Merge pull request #800 from kekingcn/release/5.0.3

release: v5.0.3 security fixes and verified deployment
fix: harden every shipped config and isolate archive storage tests
2026-11-11 22:00:44 +00:00 · 2026-10-08 15:52:17 +08:00 · 2026-10-08 15:46:27 +08:00 · 2026-10-08 15:39:17 +08:00 · 2026-10-08 14:17:07 +08:00 · 2026-10-08 14:17:07 +08:00
67 changed files with 2215 additions and 4350 deletions
--- a/.github/scripts/deploy_windows_winrm.py
+++ b/.github/scripts/deploy_windows_winrm.py
@@ -40,6 +40,8 @@ def main() -> int:
        "KK_DEPLOY_MVN_CMD": optional_env("KK_DEPLOY_MVN_CMD", r"C:\kkFileView-tools\maven\bin\mvn.cmd"),
        "KK_DEPLOY_MAVEN_SETTINGS": optional_env("KK_DEPLOY_MAVEN_SETTINGS", ""),
        "KK_DEPLOY_DRY_RUN": optional_env("KK_DEPLOY_DRY_RUN", "false").lower(),
+        "KK_DEPLOY_REVISION": optional_env("KK_DEPLOY_REVISION", ""),
+        "KK_DEPLOY_HARDEN_ACTUATOR": optional_env("KK_DEPLOY_HARDEN_ACTUATOR", "false").lower(),
    }

    script_path = pathlib.Path(__file__).with_name("remote_windows_deploy.ps1")
--- a/.github/scripts/remote_windows_deploy.ps1
+++ b/.github/scripts/remote_windows_deploy.ps1
@@ -41,6 +41,8 @@ $GitExe = Get-OptionalEnv 'KK_DEPLOY_GIT_EXE' 'C:\kkFileView-tools\git\cmd\git.e
 $MvnCmd = Get-OptionalEnv 'KK_DEPLOY_MVN_CMD' 'C:\kkFileView-tools\maven\bin\mvn.cmd'
 $MavenSettings = Get-OptionalEnv 'KK_DEPLOY_MAVEN_SETTINGS' ''
 $DryRun = Get-OptionalEnv 'KK_DEPLOY_DRY_RUN' 'false'
+$ExpectedRevision = Get-OptionalEnv 'KK_DEPLOY_REVISION' ''
+$HardenActuator = (Get-OptionalEnv 'KK_DEPLOY_HARDEN_ACTUATOR' 'false') -eq 'true'

 $BinDir = Join-Path $DeployRoot 'bin'
 $StartupScript = Join-Path $BinDir 'startup.bat'
@@ -202,6 +204,18 @@ function Build-KkFileView {
 }

 Sync-Repository
+if (-not [string]::IsNullOrWhiteSpace($ExpectedRevision)) {
+    if ($ExpectedRevision -notmatch '^[0-9a-f]{40}$') {
+        throw 'Deployment revision must be a full commit SHA'
+    }
+    Invoke-External -FilePath $GitExe -Arguments @('fetch', '--depth', '1', 'origin', $ExpectedRevision) -WorkingDirectory $SourceRoot
+    Invoke-External -FilePath $GitExe -Arguments @('checkout', '--detach', $ExpectedRevision) -WorkingDirectory $SourceRoot
+}
+$SourceRevision = (& $GitExe -C $SourceRoot rev-parse HEAD).Trim()
+if ($LASTEXITCODE -ne 0 -or ($ExpectedRevision -and $SourceRevision -ne $ExpectedRevision)) {
+    throw 'Source revision does not match the requested deployment commit'
+}
+Write-Step "Building source revision: $SourceRevision"
 Build-KkFileView

 $DownloadedJars = Get-ChildItem $BuildOutputDir -Filter 'kkFileView-*.jar' -File
@@ -295,33 +309,118 @@ function Wait-Health {
    return $false
 }

+function Resolve-ActiveConfigPath {
+    param([string[]]$CommandLines, [string]$WorkingDirectory)
+    $Paths = @()
+    foreach ($CommandLine in $CommandLines) {
+        $MatchesFound = [regex]::Matches($CommandLine, '(?:-D|--)spring\.config\.location=(?:"([^"]+)"|([^\s"<>]+))')
+        foreach ($Match in $MatchesFound) {
+            $Value = $Match.Groups[1].Value
+            if (-not $Value) { $Value = $Match.Groups[2].Value }
+            $Value = $Value -replace '^file:', ''
+            if ($Value -match '[,;*?%$]' -or $Value -notmatch '\.properties$') {
+                throw 'Security config migration requires one explicit .properties file'
+            }
+            if (-not [System.IO.Path]::IsPathRooted($Value)) {
+                $Value = Join-Path $WorkingDirectory $Value
+            }
+            $Paths += [System.IO.Path]::GetFullPath($Value)
+        }
+    }
+    $Paths = @($Paths | Select-Object -Unique)
+    if ($Paths.Count -ne 1 -or -not (Test-Path -LiteralPath $Paths[0] -PathType Leaf)) {
+        throw 'Unable to identify a unique active external configuration file'
+    }
+    return $Paths[0]
+}
+
+function Set-SecureActuatorDefaults {
+    param([string]$ConfigPath)
+    # Round-trip unrelated bytes unchanged, regardless of the existing encoding.
+    $Encoding = [System.Text.Encoding]::GetEncoding(28591)
+    $Content = $Encoding.GetString([System.IO.File]::ReadAllBytes($ConfigPath))
+    $NewLine = "`n"
+    if ($Content.Contains("`r`n")) { $NewLine = "`r`n" }
+    foreach ($Entry in @(
+        @('management.endpoints.web.exposure.include', 'health'),
+        @('management.endpoint.health.show-details', 'never')
+    )) {
+        $Pattern = '(?m)^[ \t]*' + [regex]::Escape($Entry[0]) + '[ \t]*[=:][^\r\n]*'
+        $Line = $Entry[0] + ' = ' + $Entry[1]
+        if ([regex]::IsMatch($Content, $Pattern)) {
+            $Content = [regex]::Replace($Content, $Pattern, $Line)
+        } else {
+            $Content += $NewLine + $Line + $NewLine
+        }
+    }
+    [System.IO.File]::WriteAllBytes($ConfigPath, $Encoding.GetBytes($Content))
+}
+
+function Assert-SecureActuatorExposure {
+    param([string]$Url)
+    $HealthEndpoint = [System.Uri]::new([System.Uri]$Url, 'actuator/health').AbsoluteUri
+    $MetricsEndpoint = [System.Uri]::new([System.Uri]$Url, 'actuator/metrics').AbsoluteUri
+    $Health = Invoke-RestMethod -Uri $HealthEndpoint -TimeoutSec 10
+    if ($Health.status -ne 'UP' -or @($Health.PSObject.Properties).Count -ne 1) {
+        throw 'Health endpoint still exposes component details or is unhealthy'
+    }
+    try {
+        $null = Invoke-WebRequest -Uri $MetricsEndpoint -UseBasicParsing -TimeoutSec 10
+        throw 'Metrics endpoint remains publicly exposed'
+    } catch {
+        if (-not $_.Exception.Response -or [int]$_.Exception.Response.StatusCode -ne 404) {
+            throw
+        }
+    }
+    Write-Step 'Security verification passed: aggregate health only; metrics returns 404'
+}
+
+$ActiveConfig = $null
+$BackupConfig = $null
+if ($HardenActuator) {
+    $CommandLines = @(Get-KkFileViewJavaProcesses | ForEach-Object { $_.CommandLine })
+    if ($CommandLines.Count -eq 0) { $CommandLines = @(Get-Content -LiteralPath $StartupScript -Raw) }
+    $ActiveConfig = Resolve-ActiveConfigPath -CommandLines $CommandLines -WorkingDirectory $BinDir
+    $BackupConfig = Join-Path $ReleaseDir ("{0}.{1}.bak" -f [System.IO.Path]::GetFileName($ActiveConfig), $Timestamp)
+    Write-Step "Active configuration: $ActiveConfig"
+    Write-Step "Backing up active configuration to $BackupConfig"
+    Copy-Item -LiteralPath $ActiveConfig -Destination $BackupConfig
+}
+
 Write-Step "Backing up current jar to $BackupJar"
 Copy-Item $JarPath $BackupJar -Force

-Stop-KkFileView
-if (-not (Wait-KkFileViewStopped)) {
-    throw "Timed out waiting for the previous kkFileView process to exit"
-}
-
-Write-Step "Replacing jar with artifact output"
-Copy-Item $DownloadedJar.FullName $JarPath -Force
-
-Start-KkFileView
-
-if (-not (Wait-Health -Url $HealthUrl)) {
-    Write-Step "Health check failed, rolling back"
+try {
    Stop-KkFileView
    if (-not (Wait-KkFileViewStopped)) {
-        throw "Timed out waiting for the failed kkFileView process to exit during rollback"
+        throw "Timed out waiting for the previous kkFileView process to exit"
    }
-    Copy-Item $BackupJar $JarPath -Force
+    if ($HardenActuator) { Set-SecureActuatorDefaults -ConfigPath $ActiveConfig }
+    Write-Step "Replacing jar with artifact output: $($DownloadedJar.Name)"
+    Copy-Item $DownloadedJar.FullName $JarPath -Force
    Start-KkFileView
-
    if (-not (Wait-Health -Url $HealthUrl)) {
-        throw "Deployment failed and rollback health check also failed"
+        throw 'Deployment health check failed'
    }
-
-    throw "Deployment failed, rollback completed successfully"
+    if ($HardenActuator) { Assert-SecureActuatorExposure -Url $HealthUrl }
+} catch {
+    $DeploymentError = $_
+    Write-Step 'Deployment verification failed, restoring jar and configuration'
+    Stop-KkFileView
+    if (-not (Wait-KkFileViewStopped)) { throw 'Unable to stop the failed deployment for rollback' }
+    Copy-Item $BackupJar $JarPath -Force
+    if ($BackupConfig) { Copy-Item -LiteralPath $BackupConfig -Destination $ActiveConfig -Force }
+    Start-KkFileView
+    if (-not (Wait-Health -Url $HealthUrl)) { throw 'Deployment and rollback health checks both failed' }
+    throw "Deployment failed; rollback succeeded: $DeploymentError"
 }

+@{
+    revision = $SourceRevision
+    artifact = $DownloadedJar.Name
+    sha256 = (Get-FileHash -LiteralPath $JarPath -Algorithm SHA256).Hash
+    actuatorHardened = $HardenActuator
+    deployedAt = (Get-Date).ToUniversalTime().ToString('o')
+} | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $DeployRoot 'deployment.json') -Encoding UTF8
+Write-Step "Verified deployed revision: $SourceRevision"
 Write-Step "Deployment completed successfully"
--- a/.github/scripts/test_windows_deploy.ps1
+++ b/.github/scripts/test_windows_deploy.ps1
@@ -0,0 +1,42 @@
+$ErrorActionPreference = 'Stop'
+$Tokens = $null
+$ParseErrors = $null
+$ScriptPath = Join-Path $PSScriptRoot 'remote_windows_deploy.ps1'
+$Ast = [System.Management.Automation.Language.Parser]::ParseFile($ScriptPath, [ref]$Tokens, [ref]$ParseErrors)
+if ($ParseErrors.Count -gt 0) { throw ($ParseErrors | Out-String) }
+foreach ($Name in @('Resolve-ActiveConfigPath', 'Set-SecureActuatorDefaults')) {
+    $FunctionAst = $Ast.Find({ param($Node) $Node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $Node.Name -eq $Name }, $true)
+    if (-not $FunctionAst) { throw "Missing function: $Name" }
+    . ([scriptblock]::Create($FunctionAst.Extent.Text))
+}
+
+$TempRoot = Join-Path ([System.IO.Path]::GetTempPath()) ('kkfileview-deploy-test-' + [guid]::NewGuid().ToString('N'))
+try {
+    $Bin = New-Item -ItemType Directory -Path (Join-Path $TempRoot 'bin')
+    $Config = New-Item -ItemType Directory -Path (Join-Path $TempRoot 'config')
+    $ActiveFile = Join-Path $Config.FullName 'test.properties'
+    $Utf8 = New-Object System.Text.UTF8Encoding($false)
+    $Original = "# Preserve Unicode: 中文`r`ncustom.value = unchanged`r`nmanagement.endpoints.web.exposure.include = health,info,metrics`r`nmanagement.endpoint.health.show-details = always`r`n"
+    [System.IO.File]::WriteAllText($ActiveFile, $Original, $Utf8)
+    $Resolved = Resolve-ActiveConfigPath -CommandLines @('java -Dspring.config.location=..\config\test.properties -jar kkFileView-5.0.jar') -WorkingDirectory $Bin.FullName
+    if ($Resolved -ne $ActiveFile) { throw 'Did not resolve the runtime configuration override' }
+    Set-SecureActuatorDefaults -ConfigPath $Resolved
+    $Expected = $Original.Replace('health,info,metrics', 'health').Replace('show-details = always', 'show-details = never')
+    $Actual = [System.IO.File]::ReadAllText($Resolved, $Utf8)
+    if ($Actual -cne $Expected) { throw 'Migration altered unrelated configuration or missed a security default' }
+    Set-SecureActuatorDefaults -ConfigPath $Resolved
+    if ([System.IO.File]::ReadAllText($Resolved, $Utf8) -cne $Expected) { throw 'Migration is not idempotent' }
+
+    [System.IO.File]::WriteAllText($ActiveFile, 'custom.value = unchanged', $Utf8)
+    Set-SecureActuatorDefaults -ConfigPath $ActiveFile
+    $Actual = [System.IO.File]::ReadAllText($ActiveFile, $Utf8)
+    if ($Actual -notmatch 'management.endpoints.web.exposure.include = health' -or $Actual -notmatch 'management.endpoint.health.show-details = never') {
+        throw 'Missing properties were not added'
+    }
+    $Rejected = $false
+    try { Resolve-ActiveConfigPath -CommandLines @('java -jar app.jar') -WorkingDirectory $Bin.FullName } catch { $Rejected = $true }
+    if (-not $Rejected) { throw 'Unknown active configuration must fail closed' }
+    Write-Host 'Windows deployment syntax and configuration migration tests passed'
+} finally {
+    if (Test-Path $TempRoot) { Remove-Item -LiteralPath $TempRoot -Recurse -Force }
+}
--- a/.github/workflows/master-auto-deploy.yml
+++ b/.github/workflows/master-auto-deploy.yml
@@ -4,6 +4,11 @@ on:
  push:
    branches: [ master ]
  workflow_dispatch:
+    inputs:
+      harden_actuator:
+        description: Apply v5.0.3 monitoring defaults to the active external config
+        type: boolean
+        default: false

 concurrency:
  group: master-auto-deploy-production
@@ -29,6 +34,8 @@ jobs:
      KK_DEPLOY_GIT_EXE: ${{ vars.KK_DEPLOY_GIT_EXE }}
      KK_DEPLOY_MVN_CMD: ${{ vars.KK_DEPLOY_MVN_CMD }}
      KK_DEPLOY_MAVEN_SETTINGS: ${{ vars.KK_DEPLOY_MAVEN_SETTINGS }}
+      KK_DEPLOY_REVISION: ${{ github.sha }}
+      KK_DEPLOY_HARDEN_ACTUATOR: ${{ inputs.harden_actuator || 'false' }}

    steps:
      - name: Checkout repository
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -35,6 +35,18 @@ jobs:
    - name: Build with Maven
      run: mvn -B package "-Dmaven.test.skip=true" --file pom.xml

