From 11cab45129cae2b1a15ace95dd4aa2944a56be52 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Thu, 6 Aug 2026 14:52:26 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20git=20URL=E5=90=8Etarget=E5=8F=AA?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=97=E5=90=88=E6=B3=95=E8=B7=AF=E5=BE=84=E5=AD=97?=
 =?UTF-8?q?=E7=AC=A6(=E6=8B=92=E7=BB=9D=E4=B8=AD=E6=96=87)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 wwwroot/api/cockpit_chat.dspy | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/wwwroot/api/cockpit_chat.dspy b/wwwroot/api/cockpit_chat.dspy
index 2e142be..0ea7bfd 100644
--- a/wwwroot/api/cockpit_chat.dspy
+++ b/wwwroot/api/cockpit_chat.dspy
@@ -888,7 +888,12 @@ if action == 'send_message':
                     m = re.search(r'(git@[\w.]+:[\w./-]+\.git|https?://[\w./-]+\.git)', cmd)
                     repo_url = m.group(0)
                     rest = cmd[m.end():].strip()
-                    target = rest.split()[0] if rest else ''
+                    # target 只接受合法路径片段（字母数字/-_.），拒绝中文
+                    target = ''
+                    if rest:
+                        first_token = rest.split()[0] if rest.split() else ''
+                        if first_token and re.match(r'^[a-zA-Z0-9/_.-]+$', first_token):
+                            target = first_token
                     if target and not target.startswith('-'):
                         repo_target = target
                         cmd = f'git clone {repo_url} {target}'