fix issue

app/main.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import os
 import threading
 from contextlib import asynccontextmanager
 from pathlib import Path
@@ -193,7 +194,11 @@ async def health_check():
 @app.get("/data/images/{image_name}", tags=["前端"])
 async def serve_image(image_name: str):
     """访问 images 目录下的图片文件（用于前端预览）"""
-    img_path = settings.images_dir / image_name
+    # 防止路径遍历攻击
+    safe_name = os.path.basename(image_name)
+    if safe_name != image_name or ".." in image_name:
+        return JSONResponse(status_code=400, content={"detail": "非法文件名"})
+    img_path = settings.images_dir / safe_name
     if not img_path.exists():
         return JSONResponse(status_code=404, content={"detail": "图片不存在"})
     return FileResponse(str(img_path))