From 09e56cae48adc7c3f7f59b57f63af374ee7c8c9a Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Mon, 31 Aug 2026 10:42:29 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E7=B3=BB=E7=BB=9F=E6=9C=8D?=
 =?UTF-8?q?=E5=8A=A1=E5=90=8D=E7=A7=B0=E8=B7=AF=E5=BE=84=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/servicehost/linux.go        | 2 +-
 backend/internal/servicehost/service_test.go | 8 ++++++++
 backend/internal/servicehost/windows.go      | 7 ++++---
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/backend/internal/servicehost/linux.go b/backend/internal/servicehost/linux.go
index 6fe3125..7c9d3c0 100644
--- a/backend/internal/servicehost/linux.go
+++ b/backend/internal/servicehost/linux.go
@@ -194,7 +194,7 @@ func (e *commandFailure) Error() string {
 func (e *commandFailure) Unwrap() error { return e.err }
 
 func validateName(name string) error {
-	if name == "" || name == "." || name == ".." {
+	if strings.TrimSpace(name) == "" || name == "." || name == ".." || strings.ContainsAny(name, `/\\`) {
 		return ErrInvalidName
 	}
 	return nil
diff --git a/backend/internal/servicehost/service_test.go b/backend/internal/servicehost/service_test.go
index 3285ceb..d7adb1c 100644
--- a/backend/internal/servicehost/service_test.go
+++ b/backend/internal/servicehost/service_test.go
@@ -45,3 +45,11 @@ func TestOptionsNormalizedDefaultsDisplayText(t *testing.T) {
 		t.Fatal("规范化后程序路径不能为空")
 	}
 }
+
+func TestValidateNameRejectsPathLikeValues(t *testing.T) {
+	for _, name := range []string{"", " ", ".", "..", "../Scert", "a/b", `a\b`} {
+		if err := validateName(name); err == nil {
+			t.Errorf("服务名称 %q 未被拒绝", name)
+		}
+	}
+}
diff --git a/backend/internal/servicehost/windows.go b/backend/internal/servicehost/windows.go
index f18a80b..98ec090 100644
--- a/backend/internal/servicehost/windows.go
+++ b/backend/internal/servicehost/windows.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"os/exec"
 	"strconv"
+	"strings"
 )
 
 func Install(ctx context.Context, options Options) error {
@@ -24,8 +25,8 @@ func Install(ctx context.Context, options Options) error {
 }
 
 func Uninstall(ctx context.Context, name string) error {
-	if name == "" {
-		return commandError("卸载", ErrInvalidName)
+	if err := validateName(name); err != nil {
+		return err
 	}
 	if err := runSC(ctx, "stop", name); err != nil {
 		// 服务未运行时允许继续删除。
@@ -83,7 +84,7 @@ func (e *commandFailure) Error() string {
 func (e *commandFailure) Unwrap() error { return e.err }
 
 func validateName(name string) error {
-	if name == "" || name == "." || name == ".." {
+	if strings.TrimSpace(name) == "" || name == "." || name == ".." || strings.ContainsAny(name, `/\\`) {
 		return ErrInvalidName
 	}
 	return nil