ai review

handler/health_profile.js

@@ -5,6 +5,22 @@ class HandlerHealthProfile {
   constructor() {
   }
 
+  // 白名单：只允许写入 schema 定义的顶层字段（兼容 'profile.name' 等点号路径）
+  static PROFILE_FIELDS = ["userId", "profile", "health"];
+
+  static pickFields(body) {
+    const picked = {};
+    for (const key of Object.keys(body || {})) {
+      const allowed = HandlerHealthProfile.PROFILE_FIELDS.some(
+        (f) => key === f || key.startsWith(f + ".")
+      );
+      if (allowed) {
+        picked[key] = body[key];
+      }
+    }
+    return picked;
+  }
+
   async getProfiles(ctx) {
     try {
       const { page = 1, pageSize = 20, userId, name, mobile, sortBy } = ctx.request.query;
@@ -46,7 +62,7 @@ class HandlerHealthProfile {
     try {
       const body = ctx.request.body;
 
-      const newProfile = await DBModel.HealthProfile.createProfile(body);
+      const newProfile = await DBModel.HealthProfile.createProfile(HandlerHealthProfile.pickFields(body));
       return ResponseUtil.success(ctx, { profile: newProfile }, "创建成功");
     } catch (err) {
       return ResponseUtil.internalError(ctx, err.message);
@@ -62,7 +78,7 @@ class HandlerHealthProfile {
         return ResponseUtil.badRequest(ctx, "缺少档案ID");
       }
 
-      const updatedProfile = await DBModel.HealthProfile.updateProfileById(id, update);
+      const updatedProfile = await DBModel.HealthProfile.updateProfileById(id, HandlerHealthProfile.pickFields(update));
       if (!updatedProfile) {
         return ResponseUtil.notFound(ctx, "健康档案不存在");
       }