From 9ac6f47b5e598a0f0d76a5b5b243aca2473a70c8 Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Sun, 30 Aug 2026 20:38:53 +0800
Subject: [PATCH] =?UTF-8?q?=E7=BB=9F=E4=B8=80=E8=AF=81=E4=B9=A6=E5=AF=BC?=
 =?UTF-8?q?=E5=85=A5=E8=B7=AF=E5=BE=84=E8=AF=B7=E6=B1=82=E8=A7=A3=E6=9E=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/httpapi/certificate_api.go   |  3 +--
 .../internal/httpapi/certificate_api_test.go  | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/backend/internal/httpapi/certificate_api.go b/backend/internal/httpapi/certificate_api.go
index 1bdc1a3..7ef44a6 100644
--- a/backend/internal/httpapi/certificate_api.go
+++ b/backend/internal/httpapi/certificate_api.go
@@ -2,7 +2,6 @@ package httpapi
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -173,7 +172,7 @@ func parseCertificateImportRequest(c *gin.Context) (certificate.ImportRequest, f
 		}, cleanup, nil
 	}
 	var body certificatePathRequest
-	if err := json.NewDecoder(c.Request.Body).Decode(&body); err != nil {
+	if err := bindJSON(c, &body, certificateUploadLimit); err != nil {
 		return certificate.ImportRequest{}, cleanup, fmt.Errorf("读取证书路径失败：%w", err)
 	}
 	if strings.TrimSpace(body.CertificatePath) == "" {
diff --git a/backend/internal/httpapi/certificate_api_test.go b/backend/internal/httpapi/certificate_api_test.go
index 40edfc7..4075dd4 100644
--- a/backend/internal/httpapi/certificate_api_test.go
+++ b/backend/internal/httpapi/certificate_api_test.go
@@ -135,3 +135,28 @@ func TestCertificateImportAPIRejectsMissingFiles(t *testing.T) {
 		t.Fatalf("缺少证书路径应返回参数错误：%d %s", response.Code, response.Body.String())
 	}
 }
+
+func TestCertificateImportAPIRejectsInvalidPathJSON(t *testing.T) {
+	server := New(Dependencies{
+		Config:     readyTestConfig(t.TempDir()),
+		Repository: &stubDomainRepository{},
+		ImportCertificate: func(context.Context, certificate.ImportRequest) (certificate.IssueResult, deployment.Report, error) {
+			t.Fatal("无效证书路径请求不应调用导入服务")
+			return certificate.IssueResult{}, deployment.Report{}, nil
+		},
+	})
+
+	tests := []string{
+		`{"certificate_path":"/ssl/cert.pem","private_key_path":"/ssl/key.pem","unexpected":true}`,
+		`{"certificate_path":"/ssl/cert.pem","private_key_path":"/ssl/key.pem"}{"certificate_path":"again"}`,
+	}
+	for _, body := range tests {
+		request := httptest.NewRequest(http.MethodPost, "/api/v1/domains/domain-1/certificate/import", strings.NewReader(body))
+		request.Header.Set("Content-Type", "application/json")
+		response := httptest.NewRecorder()
+		serveAdminHTTP(server, response, request)
+		if response.Code != http.StatusBadRequest {
+			t.Fatalf("无效证书路径请求应返回 400，实际为 %d：%s", response.Code, response.Body.String())
+		}
+	}
+}