+    - name: Security regression tests
+      if: runner.os == 'Linux'
+      run: >-
+        mvn -B -pl server
+        -Dtest=FtpCommandSecurityTests,UploadPathSecurityTests,PreviewSourceSecurityTests,PreviewParameterSecurityTests,ArchiveDirectorySecurityTests,ActuatorExposureSecurityTests,ActuatorOverrideExposureSecurityTests,ArchiveTraversalSecurityTests,FileControllerPathSecurityTests,FileControllerDeleteSecurityTests
+        test
+
+    - name: Validate Windows deployment
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: .github/scripts/test_windows_deploy.ps1
+
    - name: Upload Linux distribution package
      if: success() && runner.os == 'Linux'
      uses: actions/upload-artifact@v4
--- a/4
+++ b/4
@@ -1,4 +1,4 @@
 FROM keking/kkfileview-base:5.0.0
 ADD server/target/kkFileView-*.tar.gz /opt/
-ENV KKFILEVIEW_BIN_FOLDER=/opt/kkFileView-5.0.0/bin
-ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-5.0.0/config/application.properties","-jar","/opt/kkFileView-5.0.0/bin/kkFileView-5.0.0.jar"]
+ENV KKFILEVIEW_BIN_FOLDER=/opt/kkFileView-5.0.3/bin
+ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-5.0.3/config/application.properties","-jar","/opt/kkFileView-5.0.3/bin/kkFileView-5.0.3.jar"]
--- a/README.cn.md
+++ b/README.cn.md
@@ -149,6 +149,60 @@ pdf预览模式预览效果如下

 ### 历史更新记录

+#### > 2026年10月08日，v5.0.3 安全补丁版本发布：
+
+#### 安全修复
+1. FTP 连接前校验命令参数，阻止控制字符注入
+2. 上传和建目录限制在演示文件目录内，并检查符号链接
+3. 校验所有预览源地址，阻止通过不同参数绕过信任策略
+4. 预览页码和代理参数经过类型校验后再渲染模板
+5. 在通过校验的压缩包预览中生成目录树，移除公开的 `/directory` 接口
+6. 默认仅开放汇总健康状态，不再默认暴露健康详情、info 和 metrics
+
+#### 升级说明
+1. 建议所有 v5.0.2 及更早版本用户升级至 v5.0.3，继续要求 JDK 21 及以上
+2. 已有外部配置文件需设置 `management.endpoints.web.exposure.include=health` 和 `management.endpoint.health.show-details=never`，才能应用监控配置加固
+3. `/directory` 接口已移除，内置压缩包目录预览继续可用
+4. 上传仍默认禁用；启用后，上传和建目录仅允许演示目录内的路径
+
+#### > 2026年08月14日，v5.0.2 补丁版本发布 ：
+
+#### 安全修复
+1. 将不可信 HTML 预览放入不具有同源权限的 iframe 沙箱，并默认禁用其中的 JavaScript，避免被预览文件在 kkFileView 应用源中执行脚本（GHSA-9wcf-jxxf-w2g2）
+2. 默认禁用演示文件删除接口，将接口改为 POST，并要求显式配置密码后进行精确比较（GHSA-f3qx-xrwc-5428）
+
+#### 修复问题
+1. 在 PDF 转图服务启动时刷新 ImageIO 插件，使 JBIG2 等嵌套 JAR 图像读取器能够被发现，避免 PDF 转图片预览时部分图像丢失
+
+#### 升级说明
+1. 建议所有 v5.0.1 及更早版本用户尽快升级到 v5.0.2
+2. 本版本继续要求 JDK 21 及以上，现有 v5.0.1 配置可直接沿用
+3. 文件删除功能现在默认禁用；如确需启用，请通过 `KK_DELETE_PASSWORD` 或外部 `delete.password` 设置独立强密码，并将 `/deleteFile` 调用改为 POST
+4. `kk.scriptjs` 现在默认为 `false`；显式启用后，脚本仍只会在隔离的 iframe 沙箱内运行
+
+#### > 2026年07月13日，v5.0.1 补丁版本发布 ：
+
+#### 安全修复
+1. 修复 `/addTask` 未经过信任主机和本地目录过滤，可能导致服务端请求伪造（SSRF）的问题（GHSA-gwwj-52hv-6g2m）
+2. 修复 `/listFiles` 的 `directory` 参数可越出演示目录，造成路径遍历和目录信息泄露的问题（GHSA-pmp8-g8p2-p6jq）
+
+#### 修复问题
+1. 修复 PDF 跨域、页码定位、文本高亮、打印和打印水印相关问题
+2. 修复 PDF 在反向代理场景下的绝对路径问题，以及水印和高亮内容包含特殊字符时的解析失败
+3. 修复 Redis 单机、集群、主从、哨兵模式配置不一致和地址协议缺失问题
+4. 修复下载 MIME 类型校验失败后仍返回成功、HTTP 错误原因不明确，以及共享 HTTP Client 被错误关闭的问题
+5. 修复 LuckyExcel 数据校验类型未映射时的 xlsx 解析崩溃
+
+#### 优化内容
+1. 大型 xlsx 文件改用 Web Worker 执行 LuckyExcel 解析，并在 Worker 不可用或异常时自动回退主线程
+2. 新增 `pdf.sidebar.open` 配置，可控制 PDF 预览是否默认打开侧栏
+3. Maven CI 增加 Linux、Windows、macOS 构建验证
+4. 新增仓库安全策略和私密漏洞报告入口
+
+#### 升级说明
+1. 建议所有 v5.0.0 及更早版本用户尽快升级到 v5.0.1
+2. 本版本继续要求 JDK 21 及以上，现有 v5.0.0 配置可直接沿用
+
 #### > 2026年04月14日，v5.0.0 版本发布 ：
 #### 优化内容
 1. xlsx 前端解析优化 - 提升Excel文件前端渲染性能
--- a/README.md
+++ b/README.md
@@ -65,6 +65,60 @@ URL：[https://file.kkview.cn](https://file.kkview.cn)

 ## Change History

+### Version 5.0.3 (October 8, 2026)
+
+#### Security Fixes
+1. Reject control characters in FTP command arguments before connecting
+2. Confine uploads and folder creation to demo storage, including symbolic-link checks
+3. Validate every preview source URL to prevent parameter-confusion bypasses of trust policies
+4. Validate page and agent parameters before rendering preview templates
+5. Render archive directory trees within the validated preview flow and remove the public `/directory` endpoint
+6. Expose only aggregate health status by default; detailed health, info, and metrics are no longer public defaults
+
+#### Upgrade Notes
+1. All v5.0.2 and earlier users should upgrade to v5.0.3; JDK 21 or higher remains required
+2. Existing external configuration files must set `management.endpoints.web.exposure.include=health` and `management.endpoint.health.show-details=never` to apply the monitoring hardening
+3. The `/directory` endpoint is removed; the built-in archive preview remains supported
+4. Uploads remain disabled by default. Enabled uploads and folder creation accept only paths beneath demo storage
+
+### Version 5.0.2 (August 14, 2026)
+
+#### Security Fixes
+1. Sandboxed untrusted HTML previews in an opaque-origin iframe and disabled embedded JavaScript by default, preventing previewed files from executing in the kkFileView application origin (GHSA-9wcf-jxxf-w2g2)
+2. Disabled the demo file deletion endpoint by default, changed it to POST, and required an explicitly configured password with exact comparison (GHSA-f3qx-xrwc-5428)
+
+#### Fixes
+1. Refreshed ImageIO plugins when PDF conversion starts so nested JAR providers such as the JBIG2 reader are discovered, preventing images from disappearing in PDF-to-image previews
+
+#### Upgrade Notes
+1. All users running v5.0.1 or earlier are strongly encouraged to upgrade to v5.0.2
+2. JDK 21 or higher remains required, and existing v5.0.1 configuration can be reused
+3. File deletion is now disabled unless `KK_DELETE_PASSWORD` or an external `delete.password` is set to an independent strong password; integrations must call `/deleteFile` with POST
+4. `kk.scriptjs` now defaults to `false`; when explicitly enabled, scripts still run only inside the isolated iframe sandbox
+
+### Version 5.0.1 (July 13, 2026)
+
+#### Security Fixes
+1. Fixed `/addTask` bypassing trusted-host and local-directory filters, which could allow server-side request forgery (SSRF) (GHSA-gwwj-52hv-6g2m)
+2. Fixed the `/listFiles` `directory` parameter escaping the demo directory, which could allow path traversal and directory information disclosure (GHSA-pmp8-g8p2-p6jq)
+
+#### Fixes
+1. Fixed PDF cross-origin access, page positioning, text highlighting, printing, and print watermark issues
+2. Fixed PDF absolute paths behind reverse proxies and parsing failures when watermark or highlight text contains special characters
+3. Fixed inconsistent Redis settings across standalone, cluster, master-replica, and sentinel modes, including missing address protocols
+4. Fixed successful responses after MIME validation failures, unclear HTTP error reporting, and accidental closure of a shared HTTP client
+5. Fixed xlsx parsing crashes when LuckyExcel data-validation types have no mapping
+
+#### Improvements
+1. Moved LuckyExcel parsing for large xlsx files into a Web Worker, with automatic main-thread fallback when the Worker is unavailable or fails
+2. Added `pdf.sidebar.open` to control whether the PDF sidebar opens by default
+3. Added Linux, Windows, and macOS validation to Maven CI
+4. Added a repository security policy and private vulnerability reporting guidance
+
+#### Upgrade Notes
+1. All users running v5.0.0 or earlier are strongly encouraged to upgrade to v5.0.1
+2. JDK 21 or higher remains required, and existing v5.0.0 configuration can be reused
+
 ### Version 5.0.0 (April 14, 2026)

 #### Improvements
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,66 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are handled for the latest released version of kkFileView and the
+current `master` branch. Older versions may be evaluated case by case, but users
+are encouraged to upgrade to the latest release before reporting or verifying a
+security issue.
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities privately through GitHub Private
+Vulnerability Reporting:
+
+https://github.com/kekingcn/kkFileView/security/advisories/new
+
+Do not publish vulnerability details, proof-of-concept code, exploit steps,
+sensitive logs, or private deployment information in public GitHub issues,
+discussions, pull requests, or comments.
+
+When reporting a vulnerability, please include as much of the following
+information as you can safely share:
+
+- Affected kkFileView version or commit
+- Deployment mode, operating system, JDK version, and related middleware
+- Clear reproduction steps
+- Impact assessment and affected feature or endpoint
+- Sanitized logs, screenshots, or sample files if they are required to reproduce
+  the issue
+- Whether the issue is already being disclosed elsewhere
+
+The maintainers will review private reports, ask for additional information when
+needed, coordinate a fix, and publish disclosure information when appropriate.
+
+If the private reporting link is unavailable, please open a public issue only to
+request a private contact channel, without including technical vulnerability
+details.
+
+---
+
+# 安全策略
+
+## 支持版本
+
+kkFileView 安全修复主要覆盖最新发布版本和当前 `master` 分支。旧版本问题会视影响范围和维护成本单独评估，但建议用户优先升级到最新版本后再验证或报告安全问题。
+
+## 报告安全漏洞
+
+请通过 GitHub Private Vulnerability Reporting 私密提交安全漏洞：
+
+https://github.com/kekingcn/kkFileView/security/advisories/new
+
+请不要在公开 GitHub issue、discussion、pull request 或评论中发布漏洞细节、PoC、利用步骤、敏感日志或私有部署信息。
+
+提交漏洞时，请在可安全分享的前提下尽量提供以下信息：
+
+- 受影响的 kkFileView 版本或提交
+- 部署方式、操作系统、JDK 版本和相关中间件信息
+- 清晰的复现步骤
+- 影响范围，以及受影响的功能或接口
+- 复现所需的脱敏日志、截图或样例文件
+- 该问题是否已在其他渠道披露
+
+维护者会在私密渠道中评估报告，在需要时继续确认细节，协调修复，并在适当时发布披露信息。
+
+如果私密报告链接不可用，请只在公开 issue 中请求私密联系方式，不要包含任何技术漏洞细节。
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@

    <groupId>cn.keking</groupId>
    <artifactId>kkFileView-parent</artifactId>
-    <version>5.0.0</version>
+    <version>5.0.3</version>

    <properties>
        <!-- ========== Java 和编译配置 ========== -->
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -6,7 +6,7 @@
    <parent>
        <artifactId>kkFileView-parent</artifactId>
        <groupId>cn.keking</groupId>
-        <version>5.0.0</version>
+        <version>5.0.3</version>
    </parent>

