?=E6=8B=A6=E5=B9=B6=20dump=20/tmp/overview=5Fbad.json=EF=BC=88?=
 =?UTF-8?q?=E4=B8=8E=E6=B5=8F=E8=A7=88=E5=99=A8=20JSON.parse=20=E5=AF=B9?=
 =?UTF-8?q?=E9=BD=90=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 patch_v2/meowpanel/meowpanel.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/patch_v2/meowpanel/meowpanel.c b/patch_v2/meowpanel/meowpanel.c
index df9e5c0..4b508c3 100644
--- a/patch_v2/meowpanel/meowpanel.c
+++ b/patch_v2/meowpanel/meowpanel.c
@@ -1682,12 +1682,17 @@ static int api_overview(int sock)
     sA(&s, ",\"svcd\":");
     svcd_fill(&s);
     sA(&s, "}");
-    /* 服务端自校验：发出前 jv_parse 自查，坏了留证+回 500（防「非 JSON 响应」破页，2026-09-02 间歇性事故） */
+    /* 服务端自校验：发出前 jv_parse 自查，坏了留证+回 500（防「非 JSON 响应」破页，2026-09-02 间歇性事故）
+     * 加严：内嵌 NUL（strlen 截断浏览器收残体）/非法 UTF-8（浏览器 JSON.parse 拒收，宽松解析器放行）*/
     jv_t *chk = jv_parse(s.b ? s.b : "{}", (int)(s.b ? s.n : 2));
+    size_t slen = s.b ? strlen(s.b) : 0;
+    int nul_inside = s.b && (slen != s.n);          /* 内嵌 NUL：strlen < s.n */
+    int utf8_bad = s.b && !utf8_valid_n(s.b, s.n);
+    if (s.b && (nul_inside || utf8_bad)) { chk = NULL; }
     if (!chk && s.b) {
         FILE *df = fopen("/tmp/overview_bad.json", "w");
         if (df) { fwrite(s.b, 1, s.n, df); fclose(df); }
-        panel_log("overview: SELF-CHECK json invalid, raw dumped /tmp/overview_bad.json (%zu bytes)", s.n);
+        panel_log("overview: SELF-CHECK fail (nul=%d utf8_bad=%d n=%zu strlen=%zu), raw dumped /tmp/overview_bad.json", nul_inside, utf8_bad, s.n, slen);
         sbuf_free(&s);
         return send_err(sock, 500, "INTERNAL", "overview 聚合输出未通过 JSON 自校验（原始数据已留 /tmp/overview_bad.json）");
     }