fix(server): 契约正则锚点\Z闭合——尾换行脏值不再放行

Co-Authored-By: Claude Code <noreply@anthropic.com>
2026-09-18 22:24:45 +08:00
parent 3b9d8ecee0
commit be0b53bce4
2 changed files with 7 additions and 3 deletions
@@ -124,6 +124,9 @@ def _biz(name, **props):
    (_biz("form_submit_result", form_id="cf7-156", submission_id="", result_code="ok"), "property_not_allowed"),
    (_biz("product_view", product_id="byd-equation-leopard-5", inferred=True, rule_version="v1"), None),
    (_biz("product_view", product_id="x"*101, inferred=True, rule_version="v1"), "property_not_allowed"),
+    # 尾换行脏值：$ 锚匹配串尾换行前，\Z 才是真正串尾——collect 端点公开，须拒
+    (_biz("form_start", form_id="cf7-156\n"), "property_not_allowed"),
+    (_biz("form_submit", form_id="cf7-156", submission_id="9c8b7a6d-1111-4222-8333-444455556666\n"), "property_not_allowed"),
 ])
 def test_biz_event_validation(ev, expect_reason):
    assert validate_event(ev, v2=True, batch_site_id=SITE_ID, batch_visitor_id="v1") == expect_reason