    <artifactId>kkFileView</artifactId>
@@ -91,17 +91,33 @@
                    <artifactId>poi</artifactId>
                    <groupId>org.apache.poi</groupId>
                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.poi</groupId>
+                    <artifactId>ooxml-schemas</artifactId>
+                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>fr.opensagres.xdocreport</groupId>
            <artifactId>org.apache.poi.xwpf.converter.xhtml</artifactId>
            <version>${xdocreport.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.poi</groupId>
+                    <artifactId>ooxml-schemas</artifactId>
+                </exclusion>
+            </exclusions>
        </dependency>
        <dependency>
            <groupId>fr.opensagres.xdocreport</groupId>
            <artifactId>fr.opensagres.xdocreport.document</artifactId>
            <version>${xdocreport.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.poi</groupId>
+                    <artifactId>ooxml-schemas</artifactId>
+                </exclusion>
+            </exclusions>
        </dependency>
        <dependency>
            <groupId>com.aspose</groupId>
--- a/server/src/main/config/application.properties
+++ b/server/src/main/config/application.properties
@@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request
 spring.freemarker.suffix = .ftl

 # Spring Boot Actuator监控端点配置
-management.endpoints.web.exposure.include = health,info,metrics
-management.endpoint.health.show-details = always
+management.endpoints.web.exposure.include = health
+management.endpoint.health.show-details = never
 management.health.defaults.enabled = true


@@ -408,8 +408,9 @@ home.pagesize = ${DEFAULT_HOME_PAGSIZE:20}
 # 启用后删除文件需要输入验证码，防止误删
 delete.captcha = ${KK_DELETE_CAPTCHA:false}

-# 删除文件密码，默认为123456
-delete.password = ${KK_DELETE_PASSWORD:123456}
+# 删除文件密码，默认为false（禁用删除接口）
+# 如需启用删除功能，请通过环境变量或外部配置设置独立的强密码
+delete.password = ${KK_DELETE_PASSWORD:false}

 # 是否删除转换后的源文件，默认为true（删除）
 # 启用可节约磁盘空间，但会丢失原始文件
@@ -469,8 +470,8 @@ kk.xlsxshowtoolbar = false
 # 首页是否显示key密钥 默认为false（禁用）
 kk.isshowkey = false

-# 预览html文件 是否启用JavaScript 默认为true（启用）
-kk.scriptjs = true
+# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用）
+kk.scriptjs = false


 ###############################################################################
--- a/server/src/main/config/test.properties
+++ b/server/src/main/config/test.properties
@@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request
 spring.freemarker.suffix = .ftl

 # Spring Boot Actuator监控端点配置
-management.endpoints.web.exposure.include = health,info,metrics
-management.endpoint.health.show-details = always
+management.endpoints.web.exposure.include = health
+management.endpoint.health.show-details = never
 management.health.defaults.enabled = true


@@ -405,8 +405,8 @@ home.pagesize = ${DEFAULT_HOME_PAGSIZE:20}
 # 启用后删除文件需要输入验证码，防止误删
 delete.captcha = ${KK_DELETE_CAPTCHA:false}

-# 删除文件密码，默认为123456
-delete.password = ${KK_DELETE_PASSWORD:123456}
+# 删除文件密码，默认为false（禁用删除接口）
+delete.password = ${KK_DELETE_PASSWORD:false}

 # 是否删除转换后的源文件，默认为true（删除）
 # 启用可节约磁盘空间，但会丢失原始文件
@@ -466,8 +466,8 @@ kk.xlsxshowtoolbar = true
 # 首页是否显示key密钥 默认为false（禁用）
 kk.isshowkey = true

-# 预览html文件 是否启用JavaScript 默认为true（启用）
-kk.scriptjs = true
+# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用）
+kk.scriptjs = false


 ###############################################################################
@@ -475,4 +475,4 @@ kk.scriptjs = true
 ###############################################################################

 # 纯文本文件类型，直接显示
-simText = ${KK_SIMTEXT:txt,html,htm,asp,jsp,xml,json,properties,md,gitignore,log,java,py,c,cpp,sql,sh,bat,m,bas,prg,cmd}
+simText = ${KK_SIMTEXT:txt,html,htm,asp,jsp,xml,json,properties,md,gitignore,log,java,py,c,cpp,sql,sh,bat,m,bas,prg,cmd}
--- a/server/src/main/java/cn/keking/config/ConfigConstants.java
+++ b/server/src/main/java/cn/keking/config/ConfigConstants.java
@@ -31,7 +31,7 @@ public class ConfigConstants {
    // ==================================================
    public static final String DEFAULT_VALUE = "default";
    public static final String DEFAULT_SHOW_AES_KEY = "1234567890123456";
-    public static final String DEFAULT_PASSWORD = "123456";
+    public static final String DEFAULT_PASSWORD = "false";
    public static final String DEFAULT_SIZE = "500MB";
    public static final String DEFAULT_ENABLE_REFRECSHSCHEDULE = "5";
    public static final String DEFAULT_IS_JAVASCRIPT = "false";
@@ -664,7 +664,7 @@ public class ConfigConstants {
    public void setSize(String size) { setSizeValue(size); }
    public static void setSizeValue(String size) { ConfigConstants.size = size; }

-    @Value("${delete.password:123456}")
+    @Value("${delete.password:false}")
    public void setPassword(String password) { setPasswordValue(password); }
    public static void setPasswordValue(String password) { ConfigConstants.password = password; }

--- a/server/src/main/java/cn/keking/service/CompressFileReader.java
+++ b/server/src/main/java/cn/keking/service/CompressFileReader.java
@@ -35,13 +35,13 @@ import java.util.List;
@Component
 public class CompressFileReader {
    private final FileHandlerService fileHandlerService;
-    private static final String fileDir = ConfigConstants.getFileDir();

    public CompressFileReader(FileHandlerService fileHandlerService) {
        this.fileHandlerService = fileHandlerService;
    }

    public String unRar(String filePath, String filePassword, String fileName, FileAttribute fileAttribute) throws Exception {
+        String fileDir = ConfigConstants.getFileDir();
        List<String> imgUrls = new ArrayList<>();
        String baseUrl = BaseUrlFilter.getBaseUrl();
        String packagePath = "_";
--- a/server/src/main/java/cn/keking/service/PdfToJpgService.java
+++ b/server/src/main/java/cn/keking/service/PdfToJpgService.java
@@ -18,6 +18,7 @@ import org.springframework.stereotype.Component;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.ObjectUtils;

+import javax.imageio.ImageIO;
 import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.IOException;
@@ -93,6 +94,8 @@ public class PdfToJpgService {

    @PostConstruct
    public void init() {
+        refreshImageIoPlugins();
+
        int maxThreads = ConfigConstants.getPdfMaxThreads();
        // 使用固定大小的虚拟线程池
        this.virtualThreadExecutor = Executors.newFixedThreadPool(maxThreads,
@@ -104,6 +107,13 @@ public class PdfToJpgService {
        scheduleCacheCleanup();
    }

+    static void refreshImageIoPlugins() {
+        // ImageIO only scans once automatically. If another launcher or Java agent initializes
+        // it before Spring Boot installs its application class loader, nested JAR providers such
+        // as jbig2-imageio remain invisible until the application class path is scanned again.
+        ImageIO.scanForPlugins();
+    }
+
    @PreDestroy
    public void shutdown() {
        logger.info("开始关闭PDF转换服务...");
@@ -852,4 +862,4 @@ public class PdfToJpgService {
    }


-}
+}
--- a/server/src/main/java/cn/keking/service/cache/impl/CacheServiceRedisImpl.java
+++ b/server/src/main/java/cn/keking/service/cache/impl/CacheServiceRedisImpl.java
@@ -1,12 +1,14 @@
 package cn.keking.service.cache.impl;

 import cn.keking.service.cache.CacheService;
+import org.apache.commons.lang3.StringUtils;
 import org.redisson.api.RBlockingQueue;
 import org.redisson.api.RMapCache;
 import org.redisson.api.RedissonClient;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
 import org.springframework.stereotype.Service;

+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;

@@ -68,6 +70,9 @@ public class CacheServiceRedisImpl implements CacheService {

    @Override
    public List<String> getImgCache(String key) {
+        if (StringUtils.isEmpty(key)) {
+            return new ArrayList<>();
+        }
        RMapCache<String, List<String>> convertedList = redissonClient.getMapCache(FILE_PREVIEW_IMGS_KEY);
        return convertedList.get(key);
    }
--- a/server/src/main/java/cn/keking/service/impl/CompressFilePreviewImpl.java
+++ b/server/src/main/java/cn/keking/service/impl/CompressFilePreviewImpl.java
@@ -8,6 +8,8 @@ import cn.keking.utils.DownloadUtils;
 import cn.keking.service.FileHandlerService;
 import cn.keking.service.CompressFileReader;
 import cn.keking.utils.KkFileUtils;
+import cn.keking.utils.RarUtils;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.apache.poi.EncryptedDocumentException;
 import org.slf4j.Logger;
@@ -78,6 +80,12 @@ public class CompressFilePreviewImpl implements FilePreview {
        }
        model.addAttribute("fileName", fileName);
        model.addAttribute("fileTree", fileTree);
+        try {
+            model.addAttribute("archiveTreeJson", new ObjectMapper().writeValueAsString(RarUtils.getTree(fileTree)));
+        } catch (IOException | SecurityException e) {
+            logger.warn("Unable to read the previewed archive directory", e);
+            return otherFilePreview.notSupportedFile(model, fileAttribute, "该压缩包目录无法读取!");
+        }
        return COMPRESS_FILE_PREVIEW_PAGE;
    }
 }
--- a/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java
+++ b/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java
@@ -75,11 +75,11 @@ public class OfficeFilePreviewImpl implements FilePreview {
        if (!officePreviewType.equalsIgnoreCase("html")) {
            if (ConfigConstants.getOfficeTypeWeb().equalsIgnoreCase("web")) {
                if (suffix.equalsIgnoreCase("xlsx")) {
-                    model.addAttribute("pdfUrl", KkFileUtils.htmlEscape(url)); //特殊符号处理
+                    model.addAttribute("pdfUrl", url); //模板使用 ?js_string 按 JavaScript 字符串上下文转义
                    return XLSX_FILE_PREVIEW_PAGE;
                }
                if (suffix.equalsIgnoreCase("csv")) {
-                    model.addAttribute("csvUrl", KkFileUtils.htmlEscape(url));
+                    model.addAttribute("csvUrl", url);
                    return CSV_FILE_PREVIEW_PAGE;
                }
            }
--- a/server/src/main/java/cn/keking/utils/FtpUtils.java
+++ b/server/src/main/java/cn/keking/utils/FtpUtils.java
@@ -154,9 +154,22 @@ public class FtpUtils {
        } catch (URISyntaxException e) {
            throw new IOException("无效的FTP URL: " + ftpUrl, e);
        }
+        // URI#getPath decodes percent escapes. Validate the values actually
+        // sent as FTP command arguments, before opening any connection.
+        validateCommandArgument(info.remoteFilePath);
+        validateCommandArgument(info.username);
+        validateCommandArgument(info.password);
+        validateCommandArgument(new String(info.remoteFilePath.getBytes(info.controlEncoding),
+                StandardCharsets.ISO_8859_1));
        return info;
    }

+    private static void validateCommandArgument(String value) throws IOException {
+        if (value != null && value.chars().anyMatch(c -> c < 0x20 || c == 0x7f)) {
+            throw new IOException("FTP command arguments must not contain control characters");
+        }
+    }
+
    /**
     * FTP连接信息对象
     */
--- a/server/src/main/java/cn/keking/utils/RarUtils.java
+++ b/server/src/main/java/cn/keking/utils/RarUtils.java
@@ -5,6 +5,12 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.LinkOption;
+import java.nio.file.DirectoryStream;
 import java.io.UnsupportedEncodingException;
 import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
@@ -19,7 +25,6 @@ import java.util.regex.Pattern;
 **/
 public class RarUtils {
    private static final Logger logger = LoggerFactory.getLogger(RarUtils.class);
-    private static final String fileDir = ConfigConstants.getFileDir();

