收紧前端隐藏路径访问

backend/internal/httpapi/frontend.go

@@ -33,6 +33,10 @@ func (s *Server) frontend(c *gin.Context) {
 		c.Status(http.StatusNotFound)
 		return
 	}
+	if isHiddenFrontendPath(requestPath) {
+		c.Status(http.StatusNotFound)
+		return
+	}
 
 	staticDir, err := filepath.Abs(s.frontendDir)
 	if err != nil {
@@ -81,6 +85,15 @@ func isCoreRequestPath(path string) bool {
 		strings.HasPrefix(path, "/reset/")
 }
 
+func isHiddenFrontendPath(path string) bool {
+	for _, segment := range strings.Split(strings.Trim(path, "/"), "/") {
+		if strings.HasPrefix(segment, ".") {
+			return true
+		}
+	}
+	return false
+}
+
 func isWithinDirectory(directory, candidate string) bool {
 	relative, err := filepath.Rel(directory, candidate)
 	if err != nil {

backend/internal/httpapi/frontend_test.go

@@ -36,6 +36,9 @@ func TestFrontendServesAssetsAndHistoryRoutes(t *testing.T) {
 		{name: "root", method: http.MethodGet, path: "/", wantStatus: http.StatusOK, wantBody: "Scert"},
 		{name: "history route", method: http.MethodGet, path: "/login", wantStatus: http.StatusOK, wantBody: "Scert"},
 		{name: "asset", method: http.MethodGet, path: "/assets/app.js", wantStatus: http.StatusOK, wantBody: "console.log"},
+		{name: "git metadata", method: http.MethodGet, path: "/.git/config", wantStatus: http.StatusNotFound},
+		{name: "hidden file", method: http.MethodGet, path: "/.env", wantStatus: http.StatusNotFound},
+		{name: "hidden asset", method: http.MethodGet, path: "/assets/.source-map", wantStatus: http.StatusNotFound},
 		{name: "missing asset", method: http.MethodGet, path: "/assets/missing.js", wantStatus: http.StatusNotFound},
 		{name: "unknown api", method: http.MethodGet, path: "/api/unknown", wantStatus: http.StatusNotFound},
 		{name: "post fallback", method: http.MethodPost, path: "/login", wantStatus: http.StatusNotFound},