    public static byte[] getUTF8BytesFromGBKString(String gbkStr) {
        int n = gbkStr.length();
@@ -108,30 +113,40 @@ public class RarUtils {
    /**
     * 读取文件目录树
     */
-    public static List<ZtreeNodeVo> getTree(String rootPath) {
-        List<ZtreeNodeVo> nodes = new ArrayList<>();
-        File file = new File(fileDir+rootPath);
-        ZtreeNodeVo node = traverse(file);
-        nodes.add(node);
-        return nodes;
-    }
-    private static ZtreeNodeVo traverse(File file) {
-        ZtreeNodeVo pathNodeVo = new ZtreeNodeVo();
-        pathNodeVo.setId(file.getAbsolutePath().replace(fileDir, "").replace("\\", "/"));
-        pathNodeVo.setName(file.getName());
-        pathNodeVo.setPid(file.getParent().replace(fileDir, "").replace("\\", "/"));
-        if (file.isDirectory()) {
-            List<ZtreeNodeVo> subNodeVos = new ArrayList<>();
-            File[] subFiles = file.listFiles();
-            if (subFiles == null) {
-                return pathNodeVo;
-            }
-            for (File subFile : subFiles) {
-                ZtreeNodeVo subNodeVo = traverse(subFile);
-                subNodeVos.add(subNodeVo);
-            }
-            pathNodeVo.setChildren(subNodeVos);
+    public static List<ZtreeNodeVo> getTree(String rootPath) throws IOException {
+        Path fileRoot = Paths.get(ConfigConstants.getFileDir()).toRealPath();
+        Path archiveRoot = fileRoot.resolve(rootPath).normalize();
+        if (archiveRoot.equals(fileRoot) || !archiveRoot.startsWith(fileRoot)) {
+            throw new SecurityException("Only an individual archive directory may be listed");
        }
-        return pathNodeVo;
+        archiveRoot = archiveRoot.toRealPath();
+        if (archiveRoot.equals(fileRoot) || !archiveRoot.startsWith(fileRoot) || !Files.isDirectory(archiveRoot)) {
+            throw new SecurityException("Archive directory escapes file storage");
+        }
+        return List.of(traverse(archiveRoot, fileRoot, archiveRoot));
+    }
+
+    private static ZtreeNodeVo traverse(Path file, Path fileRoot, Path archiveRoot) throws IOException {
+        ZtreeNodeVo node = new ZtreeNodeVo();
+        node.setId(fileRoot.relativize(file).toString().replace('\\', '/'));
+        node.setName(file.getFileName().toString());
+        node.setPid(file.equals(archiveRoot) ? "" : fileRoot.relativize(file.getParent()).toString().replace('\\', '/'));
+        if (Files.isDirectory(file, LinkOption.NOFOLLOW_LINKS)) {
+            List<ZtreeNodeVo> children = new ArrayList<>();
+            try (DirectoryStream<Path> entries = Files.newDirectoryStream(file)) {
+                for (Path child : entries) {
+                    // Do not follow links into other cached documents or outside storage.
+                    if (Files.isSymbolicLink(child)) {
+                        continue;
+                    }
+                    if (Files.isRegularFile(child, LinkOption.NOFOLLOW_LINKS)
+                            || Files.isDirectory(child, LinkOption.NOFOLLOW_LINKS)) {
+                        children.add(traverse(child, fileRoot, archiveRoot));
+                    }
+                }
+            }
+            node.setChildren(children);
+        }
+        return node;
    }
 }
--- a/server/src/main/java/cn/keking/utils/WebUtils.java
+++ b/server/src/main/java/cn/keking/utils/WebUtils.java
@@ -241,32 +241,50 @@ public class WebUtils {
     * @return url
     */
    public static String getSourceUrl(ServletRequest request) {
-        String url = request.getParameter("url");
-        String urls = request.getParameter("urls");
-        String currentUrl = request.getParameter("currentUrl");
-        String urlPath = request.getParameter("urlPath");
+        List<String> urls = getSourceUrls(request);
+        return urls.isEmpty() ? null : urls.get(0);
+    }
+
+    /** Validate every candidate consumed by preview endpoints, including all images. */
+    public static List<String> getSourceUrls(ServletRequest request) {
+        List<String> urls = new ArrayList<>();
        String encryption = request.getParameter("encryption");
-        if (StringUtils.isNotBlank(url)) {
-            return decodeUrl(url,encryption);
+        try {
+            for (String name : List.of("url", "currentUrl", "urlPath", "urls")) {
+                String[] values = request.getParameterValues(name);
+                if (values == null) {
+                    continue;
+                }
+                for (String value : values) {
+                    if (StringUtils.isBlank(value)) {
+                        continue;
+                    }
+                    // picturesPreview decodes currentUrl as Base64 independently of encryption.
+                    String decoded = "currentUrl".equals(name)
+                            ? decodeBase64String(value, StandardCharsets.UTF_8) : decodeUrl(value, encryption);
+                    if (decoded == null) {
+                        return List.of("");
+                    }
+                    if ("urls".equals(name)) {
+                        urls.addAll(Arrays.asList(decoded.split("\\|", -1)));
+                    } else {
+                        urls.add(decoded);
+                    }
+                }
+            }
+        } catch (RuntimeException e) {
+            return List.of("");
        }
-        if (StringUtils.isNotBlank(currentUrl)) {
-            return decodeUrl(currentUrl,encryption);
-        }
-        if (StringUtils.isNotBlank(urlPath)) {
-            return decodeUrl(urlPath,encryption);
-        }
-        if (StringUtils.isNotBlank(urls)) {
-            urls = decodeUrl(urls,encryption);
-            String[] images = urls.split("\\|");
-            return images[0];
-        }
-        return null;
+        return urls;
    }
    /**
     *  判断地址是否正确
     * 高 2022/12/17
     */
    public static boolean isValidUrl(String url) {
+        if (url == null) {
+            return false;
+        }
        String regStr = "^((https|http|ftp|rtsp|mms|file)://)";//[.?*]表示匹配的就是本身
        Pattern pattern = Pattern.compile(regStr);
        Matcher matcher = pattern.matcher(url);
@@ -350,10 +368,13 @@ public class WebUtils {
     * @return host
     */
    public static String getHost(String urlStr) {
+        if (urlStr == null) {
+            return null;
+        }
        try {
-            URL url = new URL(urlStr);
-            return url.getHost().toLowerCase();
-        } catch (MalformedURLException ignored) {
+            URL url = normalizedURL(urlStr);
+            return url.getHost().toLowerCase(Locale.ROOT);
+        } catch (GalimatiasParseException | MalformedURLException | IllegalArgumentException ignored) {
        }
        return null;
    }
--- a/server/src/main/java/cn/keking/web/controller/FileController.java
+++ b/server/src/main/java/cn/keking/web/controller/FileController.java
@@ -6,11 +6,11 @@ import cn.keking.model.ReturnResponse;
 import cn.keking.utils.CaptchaUtil;
 import cn.keking.utils.DateUtils;
 import cn.keking.utils.KkFileUtils;
-import cn.keking.utils.RarUtils;
 import cn.keking.utils.WebUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.util.ObjectUtils;
+import org.springframework.util.StringUtils;
 import org.springframework.util.StreamUtils;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -28,10 +28,16 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.nio.file.DirectoryStream;
+import java.nio.file.FileAlreadyExistsException;
+import java.nio.file.LinkOption;
+import java.nio.file.StandardOpenOption;
 import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 import java.util.*;

 import static cn.keking.utils.CaptchaUtil.CAPTCHA_CODE;
@@ -150,29 +156,24 @@ public class FileController {
    @PostMapping("/fileUpload")
    public ReturnResponse<Object> fileUpload(@RequestParam("file") MultipartFile file,
                                             @RequestParam(value = "path", defaultValue = "") String path) {
-        ReturnResponse<Object> checkResult = this.fileUploadCheck(file, path);
+        ReturnResponse<Object> checkResult = this.fileUploadCheck(file);
        if (checkResult.isFailure()) {
            return checkResult;
        }

-        String uploadPath = fileDir + demoPath;
-        if (!ObjectUtils.isEmpty(path)) {
-            uploadPath += path + File.separator;
-        }
-
-        File outFile = new File(uploadPath);
-        if (!outFile.exists() && !outFile.mkdirs()) {
-            logger.error("创建文件夹【{}】失败，请检查目录权限！", uploadPath);
-            return ReturnResponse.failure("创建文件夹失败，请检查目录权限！");
-        }
-
        String fileName = checkResult.getContent().toString();
-        logger.info("上传文件：{}{}", uploadPath, fileName);
-
-        try (InputStream in = file.getInputStream();
-             OutputStream out = Files.newOutputStream(Paths.get(uploadPath + fileName))) {
-            StreamUtils.copy(in, out);
+        try {
+            Path target = createUploadDirectory(path).resolve(fileName);
+            try (InputStream in = file.getInputStream();
+                 OutputStream out = Files.newOutputStream(target, StandardOpenOption.CREATE_NEW,
+                         StandardOpenOption.WRITE, LinkOption.NOFOLLOW_LINKS)) {
+                StreamUtils.copy(in, out);
+            }
            return ReturnResponse.success(null);
+        } catch (FileAlreadyExistsException e) {
+            return ReturnResponse.failure("存在同名文件，请先删除原有文件再次上传");
+        } catch (SecurityException | InvalidPathException e) {
+            return ReturnResponse.failure("非法目录路径");
        } catch (IOException e) {
            logger.error("文件上传失败", e);
            return ReturnResponse.failure("文件上传失败");
@@ -191,33 +192,52 @@ public class FileController {
                return ReturnResponse.failure("文件夹名称不能为空");
            }

-            if (KkFileUtils.isIllegalFileName(folderName)) {
+            if (KkFileUtils.isIllegalFileName(folderName) || folderName.contains("/")
+                    || folderName.contains("\\") || folderName.contains(":")
+                    || folderName.indexOf('\0') >= 0 || folderName.endsWith(".") || folderName.endsWith(" ")) {
                return ReturnResponse.failure("非法文件夹名称");
            }
-            String basePath = fileDir + demoPath;
-            if (!ObjectUtils.isEmpty(path)) {
-                basePath += path + File.separator;
-            }
-
-            File newFolder = new File(basePath + folderName);
-            if (newFolder.exists()) {
-                return ReturnResponse.failure("文件夹已存在");
-            }
-
-            if (newFolder.mkdirs()) {
-                logger.info("创建文件夹：{}", newFolder.getAbsolutePath());
-                return ReturnResponse.success();
-            } else {
-                logger.error("创建文件夹失败：{}", newFolder.getAbsolutePath());
-                return ReturnResponse.failure("创建文件夹失败，请检查目录权限");
-            }
+            Files.createDirectory(createUploadDirectory(path).resolve(folderName));
+            return ReturnResponse.success();
+        } catch (FileAlreadyExistsException e) {
+            return ReturnResponse.failure("文件夹已存在");
+        } catch (SecurityException | InvalidPathException e) {
+            return ReturnResponse.failure("非法目录路径");
        } catch (Exception e) {
            logger.error("创建文件夹异常", e);
-            return ReturnResponse.failure("创建文件夹失败：" + e.getMessage());
+            return ReturnResponse.failure("创建文件夹失败");
        }
    }

-    @GetMapping("/deleteFile")
+    /** Create only relative upload directories, without following symbolic links. */
+    private Path createUploadDirectory(String requestedPath) throws IOException {
+        String value = requestedPath == null ? "" : requestedPath.replace('\\', '/');
+        if (value.startsWith("/") || value.indexOf(':') >= 0 || value.indexOf('\0') >= 0) {
+            throw new SecurityException("Absolute paths are not allowed");
+        }
+        Path relative = Paths.get(value);
+        for (Path segment : relative) {
+            String name = segment.toString();
+            if ("..".equals(name) || (!".".equals(name) && (name.endsWith(".") || name.endsWith(" ")))) {
+                throw new SecurityException("Parent path segments are not allowed");
+            }
+        }
+        Path root = Files.createDirectories(Paths.get(fileDir)).toRealPath();
+        Path current = root;
+        for (Path segment : Paths.get(demoDir).resolve(relative).normalize()) {
+            current = current.resolve(segment);
+            try {
+                Files.createDirectory(current);
+            } catch (FileAlreadyExistsException e) {
+                if (!Files.isDirectory(current, LinkOption.NOFOLLOW_LINKS)) {
+                    throw new SecurityException("Upload directory must not be a symbolic link or file");
+                }
+            }
+        }
+        return current;
+    }
+
+    @PostMapping("/deleteFile")
    public ReturnResponse<Object> deleteFile(HttpServletRequest request, String fileName, String password) {
        ReturnResponse<Object> checkResult = this.deleteFileCheck(request, fileName, password);
        if (checkResult.isFailure()) {
@@ -341,13 +361,23 @@ public class FileController {
            }

            // ==================== 2. 构建路径和验证 ====================
-            String basePath = fileDir + demoPath;
-            if (!ObjectUtils.isEmpty(path)) {
-                basePath += path + File.separator;
+            Path currentDir;
+            try {
+                currentDir = resolveDirectoryUnderRoot(Paths.get(fileDir, demoDir), path);
+            } catch (InvalidPathException | SecurityException e) {
+                logger.warn("拒绝访问 demo 目录之外的文件列表路径");
+                result.put("total", 0);
+                result.put("data", Collections.emptyList());
+                result.put("error", "非法目录路径");
+                return result;
+            } catch (IOException e) {
+                logger.error("解析 demo 目录失败", e);
+                result.put("total", 0);
+                result.put("data", Collections.emptyList());
+                return result;
            }

-            File currentDir = new File(basePath);
-            if (!currentDir.exists() || !currentDir.isDirectory()) {
+            if (!Files.isDirectory(currentDir)) {
                result.put("total", 0);
                result.put("data", Collections.emptyList());
                return result;
@@ -357,13 +387,13 @@ public class FileController {
            List<Path> allPaths = new ArrayList<>();
            long collectStartTime = System.currentTimeMillis();

-            try (DirectoryStream<Path> stream = Files.newDirectoryStream(Paths.get(basePath))) {
+            try (DirectoryStream<Path> stream = Files.newDirectoryStream(currentDir)) {
                for (Path entry : stream) {
                    allPaths.add(entry);
                    stats.incrementFileCount();
                }
            } catch (IOException e) {
-                logger.error("读取目录失败: {}", basePath, e);
+                logger.error("读取目录失败: {}", currentDir, e);
                result.put("total", 0);
                result.put("data", Collections.emptyList());
                return result;
@@ -492,6 +522,46 @@ public class FileController {
        return result;
    }

+    /**
+     * Resolve an existing directory below the configured demo root.
+     *
+     * <p>Both lexical normalization and real-path checks are required: the
+     * former blocks traversal and absolute paths, while the latter prevents a
+     * symlink inside the demo directory from escaping the configured root.</p>
+     */
+    static Path resolveDirectoryUnderRoot(Path root, String requestedPath) throws IOException {
+        Path normalizedRoot = root.toAbsolutePath().normalize();
+        String relativePath = requestedPath == null ? "" : requestedPath.replace('\\', '/');
+
+        if (relativePath.indexOf('\0') >= 0
+                || relativePath.startsWith("/")
+                || relativePath.matches("^[A-Za-z]:.*")) {
+            throw new SecurityException("Absolute paths are not allowed");
+        }
+
+        Path relative = Paths.get(relativePath);
+        if (relative.isAbsolute()) {
+            throw new SecurityException("Absolute paths are not allowed");
+        }
+        for (Path segment : relative) {
+            if ("..".equals(segment.toString())) {
+                throw new SecurityException("Parent path segments are not allowed");
+            }
+        }
+
+        Path resolved = normalizedRoot.resolve(relative).normalize();
+        if (!resolved.startsWith(normalizedRoot)) {
+            throw new SecurityException("Path escapes the configured root");
+        }
+
+        Path realRoot = normalizedRoot.toRealPath();
+        Path realResolved = resolved.toRealPath();
+        if (!realResolved.startsWith(realRoot)) {
+            throw new SecurityException("Path escapes the configured root through a symbolic link");
+        }
+        return realResolved;
+    }
+
    /**
     * 构建性能统计信息
     */
@@ -668,7 +738,7 @@ public class FileController {
    /**
     * 上传文件前校验
     */
-    private ReturnResponse<Object> fileUploadCheck(MultipartFile file, String path) {
+    private ReturnResponse<Object> fileUploadCheck(MultipartFile file) {
        if (ConfigConstants.getFileUploadDisable()) {
            return ReturnResponse.failure("文件上传接口已禁用");
        }
@@ -680,7 +750,8 @@ public class FileController {
        if (!KkFileUtils.isAllowedUpload(fileName)) {
            return ReturnResponse.failure("不允许上传的文件类型: " + fileName);
        }
-        if (KkFileUtils.isIllegalFileName(fileName)) {
+        if (KkFileUtils.isIllegalFileName(fileName) || fileName.contains(":") || fileName.indexOf('\0') >= 0
+                || fileName.endsWith(".") || fileName.endsWith(" ")) {
            return ReturnResponse.failure("不允许上传的文件名: " + fileName);
        }
        FileType type = FileType.typeFromFileName(fileName);
@@ -688,11 +759,6 @@ public class FileController {
            return ReturnResponse.failure("该文件格式还不支持预览，请联系管理员，添加该格式: " + fileName);
        }

-        // 判断是否存在同名文件
-        if (existsFile(fileName, path)) {
-            return ReturnResponse.failure("存在同名文件，请先删除原有文件再次上传");
-        }
-
        return ReturnResponse.success(fileName);
    }

@@ -724,11 +790,22 @@ public class FileController {
            return ReturnResponse.failure("密码 or 验证码为空，删除失败！");
        }

-        String expectedPassword = ConfigConstants.getDeleteCaptcha() ?
+        boolean captchaEnabled = ConfigConstants.getDeleteCaptcha();
+        String expectedPassword = captchaEnabled ?
                WebUtils.getSessionAttr(request, CAPTCHA_CODE) :
                ConfigConstants.getPassword();

-        if (!password.equalsIgnoreCase(expectedPassword)) {
+        if (!captchaEnabled && (!StringUtils.hasText(expectedPassword)
+                || "false".equalsIgnoreCase(expectedPassword))) {
+            return ReturnResponse.failure("文件删除接口已禁用，请先配置 delete.password");
+        }
+
+        if (!StringUtils.hasText(expectedPassword)) {
+            return ReturnResponse.failure("验证码已失效，请刷新后重试！");
+        }
+
+        if (!MessageDigest.isEqual(password.getBytes(StandardCharsets.UTF_8),
+                expectedPassword.getBytes(StandardCharsets.UTF_8))) {
            logger.error("删除文件【{}】失败，密码错误！", fileName);
            return ReturnResponse.failure("删除文件失败，密码错误！");
        }
@@ -736,28 +813,4 @@ public class FileController {
        return ReturnResponse.success(fileName);
    }

-    @GetMapping("/directory")
-    public Object directory(String urls) {
-        String fileUrl;
-        try {
-            fileUrl = WebUtils.decodeUrl(urls,"base64");
-        } catch (Exception ex) {
-            String errorMsg = String.format(BASE64_DECODE_ERROR_MSG, "url");
-            return ReturnResponse.failure(errorMsg);
-        }
-        fileUrl = fileUrl.replaceAll("http://", "");
-        if (KkFileUtils.isIllegalFileName(fileUrl)) {
-            return ReturnResponse.failure("不允许访问的路径:");
-        }
-        return RarUtils.getTree(fileUrl);
-    }
-
-    private boolean existsFile(String fileName, String path) {
-        String fullPath = fileDir + demoPath;
-        if (!ObjectUtils.isEmpty(path)) {
-            fullPath += path + File.separator;
-        }
-        File file = new File(fullPath + fileName);
-        return file.exists();
-    }
-}
+}
--- a/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java
+++ b/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java
@@ -86,8 +86,8 @@ public class OnlinePreviewController {

        highlightall= KkFileUtils.htmlEscape(highlightall);
        model.addAttribute("highlightall", highlightall);
-        model.addAttribute("page", page);
-        model.addAttribute("kkagent", kkagent);
+        model.addAttribute("page", normalizePage(page));
+        model.addAttribute("kkagent", Boolean.toString(Boolean.parseBoolean(kkagent)));
        model.addAttribute("file", fileAttribute);
        FilePreview filePreview = previewFactory.get(fileAttribute);
        logger.info("预览文件url：{}，previewType：{}", fileUrl, fileAttribute.getType());
@@ -98,6 +98,17 @@ public class OnlinePreviewController {
        return filePreview.filePreviewHandle(fileUrl, model, fileAttribute);  //统一在这里处理 url
    }

+    private static String normalizePage(String page) {
+        if (page != null && page.matches("[0-9]{1,10}")) {
+            try {
+                return Integer.toString(Integer.parseInt(page));
+            } catch (NumberFormatException ignored) {
+                // Out-of-range values use the same default as missing values.
+            }
+        }
+        return "0";
+    }
+
    @GetMapping( "/picturesPreview")
    public String picturesPreview(@RequestParam String urls,
                                  @RequestParam(required = false) String key,
@@ -287,4 +298,4 @@ public class OnlinePreviewController {
        cacheService.addQueueTask(fileUrls);
        return "success";
    }
-}
+}
--- a/server/src/main/java/cn/keking/web/filter/TrustDirFilter.java
+++ b/server/src/main/java/cn/keking/web/filter/TrustDirFilter.java
@@ -13,6 +13,7 @@ import org.springframework.util.FileCopyUtils;
 import org.springframework.util.StringUtils;

 import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletResponse;

 import java.io.File;
 import java.io.IOException;
@@ -20,6 +21,7 @@ import java.net.URL;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
 import java.util.Locale;
+import java.util.List;

 /**
 * @author : kl (http://kailing.pub)
@@ -45,9 +47,12 @@ public class TrustDirFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
-        String url = WebUtils.getSourceUrl(request);
-        if (!allowPreview(url)) {
-            response.getWriter().write(this.notTrustDirView);
+        List<String> urls = WebUtils.getSourceUrls(request);
+        if (urls.isEmpty() || urls.stream().anyMatch(url -> !allowPreview(url))) {
+            if (response instanceof HttpServletResponse httpResponse) {
+                httpResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
+            }
+            response.getWriter().write(this.notTrustDirView == null ? "Forbidden" : this.notTrustDirView);
            response.getWriter().close();
        } else {
            chain.doFilter(request, response);
@@ -61,7 +66,7 @@ public class TrustDirFilter implements Filter {

    private boolean allowPreview(String urlPath) {
        // 判断URL是否合法
-        if (KkFileUtils.isIllegalFileName(urlPath) || !StringUtils.hasText(urlPath) || !WebUtils.isValidUrl(urlPath)) {
+        if (!StringUtils.hasText(urlPath) || KkFileUtils.isIllegalFileName(urlPath) || !WebUtils.isValidUrl(urlPath)) {
            return false;
        }
        try {
--- a/server/src/main/java/cn/keking/web/filter/TrustHostFilter.java
+++ b/server/src/main/java/cn/keking/web/filter/TrustHostFilter.java
@@ -5,6 +5,7 @@ import cn.keking.utils.WebUtils;

 import java.io.IOException;
 import java.util.Map;
+import java.util.List;
 import java.util.Locale;
 import java.util.concurrent.ConcurrentHashMap;
 import java.nio.charset.StandardCharsets;
@@ -48,9 +49,12 @@ public class TrustHostFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
-        String url = WebUtils.getSourceUrl(request);
-        String host = WebUtils.getHost(url);
-        if (isNotTrustHost(host) || !WebUtils.isValidUrl(url)) {
+        List<String> urls = WebUtils.getSourceUrls(request);
+        String rejectedUrl = urls.stream()
+                .filter(url -> !WebUtils.isValidUrl(url) || isNotTrustHost(WebUtils.getHost(url)))
+                .findFirst().orElse(null);
+        if (urls.isEmpty() || rejectedUrl != null) {
+            String host = rejectedUrl == null ? null : WebUtils.getHost(rejectedUrl);
            String currentHost = host == null ? "UNKNOWN" : host;
            if (response instanceof HttpServletResponse httpServletResponse) {
                httpServletResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
--- a/server/src/main/resources/static/ofd/js/cnofd.umd.min.js
+++ b/server/src/main/resources/static/ofd/js/cnofd.umd.min.js
--- a/server/src/main/resources/static/pdfjs/web/viewer.mjs
+++ b/server/src/main/resources/static/pdfjs/web/viewer.mjs
@@ -1,5 +1,18 @@
 var kkhighlightAll;
 var watermarkTxt;
+var watermarkSettings = {
+    start_x: 80,
+    start_y: 80,
+    x_space: 80,
+    y_space: 80,
+    color: 'black',
+    alpha: 0.2,
+    fontsize: '18px',
+    font: '微软雅黑',
+    width: 200,
+    height: 80,
+    angle: 30
+};
 const queryString = document.location.search.substring(1);
 const params = (0, parseQueryString)(queryString);

@@ -13,6 +26,30 @@ if (kkpdfAutoFetch == "true") {
 function isNotEmpty(value) {
  return value !== null && value !== undefined && value !== '' && value !== 'false' ;
 }
+
+function getWatermarkStringParam(params, name, fallback) {
+    const value = params.get(name);
+    return isNotEmpty(value) ? value : fallback;
+}
+
+function getWatermarkNumberParam(params, name, fallback, isValid) {
+    const rawValue = params.get(name);
+    if (!isNotEmpty(rawValue)) return fallback;
+    const value = Number(rawValue);
+    return Number.isFinite(value) && isValid(value) ? value : fallback;
+}
+
+function configureWatermark(params) {
+    watermarkSettings.x_space = getWatermarkNumberParam(params, "watermarkxspace", watermarkSettings.x_space, value => value >= 0);
+    watermarkSettings.y_space = getWatermarkNumberParam(params, "watermarkyspace", watermarkSettings.y_space, value => value >= 0);
+    watermarkSettings.font = getWatermarkStringParam(params, "watermarkfont", watermarkSettings.font);
+    watermarkSettings.fontsize = getWatermarkStringParam(params, "watermarkfontsize", watermarkSettings.fontsize);
+    watermarkSettings.color = getWatermarkStringParam(params, "watermarkcolor", watermarkSettings.color);
+    watermarkSettings.alpha = getWatermarkNumberParam(params, "watermarkalpha", watermarkSettings.alpha, value => value >= 0 && value <= 1);
+    watermarkSettings.width = getWatermarkNumberParam(params, "watermarkwidth", watermarkSettings.width, value => value > 0);
+    watermarkSettings.height = getWatermarkNumberParam(params, "watermarkheight", watermarkSettings.height, value => value > 0);
+    watermarkSettings.angle = getWatermarkNumberParam(params, "watermarkangle", watermarkSettings.angle, Number.isFinite);
+}
 /**
 * 通用水印生成函数
 * @param {HTMLElement} container   - 水印容器（相对定位的父元素）
@@ -23,20 +60,7 @@ function isNotEmpty(value) {
 function addWatermark(container, watermarkTxt, explicitWidth = null, explicitHeight = null) {
    if (!isNotEmpty(watermarkTxt)) return;

-    // 公共配置
-    const settings = {
-        start_x: 80,
-        start_y: 80,
-        x_space: 80,
-        y_space: 80,
-        color: 'black',
-        alpha: 0.2,
-        fontsize: '18px',
-        font: '微软雅黑',
-        width: 200,
-        height: 80,
-        angle: 30
-    };
+    const settings = watermarkSettings;

    // 确定实际使用的宽高
    let pageWidth, pageHeight;
@@ -55,30 +79,30 @@ function addWatermark(container, watermarkTxt, explicitWidth = null, explicitHei
    maxY = Math.max(maxY, 250);

    const fragment = document.createDocumentFragment();
-    for (let x = settings.start_x; x < maxX; x += settings.x_space) {
-        for (let y = settings.start_y; y < maxY; y += settings.y_space) {
+    const xStep = settings.width + settings.x_space;
+    const yStep = settings.height + settings.y_space;
+    for (let x = settings.start_x; x < maxX; x += xStep) {
+        for (let y = settings.start_y; y < maxY; y += yStep) {
            const div = document.createElement('div');
            div.className = 'mask_div';
            div.appendChild(document.createTextNode(watermarkTxt));
-            div.style.cssText = `
-                filter: progid:DXImageTransform.Microsoft.Alpha(opacity=${settings.alpha * 100});
-                transform: rotate(-${settings.angle}deg);
-                visibility: visible;
-                position: absolute;
-                left: ${x}px;
-                top: ${y}px;
-                overflow: hidden;
-                z-index: 100;
-                pointer-events: none;
-                opacity: ${settings.alpha};
-                font-size: ${settings.fontsize};
-                font-family: ${settings.font};
-                color: ${settings.color};
-                text-align: center;
-                width: ${settings.width}px;
-                height: ${settings.height}px;
-                display: block;
-            `;
+            div.style.filter = `progid:DXImageTransform.Microsoft.Alpha(opacity=${settings.alpha * 100})`;
+            div.style.transform = `rotate(-${settings.angle}deg)`;
+            div.style.visibility = 'visible';
+            div.style.position = 'absolute';
+            div.style.left = `${x}px`;
+            div.style.top = `${y}px`;
+            div.style.overflow = 'hidden';
+            div.style.zIndex = '100';
+            div.style.pointerEvents = 'none';
+            div.style.opacity = settings.alpha;
+            div.style.fontSize = settings.fontsize;
+            div.style.fontFamily = settings.font;
+            div.style.color = settings.color;
+            div.style.textAlign = 'center';
+            div.style.width = `${settings.width}px`;
+            div.style.height = `${settings.height}px`;
+            div.style.display = 'block';
            fragment.appendChild(div);
        }
    }
@@ -22069,7 +22093,8 @@ const PDFViewerApplication = {
    disableBookmark = params.get("disablebookmark") ?? 'false';
    disableEditing = params.get("disableediting") ?? 'false';
    kkhighlightAll = params.get("pdfhighlightall") ?? 'false';
-    watermarkTxt= params.get('watermarktxt') ?? 'false';
+    watermarkTxt = params.get('watermarktxt') ?? 'false';
+    configureWatermark(params);
    try {
      file = new URL(file).href;
    } catch {
@@ -24017,4 +24042,4 @@ if (document.readyState === "interactive" || document.readyState === "complete")

 export { PDFViewerApplication, AppConstants as PDFViewerApplicationConstants, AppOptions as PDFViewerApplicationOptions };

-//# sourceMappingURL=viewer.mjs.map
+//# sourceMappingURL=viewer.mjs.map
--- a/server/src/main/resources/web/bpmn.ftl
+++ b/server/src/main/resources/web/bpmn.ftl
@@ -41,7 +41,7 @@
    const viewer = new BpmnJS({
        container: '#diagram'
    });
-	var url = '${finalUrl}';
+	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/code.ftl
+++ b/server/src/main/resources/web/code.ftl
@@ -16,6 +16,22 @@
    <script src="js/jsformat.js" type="text/javascript"></script>
    </#if>
    <script src="js/base64.min.js" type="text/javascript"></script>
+    <style>
+        #htmlPreviewFrame {
+            width: 100%;
+            min-height: 65vh;
+            border: 0;
+            background: #fff;
+        }
+        #htmlSource {
+            min-height: 65vh;
+            overflow: auto;
+            border: 0;
+            background: #fff;
+            white-space: pre-wrap;
+            word-break: break-word;
+        }
+    </style>
 </head>
 <body>
 <input hidden id="textData" value="${textData}"/>
@@ -25,7 +41,7 @@
    <div class="panel panel-default">
        <div class="panel-heading"> 
            <h4 class="panel-title"> 
-                <strong><font color="red"><input class="GLOkBtn" type="button" value="运行html" onclick="loadXmlData();" /></font></strong>
+                <strong><font color="red"><input class="GLOkBtn" type="button" value="在沙箱中运行html" onclick="loadXmlData();" /></font></strong>
                <a data-toggle="collapse" data-parent="#accordion" onclick="loadText();">
                    ${file.name}   
                </a>
@@ -39,58 +55,43 @@
 <script>
    // 将Freemarker的布尔值传递给JavaScript
    var scriptjs = ${scriptjs?c}; // ?c 将布尔值转换为字符串true/false
+
+    function decodePreviewText() {
+        var escapedText = Base64.decode($("#textData").val());
+        var decoder = document.createElement("textarea");
+        decoder.innerHTML = escapedText;
+        return decoder.value;
+    }
+
+    function replacePreviewContent(element) {
+        var container = document.getElementById("text");
+        while (container.firstChild) {
+            container.removeChild(container.firstChild);
+        }
+        container.appendChild(element);
+    }
    
    /**
     *加载普通文本
     */
    function loadText() {
-        var base64data = $("#textData").val()
-        var div = document.getElementById("text");
-        div.innerHTML = ""; //
-        var textData = Base64.decode(base64data);
-        textData = htmlttt(textData,1);
-        var textPreData = "<xmp style='background-color: #FFFFFF;overflow-y: scroll;border:none'>" + textData + "</xmp>";
-        $("#text").append(textPreData);
+        var source = document.createElement("pre");
+        source.id = "htmlSource";
+        source.textContent = decodePreviewText();
+        replacePreviewContent(source);
    }
    
-    function htmlttt (str,txt){ 
-        var s = "";
-        if(str.length == 0) return "";
-        s = str.replace(/&amp;/gi,"&");
-        s = s.replace(/&lt;/gi,"<");
-        s = s.replace(/&gt;/gi,">");
-        s = s.replace(/&nbsp;/gi," ");
-        s = s.replace(/&#39;/gi,"\'");
-        s = s.replace(/&quot;/gi,"\""); 
-        s = s.replace(/javascript/g,"javascript ");
-        if (txt === 2){
-            s = s.replace(/<script/gi, "&lt;script ");
-            s = s.replace(/javascript/g,"javascript ");
-            s = s.replace(/<\/script/gi, "&lt;/script ");
-            s = s.replace(/<iframe/gi, "&lt;iframe ");
-            s = s.replace(/<\/iframe/gi, "&lt;/iframe ");
-            s = s.replace(/confirm/gi, "c&onfirm");
-            s = s.replace(/alert/gi, "a&lert");
-            s = s.replace(/eval/gi, "e&val");
-        }
-        return s;  
-    } 
-    
    /**
     *加载运行
     */
    function loadXmlData() {
-        var base64data = $("#textData").val();
-        var textData = Base64.decode(base64data);
-        
-        // 直接使用JavaScript变量进行判断
-        if (scriptjs) {
-            textData = htmlttt(textData, 1);
-        } else {
-            textData = htmlttt(textData, 2);
-        }
-        
-        $('#text').html(textData);
+        var frame = document.createElement("iframe");
+        frame.id = "htmlPreviewFrame";
+        frame.title = "HTML sandbox preview";
+        frame.setAttribute("sandbox", scriptjs ? "allow-scripts" : "");
+        frame.setAttribute("referrerpolicy", "no-referrer");
+        frame.srcdoc = decodePreviewText();
+        replacePreviewContent(frame);
    }
    
    /**
@@ -141,4 +142,4 @@
 </script>
 </#if>
 </body>
-</html>
+</html>
--- a/server/src/main/resources/web/compress.ftl
+++ b/server/src/main/resources/web/compress.ftl
@@ -944,22 +944,10 @@
    }

    function loadTree() {
-        var url = "http://" + '${fileTree}';
        setTreeStatus("目录加载中", "is-loading");
        treeSummaryEl.textContent = "正在准备目录结构...";
        showTreeState("loading");
-        $.ajax({
-            type: "get",
-            url: "${baseUrl}directory?urls=" + encodeURIComponent(Base64.encode(url)),
-            success: function (res) {
-                initTree(res);
-            },
-            error: function () {
-                showTreeState("error");
-                setTreeStatus("目录加载失败", "is-error");
-                treeSummaryEl.textContent = "目录读取失败，请重试。";
-            }
-        });
+        initTree(JSON.parse('${archiveTreeJson?js_string}'));
    }

    document.getElementById("retryTree").addEventListener("click", function () {
--- a/server/src/main/resources/web/csv.ftl
+++ b/server/src/main/resources/web/csv.ftl
@@ -35,7 +35,7 @@ var process_wb = (function() {
    if(typeof console !== 'undefined') console.log("output", new Date());
  };
 })();
- var url = '${finalUrl}';
+ var url = '${finalUrl?js_string}';
 var kkagent = '${kkagent}';
 var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/dcm.ftl
+++ b/server/src/main/resources/web/dcm.ftl
@@ -54,7 +54,7 @@
        <script src="dcm/index.umd.js"></script>

        <script>
-       var url = '${finalUrl}';
+       var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/drawio.ftl
+++ b/server/src/main/resources/web/drawio.ftl
@@ -16,7 +16,7 @@
    <#assign finalUrl="${baseUrl}${currentUrl}">
 </#if>
  <script>
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/eml.ftl
+++ b/server/src/main/resources/web/eml.ftl
@@ -19,7 +19,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-   	var url = '${finalUrl}';
+   	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/epub.ftl
+++ b/server/src/main/resources/web/epub.ftl
@@ -25,7 +25,7 @@
  <div id="next" class="arrow">›</div>
 </body>
 <script type="text/javascript">
- 	var url = '${finalUrl}';
+ 	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/main/index.ftl
+++ b/server/src/main/resources/web/main/index.ftl
@@ -369,8 +369,8 @@
        $("#deleteCaptchaConfirmBtn").click(function() {
            var fileName = $("#deleteCaptchaFileName").val();
            var deleteCaptchaText = $("#deleteCaptchaText").val();
-            $.get('${baseUrl}deleteFile?fileName=' + fileName +'&password=' + deleteCaptchaText, function(data){
-                if ("删除文件失败，密码错误！" === data.msg) {
+            $.post('${baseUrl}deleteFile', {fileName: fileName, password: deleteCaptchaText}, function(data){
+                if (!data.success) {
                    alert(data.msg);
                } else {
                    $('#table').bootstrapTable("refresh", {});
@@ -392,11 +392,16 @@
        function deleteFile(fileName, isFolder) {
            var message = isFolder ? '你确定要删除这个文件夹吗？（包含所有子文件）' : '你确定要删除这个文件吗？';
            if (window.confirm(message)) {
-                password = prompt("请输入默认密码:123456");
+                var password = prompt("请输入文件删除密码");
+                if (password === null) {
+                    return false;
+                }
                $.ajax({
-                    url: '${baseUrl}deleteFile?fileName=' + fileName +'&password='+password,
+                    url: '${baseUrl}deleteFile',
+                    type: 'POST',
+                    data: {fileName: fileName, password: password},
                    success: function (data) {
-                        if ("删除文件失败，密码错误！" === data.msg) {
+                        if (!data.success) {
                            alert(data.msg);
                        } else {
                            $("#table").bootstrapTable("refresh", {});
--- a/server/src/main/resources/web/main/record.ftl
+++ b/server/src/main/resources/web/main/record.ftl
@@ -41,10 +41,10 @@
                    你可以先看最新版本的升级重点，再顺着时间轴继续了解历史版本细节。
                </p>
                <div class="release-badge-row">
-                    <span class="tag highlight">最新版本 v5.0.0</span>
-                    <span class="tag brand">发布日期 2026-04-14</span>
+                    <span class="tag highlight">最新版本 v5.0.3</span>
+                    <span class="tag brand">发布日期 2026-10-08</span>
                    <span class="tag warn">JDK 21+ 强制要求</span>
-                    <span class="tag">压缩包工作区预览 / PDF 默认模式</span>
+                    <span class="tag">安全补丁 / FTP、文件路径、预览与监控加固</span>
                </div>
            </div>
        </section>
@@ -52,11 +52,120 @@
        <section class="release-section">
            <div class="timeline-year">2026</div>
            <div class="timeline-list">
+                <article class="release-card">
+                    <h3>v5.0.3</h3>
+                    <div class="release-meta">
+                        <span class="tag brand">2026-10-08</span>
+                        <span class="tag highlight">最新稳定版本</span>
+                        <span class="tag warn">建议尽快升级</span>
+                    </div>
+                    <div class="release-columns">
+                        <div class="release-group">
+                            <h4>安全修复</h4>
+                            <ul class="release-list">
+                                <li>校验 FTP 命令参数，限制上传和建目录路径。</li>
+                                <li>校验所有预览源地址，以及页码和代理参数。</li>
+                                <li>压缩包目录树改由通过校验的预览生成，移除公开的目录枚举接口。</li>
+                                <li>监控默认仅开放汇总健康状态。</li>
+                            </ul>
+                        </div>
+                        <div class="release-group">
+                            <h4>升级重点</h4>
+                            <ul class="release-list">
+                                <li>建议 v5.0.2 及更早版本用户升级，继续要求 JDK 21 及以上。</li>
+                                <li>已有外部配置需将 <code>management.endpoints.web.exposure.include</code> 设为 <code>health</code>，将 <code>management.endpoint.health.show-details</code> 设为 <code>never</code>。</li>
+                                <li><code>/directory</code> 接口已移除，内置压缩包预览继续可用。</li>
+                            </ul>
+                        </div>
+                    </div>
+                </article>
+
+                <article class="release-card">
+                    <h3>v5.0.2</h3>
+                    <div class="release-meta">
+                        <span class="tag brand">2026-08-14</span>
+                        <span class="tag">上一补丁版本</span>
+                        <span class="tag warn">建议尽快升级</span>
+                    </div>
+                    <div class="release-columns">
+                        <div class="release-group">
+                            <h4>安全修复</h4>
+                            <ul class="release-list">
+                                <li>HTML 文件改在不具有同源权限的 iframe 沙箱中预览，并默认禁用 JavaScript。</li>
+                                <li>文件删除接口默认禁用，改用 POST，并要求显式配置密码后进行精确比较。</li>
+                            </ul>
+                        </div>
+                        <div class="release-group">
+                            <h4>修复</h4>
+                            <ul class="release-list">
+                                <li>刷新 ImageIO 插件，修复 PDF 转图片预览时 JBIG2 等图像读取器未被发现导致的图片丢失。</li>
+                            </ul>
+                        </div>
+                        <div class="release-group">
+                            <h4>配置调整</h4>
+                            <ul class="release-list">
+                                <li><code>delete.password</code> 默认改为 <code>false</code>。</li>
+                                <li><code>kk.scriptjs</code> 默认改为 <code>false</code>，启用后仍保持沙箱隔离。</li>
+                            </ul>
+                        </div>
+                        <div class="release-group">
+                            <h4>升级重点</h4>
+                            <ul class="release-list">
+                                <li>建议所有 v5.0.1 及更早版本用户尽快升级。</li>
+                                <li>继续要求 JDK 21 及以上，现有配置可直接沿用。</li>
+                                <li>如需删除功能，请配置独立强密码，并将调用方式改为 POST。</li>
+                            </ul>
+                        </div>
+                    </div>
+                </article>
+
+                <article class="release-card">
+                    <h3>v5.0.1</h3>
+                    <div class="release-meta">
+                        <span class="tag brand">2026-07-13</span>
+                        <span class="tag">上一补丁版本</span>
+                        <span class="tag warn">建议尽快升级</span>
+                    </div>
+                    <div class="release-columns">
+                        <div class="release-group">
+                            <h4>安全修复</h4>
+                            <ul class="release-list">
+                                <li>修复 <code>/addTask</code> 未覆盖信任主机和本地目录过滤导致的 SSRF 风险。</li>
+                                <li>修复 <code>/listFiles</code> 可越出演示目录导致的路径遍历和目录信息泄露。</li>
+                            </ul>
+                        </div>
+                        <div class="release-group">
+                            <h4>修复</h4>
+                            <ul class="release-list">
+                                <li>修复 PDF 跨域、页码、高亮、打印、打印水印及反向代理路径问题。</li>
+                                <li>修复 Redis 多种运行模式的配置兼容问题。</li>
+                                <li>修复 HTTP 错误处理、共享 Client 生命周期和 xlsx 数据校验解析问题。</li>
+                            </ul>
+                        </div>
+                        <div class="release-group">
+                            <h4>优化</h4>
+                            <ul class="release-list">
+                                <li>大型 xlsx 文件使用 Web Worker 解析，并保留主线程自动回退。</li>
+                                <li>新增 <code>pdf.sidebar.open</code>，支持配置 PDF 默认侧栏状态。</li>
+                                <li>Maven CI 增加 Linux、Windows、macOS 构建验证。</li>
+                            </ul>
+                        </div>
+                        <div class="release-group">
+                            <h4>升级重点</h4>
+                            <ul class="release-list">
+                                <li>建议所有 v5.0.0 及更早版本用户尽快升级。</li>
+                                <li>继续要求 JDK 21 及以上。</li>
+                                <li>现有 v5.0.0 配置可直接沿用。</li>
+                            </ul>
+                        </div>
+                    </div>
+                </article>
+
                <article class="release-card">
                    <h3>v5.0.0</h3>
                    <div class="release-meta">
                        <span class="tag brand">2026-04-14</span>
-                        <span class="tag highlight">最新稳定版本</span>
+                        <span class="tag">5.0 功能版本</span>
                        <span class="tag warn">升级需 JDK 21+</span>
                    </div>
                    <div class="release-columns">
--- a/server/src/main/resources/web/msg.ftl
+++ b/server/src/main/resources/web/msg.ftl
@@ -17,7 +17,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-   	var url = '${finalUrl}';
+   	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/ofd.ftl
+++ b/server/src/main/resources/web/ofd.ftl
@@ -17,7 +17,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     
--- a/server/src/main/resources/web/officeweb.ftl
+++ b/server/src/main/resources/web/officeweb.ftl
@@ -22,23 +22,23 @@
     * 初始化水印
     */
    function initWaterMark() {
-        let watermarkTxt = '${watermarkTxt}';
+        let watermarkTxt = '${watermarkTxt!''}';
        if (watermarkTxt !== '') {
            watermark.init({
-                watermark_txt: '${watermarkTxt}',
+                watermark_txt: '${watermarkTxt!''}',
                watermark_x: 0,
                watermark_y: 0,
                watermark_rows: 0,
                watermark_cols: 0,
-                watermark_x_space: ${watermarkXSpace},
-                watermark_y_space: ${watermarkYSpace},
-                watermark_font: '${watermarkFont}',
-                watermark_fontsize: '${watermarkFontsize}',
-                watermark_color: '${watermarkColor}',
-                watermark_alpha: ${watermarkAlpha},
-                watermark_width: ${watermarkWidth},
-                watermark_height: ${watermarkHeight},
-                watermark_angle: ${watermarkAngle},
+                watermark_x_space: ${watermarkXSpace!'10'},
+                watermark_y_space: ${watermarkYSpace!'10'},
+                watermark_font: '${watermarkFont!'微软雅黑'}',
+                watermark_fontsize: '${watermarkFontsize!'18px'}',
+                watermark_color: '${watermarkColor!'black'}',
+                watermark_alpha: ${watermarkAlpha!'0.2'},
+                watermark_width: ${watermarkWidth!'240'},
+                watermark_height: ${watermarkHeight!'80'},
+                watermark_angle: ${watermarkAngle!'10'},
            });
        }
    }
@@ -157,7 +157,7 @@
        window.location.href=test;
    }

-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
   	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/online3D.ftl
+++ b/server/src/main/resources/web/online3D.ftl
@@ -20,7 +20,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
    var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/pdf.ftl
+++ b/server/src/main/resources/web/pdf.ftl
@@ -46,14 +46,25 @@
 </#if>

 <script type="text/javascript">
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
    var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
        url = baseUrl + 'getCorsFile?urlPath=' + encodeURIComponent(Base64.encode(url)) + "&key=${kkkey}";
    }
    var viewerUrl = baseUrl + "pdfjs/web/viewer.html?file=" + encodeURIComponent(url);
-	var watermarkEncoded = encodeURIComponent('${watermarkTxt?js_string}');
+    var watermarkParams = {
+        watermarktxt: '${watermarkTxt?js_string}',
+        watermarkxspace: '${watermarkXSpace?js_string}',
+        watermarkyspace: '${watermarkYSpace?js_string}',
+        watermarkfont: '${watermarkFont?js_string}',
+        watermarkfontsize: '${watermarkFontsize?js_string}',
+        watermarkcolor: '${watermarkColor?js_string}',
+        watermarkalpha: '${watermarkAlpha?js_string}',
+        watermarkwidth: '${watermarkWidth?js_string}',
+        watermarkheight: '${watermarkHeight?js_string}',
+        watermarkangle: '${watermarkAngle?js_string}'
+    };
    var highlightEncoded = encodeURIComponent('${highlightall?js_string}');
    viewerUrl += "&disablepresentationmode=${pdfPresentationModeDisable}";
    viewerUrl += "&disableopenfile=${pdfOpenFileDisable}";
@@ -61,7 +72,9 @@
    viewerUrl += "&disabledownload=${pdfDownloadDisable}";
    viewerUrl += "&disablebookmark=${pdfBookmarkDisable}";
    viewerUrl += "&disableediting=${pdfDisableEditing}";
-    viewerUrl += "&watermarktxt=" + watermarkEncoded;
+    Object.keys(watermarkParams).forEach(function (name) {
+        viewerUrl += "&" + name + "=" + encodeURIComponent(watermarkParams[name]);
+    });
    viewerUrl += "&pdfhighlightall=" + highlightEncoded;
    viewerUrl += "#page=${page}";   // ?c 确保数字不包含千位分隔符
 <#if "true" == pdfSidebarOpen>
--- a/server/src/main/resources/web/picture.ftl
+++ b/server/src/main/resources/web/picture.ftl
@@ -58,6 +58,17 @@
        });
    }
    
+    // 从原始图片 URL 提取文件名（优先用 data-original-url，避免受反代 / CORS 代理 URL 影响）
+    function getImageNameFromOriginalUrl(imageElement) {
+        var originalUrl = imageElement.getAttribute('data-original-url') || '';
+        // 去除查询串与锚点
+        var noQuery = originalUrl.split('?')[0].split('#')[0];
+        // 取路径最后一段作为文件名（兼容 / 与 \）
+        var lastSep = Math.max(noQuery.lastIndexOf('/'), noQuery.lastIndexOf('\\'));
+        var name = lastSep >= 0 ? noQuery.substring(lastSep + 1) : noQuery;
+        return name || 'image';
+    }
+
    // 初始化图片查看器
    function initImageViewer() {
        var viewer = new Viewer(document.getElementById('image'), {
@@ -66,6 +77,10 @@
            button: false,
            backdrop: false,
            loop: true,
+            // Viewer 会将克隆图片的 data-original-url 改为加载地址，因此从原始元素读取标题。
+            title: function () {
+                return getImageNameFromOriginalUrl(this.images[this.index]);
+            }
        });
        viewer.view(0); // 0 是图片的索引，如果你想点击第一张图片，索引为 0
    }
--- a/server/src/main/resources/web/svg.ftl
+++ b/server/src/main/resources/web/svg.ftl
@@ -129,7 +129,7 @@
    let isDragging = false;
    let startX, startY, startTranslateX, startTranslateY;
    let panStartX, panStartY;
-	var url = '${finalUrl}';
+	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/tiff.ftl
+++ b/server/src/main/resources/web/tiff.ftl
@@ -30,7 +30,7 @@
        var reg = new RegExp(str + "$");
        return reg.test(this);
    }
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/xmind.ftl
+++ b/server/src/main/resources/web/xmind.ftl
@@ -20,7 +20,7 @@

 <script src="xmind/xmind.js"></script>
 <script type="text/javascript">
-   	var url = '${finalUrl}';
+   	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
+++ b/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
@@ -5,6 +5,7 @@ import org.junit.jupiter.api.Test;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
+import java.util.Map;

 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -35,6 +36,38 @@ public class PdfViewerCompatibilityTests {
        assertTrue(pdfTemplate.contains("viewerUrl += \"&pagemode=none\";"));
    }

+    @Test
+    void shouldForwardAndApplyAllPdfWatermarkSettings() throws IOException {
+        String pdfTemplate = readResource("/web/pdf.ftl");
+        String viewerScript = readResource("/static/pdfjs/web/viewer.mjs");
+        Map<String, String> watermarkParams = Map.ofEntries(
+                Map.entry("watermarktxt", "watermarkTxt"),
+                Map.entry("watermarkxspace", "watermarkXSpace"),
+                Map.entry("watermarkyspace", "watermarkYSpace"),
+                Map.entry("watermarkfont", "watermarkFont"),
+                Map.entry("watermarkfontsize", "watermarkFontsize"),
+                Map.entry("watermarkcolor", "watermarkColor"),
+                Map.entry("watermarkalpha", "watermarkAlpha"),
+                Map.entry("watermarkwidth", "watermarkWidth"),
+                Map.entry("watermarkheight", "watermarkHeight"),
+                Map.entry("watermarkangle", "watermarkAngle")
+        );
+
+        watermarkParams.forEach((queryParam, templateAttribute) -> {
+            assertTrue(pdfTemplate.contains(queryParam + ": '${" + templateAttribute + "?js_string}'"),
+                    () -> "PDF template does not forward " + templateAttribute);
+            assertTrue(viewerScript.contains("\"" + queryParam + "\"")
+                            || viewerScript.contains("'" + queryParam + "'"),
+                    () -> "PDF viewer does not consume " + queryParam);
+        });
+        assertTrue(viewerScript.contains("div.style.fontFamily = settings.font;"));
+        assertTrue(viewerScript.contains("div.style.fontSize = settings.fontsize;"));
+        assertTrue(viewerScript.contains("div.style.color = settings.color;"));
+        assertTrue(viewerScript.contains("div.style.opacity = settings.alpha;"));
+        assertTrue(viewerScript.contains("const xStep = settings.width + settings.x_space;"));
+        assertTrue(viewerScript.contains("const yStep = settings.height + settings.y_space;"));
+    }
+
    @Test
    void shouldPreferPdfForOfficePreviewByDefault() throws IOException {
        String properties = readResource("/application.properties");
@@ -42,6 +75,25 @@ public class PdfViewerCompatibilityTests {
        assertTrue(properties.contains("office.preview.type = ${KK_OFFICE_PREVIEW_TYPE:pdf}"));
    }

+    @Test
+    void shouldEscapeFileUrlWithJsStringInAllPreviewTemplates() throws IOException {
+        // Regression test for #790: a single quote in the source file URL (e.g. a path
+        // segment like "Int'l") was interpolated raw into the inline `var url = '...'`
+        // assignment, terminating the JS string early and throwing Uncaught SyntaxError.
+        // FreeMarker's ?js_string built-in escapes it for the JS string literal context.
+        // Every preview template that injects the file URL into a JS string literal must
+        // use ?js_string, otherwise a URL containing an apostrophe breaks the page.
+        String[] previewTemplates = {
+                "bpmn", "csv", "dcm", "drawio", "eml", "epub", "msg", "ofd",
+                "officeweb", "online3D", "pdf", "svg", "tiff", "xmind"
+        };
+        for (String name : previewTemplates) {
+            String template = readResource("/web/" + name + ".ftl");
+            assertTrue(template.contains("var url = '${finalUrl?js_string}';"),
+                    () -> name + ".ftl must JS-escape the file URL to avoid SyntaxError on apostrophe (see #790)");
+        }
+    }
+
    private String readResource(String resourcePath) throws IOException {
        try (InputStream inputStream = getClass().getResourceAsStream(resourcePath)) {
            assertNotNull(inputStream);
--- a/server/src/test/java/cn/keking/PictureFilePreviewTests.java
+++ b/server/src/test/java/cn/keking/PictureFilePreviewTests.java
@@ -0,0 +1,52 @@
+package cn.keking;
+
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * kkFileView #787 回归测试：直接图片预览（picture.ftl）必须在 Viewer.js 标题里显示文件名。
+ *
+ * 根因：v4.3.0 之后模板把图片元素从 &lt;img&gt; 改成 &lt;div src&gt;，而 HTMLDivElement 没有 DOM 的
+ * src 属性，Viewer.js 用 image.src 取标题得到 undefined，导致标题为空。修复方式是在 Viewer 初始化时
+ * 配置 title 函数，从 data-original-url 派生文件名。
+ *
+ * Viewer 会将内部克隆图片的 data-original-url 改为实际加载地址（可能是代理地址），
+ * 标题必须读取 this.images[this.index] 中保留原始 URL 的元素。
+ */
+public class PictureFilePreviewTests {
+
+    @Test
+    void shouldDeriveViewerTitleFromOriginalUrl() throws IOException {
+        String pictureTemplate = readResource("/web/picture.ftl");
+
+        // 模板仍保留 data-original-url 供标题派生使用
+        assertTrue(pictureTemplate.contains("data-original-url"),
+                () -> "picture.ftl must keep data-original-url for title derivation (see #787)");
+
+        // Viewer 初始化必须配置 title 函数，否则 <div> 的 image.src 为 undefined、标题为空
+        assertTrue(pictureTemplate.contains("title: function"),
+                () -> "picture.ftl must configure a Viewer title function to show the filename (see #787)");
+
+        // 标题派生逻辑必须读取 data-original-url（而非反代 / CORS 代理 URL）
+        assertTrue(pictureTemplate.contains("getImageNameFromOriginalUrl"),
+                () -> "picture.ftl must derive the title from data-original-url (see #787)");
+        assertTrue(pictureTemplate.contains("getAttribute('data-original-url')"),
+                () -> "title derivation must read data-original-url attribute (see #787)");
+
+        assertTrue(pictureTemplate.contains("getImageNameFromOriginalUrl(this.images[this.index])"),
+                () -> "Viewer title must use the original element rather than its proxy-backed clone (see #787)");
+    }
+
+    private String readResource(String resourcePath) throws IOException {
+        try (InputStream inputStream = getClass().getResourceAsStream(resourcePath)) {
+            assertNotNull(inputStream);
+            return new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
+        }
+    }
+}
--- a/server/src/test/java/cn/keking/PreviewUrlEscapingTests.java
+++ b/server/src/test/java/cn/keking/PreviewUrlEscapingTests.java
@@ -0,0 +1,76 @@
+package cn.keking;
+
+import cn.keking.config.ConfigConstants;
+import cn.keking.model.FileAttribute;
+import cn.keking.service.impl.OfficeFilePreviewImpl;
+import cn.keking.service.impl.PdfFilePreviewImpl;
+import freemarker.template.Configuration;
+import freemarker.template.Template;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.ui.ExtendedModelMap;
+
+import java.io.StringWriter;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class PreviewUrlEscapingTests {
+
+    @ParameterizedTest
+    @ValueSource(strings = {"pdf", "csv", "xlsx"})
+    void shouldPreserveSourceUrlThroughPreviewModelAndTemplate(String suffix) throws Exception {
+        String sourceUrl = "https://files.example/Int'l/report%20one." + suffix + "?token=a&mode=b";
+        String previousOfficeTypeWeb = ConfigConstants.getOfficeTypeWeb();
+        ConfigConstants.setOfficeTypeWebValue("web");
+        try {
+            FileAttribute file = new FileAttribute();
+            file.setName("report." + suffix);
+            file.setSuffix(suffix);
+            file.setOfficePreviewType("pdf");
+            file.setCacheName("url-escaping-test." + suffix);
+
+            ExtendedModelMap model = new ExtendedModelMap();
+            model.addAttribute("file", file);
+            model.addAttribute("baseUrl", "https://preview.example/");
+            model.addAttribute("kkagent", "false");
+            model.addAttribute("page", "0");
+            model.addAttribute("switchDisabled", "true");
+            model.addAttribute("watermarkTxt", "");
+            model.addAttribute("xlsxshowtoolbar", false);
+            for (String name : new String[]{"watermarkXSpace", "watermarkYSpace", "watermarkAlpha",
+                    "watermarkWidth", "watermarkHeight", "watermarkAngle"}) {
+                model.addAttribute(name, "0");
+            }
+            for (String name : new String[]{"watermarkFont", "watermarkFontsize", "watermarkColor",
+                    "highlightall", "pdfPresentationModeDisable", "pdfOpenFileDisable", "pdfPrintDisable",
+                    "pdfDownloadDisable", "pdfBookmarkDisable", "pdfDisableEditing", "pdfSidebarOpen", "kkkey"}) {
+                model.addAttribute(name, "");
+            }
+
+            OfficeFilePreviewImpl office = new OfficeFilePreviewImpl(null, null, null, null);
+            String view = suffix.equals("pdf")
+                    ? new PdfFilePreviewImpl(null, null, office, null).filePreviewHandle(sourceUrl, model, file)
+                    : office.filePreviewHandle(sourceUrl, model, file);
+            assertEquals(Map.of("pdf", "pdf", "csv", "csv", "xlsx", "officeweb").get(suffix), view);
+            assertEquals(sourceUrl, model.get(suffix.equals("csv") ? "csvUrl" : "pdfUrl"));
+
+            Configuration configuration = new Configuration(Configuration.VERSION_2_3_32);
+            configuration.setClassForTemplateLoading(getClass(), "/web");
+            configuration.setDefaultEncoding("UTF-8");
+            configuration.setClassicCompatible(true);
+            Template template = configuration.getTemplate(view + ".ftl");
+            StringWriter output = new StringWriter();
+            template.process(model, output);
+            String html = output.toString();
+
+            assertTrue(html.contains("var url = 'https://files.example/Int\\'l/report%20one."
+                    + suffix + "?token=a&mode=b';"), html);
+            assertFalse(html.contains("&#39;"), html);
+        } finally {
+            ConfigConstants.setOfficeTypeWebValue(previousOfficeTypeWeb);
+        }
+    }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kl	3b82689a67	Merge pull request #800 from kekingcn/release/5.0.3 release: v5.0.3 security fixes and verified deployment	2026-10-08 15:52:17 +08:00
kl	3c73d8e0e1	fix: harden every shipped config and isolate archive storage tests	2026-10-08 15:46:27 +08:00
kl	7d311ee02f	release: prepare v5.0.3 security fixes and verified deployment	2026-10-08 15:39:17 +08:00
kl	0ff214d0b1	test: verify existing archive traversal protection	2026-10-08 14:17:07 +08:00
kl	e7e3284f26	fix: expose only aggregate health information by default	2026-10-08 14:17:07 +08:00
kl	8530c0a713	fix: render archive trees only within authorized previews	2026-10-08 14:17:07 +08:00
kl	84369c032b	fix: constrain preview page and agent parameters to safe scalar values	2026-10-08 14:11:19 +08:00
kl	93931f6a7a	fix: validate every preview source before applying trust policies	2026-10-08 14:11:19 +08:00
kl	91b46383d1	fix: confine upload writes and folder creation to demo storage	2026-10-08 14:06:58 +08:00
kl	d0a0700275	fix: reject control characters in FTP command arguments	2026-10-08 14:04:15 +08:00
kl	9dad4d80eb	Merge pull request #789 from yuhaibohotmail/fix/officeweb-watermark-defaults fix: 修复水印配置缺失时 xlsx 预览白页	2026-10-08 13:52:33 +08:00
kl	567c8b949a	Merge master into watermark defaults fix	2026-10-08 13:48:15 +08:00
kl	5e3c013e38	Merge pull request #795 from wylovelyi/fix/issue-790-js-escape fix: escape preview URLs and resolve Office schema conflicts	2026-10-08 13:19:56 +08:00
kl	1acd4e4ecd	fix: exclude legacy schemas from Office preview dependencies	2026-10-08 13:14:52 +08:00
kl	1dfad8860f	Merge pull request #798 from wylovelyi/fix/issue-787-image-preview-filename fix(#787): show filename in image preview title via data-original-url	2026-10-08 13:07:11 +08:00
kl	7ef274d376	fix: preserve spreadsheet URLs for JavaScript escaping	2026-10-08 13:04:51 +08:00
kl	0938f3699f	Merge pull request #797 from baiyu-jujuc/fix/redis-image-preview-npe fix: avoid NPE when previewing images with redis cache	2026-10-08 13:02:47 +08:00
kl	86c2b8d552	fix: retain original image titles when proxying previews	2026-10-08 13:02:39 +08:00
wylovelyi	6b948fa675	fix(#787 ): make the image-preview title actually derive from the original URL Verified against the bundled viewer.min.js: the `title(image, imageData)` callback receives the <img> element Viewer.js creates internally (view(): `var image = document.createElement('img')`), NOT the original <div>. Viewer only forwards the attributes listed in `inheritedAttributes` (default: crossOrigin, decoding, isMap, loading, referrerPolicy, sizes, srcset, useMap) when building that <img>, and `data-original-url` is not in that list. So the previous title function always read null and the title stayed 'image' -- the fix was a no-op at runtime. Fix: add `data-original-url` to Viewer's `inheritedAttributes` so the original URL is forwarded from the thumbnail <img> to the title <img>, letting `getImageNameFromOriginalUrl` return the real filename (and not the CORS-proxy URL). Also updates PictureFilePreviewTests to assert `inheritedAttributes` is configured with data-original-url, locking the regression.	2026-10-08 10:00:00 +00:00
yuhaibo	45d7e34678	fix: officeweb.ftl 数值水印缺省值改为字符串，避免按 locale 格式化上一版给六个数值水印变量用的是数值缺省值（${watermarkAlpha!0.2} 等）。 FreeMarker 按请求的 locale 格式化数值：Accept-Language 为 de-DE / fr-FR 时 0.2 输出成 0,2，ar-EG 时数字变成阿拉伯-印度数字，内联脚本解析失败， initWaterMark 与 isLoading 都没有定义，xlsx 预览照样起不来——而此时响应是 200、页面也有 </html>，只看页面完整性看不出来。改为字符串缺省值，与 WatermarkConfigConstants.DEFAULT_* 的类型一致，原样输出。已配置的值本来就是字符串，不受影响。测试改为按 zh-CN / en-US / de-DE / fr-FR / ar-EG 逐个渲染，并逐个断言全部数值输出；已有配置那条也按 zh-CN / de-DE / ar-EG 跑。改模板前先跑：de-DE、fr-FR 红在 watermark_alpha: 0,2，ar-EG 红在 watermark_x_space: ١٠，其余五条通过；改后 8 条全过。 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-27 08:48:33 -07:00
wylovely	ae7cdf3963	test(#790 ): assert JS-escaping of file URL across all 14 preview templates	2026-09-24 15:41:22 +08:00
wylovely	80b13dacba	fix(#787 ): derive Viewer title from data-original-url so image preview shows the filename (was empty for <div src>)	2026-09-24 15:27:12 +08:00
wylovely	d332dbed6a	fix(#787 ): derive Viewer title from data-original-url so image preview shows the filename (was empty for <div src>)	2026-09-24 15:27:10 +08:00
baiyu-jujuc	c1b9daa561	fix: avoid NPE when previewing images with redis cache CacheServiceRedisImpl#getImgCache(String) passed the key straight to Redisson, which throws NullPointerException (map key can't be null) for a null key. Every single-image preview hits this path because compressFileKey is only set for images inside an archive, so with cache.type=redis the preview endpoint always returned HTTP 500. Return an empty list for empty keys, matching CacheServiceJDKImpl. Fixes #793	2026-09-23 14:01:57 +08:00
wylovely	016a040461	test(#790 ): add regression test asserting file URL is JS-escaped in preview template	2026-09-22 09:17:43 +08:00
wylovely	6fa1d91296	fix(#790 ): escape file URL in pdf.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:14:19 +08:00
wylovely	0094514fa7	fix(#790 ): escape file URL in xmind.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:45 +08:00
wylovely	7a2250cc62	fix(#790 ): escape file URL in tiff.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:42 +08:00
wylovely	67b71de330	fix(#790 ): escape file URL in svg.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:38 +08:00
wylovely	228ac8e3a0	fix(#790 ): escape file URL in online3D.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:35 +08:00
wylovely	f47e4b8a96	fix(#790 ): escape file URL in officeweb.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:32 +08:00
wylovely	e8f1fff879	fix(#790 ): escape file URL in ofd.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:30 +08:00
wylovely	29ec82554e	fix(#790 ): escape file URL in msg.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:26 +08:00
wylovely	94da3209fc	fix(#790 ): escape file URL in epub.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:24 +08:00
wylovely	ab4542ca65	fix(#790 ): escape file URL in eml.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:22 +08:00
wylovely	3096ef8368	fix(#790 ): escape file URL in drawio.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:19 +08:00
wylovely	73437824be	fix(#790 ): escape file URL in dcm.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:16 +08:00
wylovely	e34e281461	fix(#790 ): escape file URL in csv.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:14 +08:00
wylovely	b81cb91d67	fix(#790 ): escape file URL in bpmn.ftl with ?js_string to prevent SyntaxError on apostrophe	2026-09-22 09:13:12 +08:00
kl	cd127fd855	Merge pull request #783 from xushenl/fix/fix-ofd-preview-compatibility fix(ofd):update cnofd viewer for OFD compatibility	2026-09-18 23:12:45 +08:00
yuhaibo	c4e1929ecf	fix: 水印配置缺失时 xlsx 预览白页 —— officeweb.ftl 补上缺省值未提供外部 config/application.properties 的部署上，预览任何 xlsx 都失败： FreeMarker 在 officeweb.ftl 第 25 行抛 InvalidReferenceException，点名 watermarkTxt。DEBUG 模式把错误内联进 HTML，页面断在半截 JavaScript 里、永远没有 </html>，浏览器上是白页或一直转圈，而 HTTP 状态码是 200 —— 看起来像转换超时，不像模板错。两处叠在一起： 1. 十个 watermark* 请求属性可能整族不存在。WatermarkConfigConstants 没有类级注解（对比 ConfigConstants 上的 @Component），不是 Spring bean，那十个 @Value 的 setter 从来不会被调用；唯一填充它们的 ConfigRefreshComponent#loadConfig() 在配置文件不存在时直接 return。于是十个 getter 全返回 null，AttributeSetFilter 的 setAttribute(name, null) 按 Servlet 规范等同于删除属性。 2. officeweb.ftl 是唯一没有 classic_compatible 兜底的预览模板。 commonHeader.ftl 第 1 行是 <#setting classic_compatible=true>，所有 include 它的模板在属性缺失时把变量渲染成空串、照常出页面； officeweb.ftl 既不 include 它、自己也没有这个设置。缺省值取 WatermarkConfigConstants.DEFAULT_，watermarkTxt 取空串—— 空串会让下一行的 if (watermarkTxt !== '') 跳过 watermark.init()，不会给所有预览凭空加上水印。其余九个只在水印开着时才用到，但那个 if 是 JavaScript 的、不是模板的，FreeMarker 两条分支都渲染，所以十个都要给。新增的测试直接用 FreeMarker 渲染这个模板，不需要把服务跑起来：数据模型里一个 watermark 都不给（那正是缺陷发生时的情形），断言渲染得出 </html>；另一条把十个值全给上，断言逐个原样渲染，保证缺省值不会盖掉真实配置。改模板之前先跑过一遍，第一条报 InvalidReferenceException、第二条通过。 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-08 00:54:15 -07:00
木火	bf11e7d3c1	fix(ofd):update cnofd viewer for OFD compatibility	2026-08-27 21:51:03 +08:00
kl	dff27aed42	Merge pull request #782 from kekingcn/codex/fix-custom-watermark-settings fix: 修复 PDF/Word 自定义水印设置不生效	2026-08-25 09:58:47 +08:00
kl	a199b4a7fe	fix: honor custom watermark settings in PDF preview	2026-08-25 08:39:11 +08:00
kl	c4288f7e59	Merge pull request #780 from kekingcn/release/5.0.2 Release v5.0.2	2026-08-14 14:33:28 +08:00
kl	e2bcb67d43	chore(release): prepare v5.0.2	2026-08-14 14:28:41 +08:00
kl	69b234fda2	Merge commit from fork Fix insecure default file deletion	2026-08-14 14:14:37 +08:00
kl	56eceebef8	Merge commit from fork Sandbox HTML preview execution	2026-08-14 14:12:17 +08:00
kl	f852bf844b	fix: secure demo file deletion	2026-08-14 11:12:50 +08:00
kl	583208898f	fix: sandbox HTML preview execution	2026-08-14 11:12:50 +08:00
kl	9c3fd82076	Merge pull request #779 from kekingcn/pdf-jbig2-image-loss fix: refresh ImageIO plugins before PDF conversion	2026-08-11 13:00:24 +08:00
kl	257180eb95	fix: refresh ImageIO plugins before PDF conversion	2026-08-11 12:54:50 +08:00
kl	e134689df3	Merge pull request #771 from kekingcn/release/5.0.1 Release v5.0.1	2026-07-13 17:16:27 +08:00
kl	3a08031929	chore(release): prepare v5.0.1	2026-07-13 17:12:40 +08:00
kl	47745e4d74	Merge commit from fork	2026-07-13 16:53:58 +08:00
kl	332a98b6fa	Add security policy (#770 )	2026-06-29 14:58:29 +08:00