fix(adtracking): 修复生产网关反代路由、成交态统计口径与安全加固

backend/internal/modules/auth/repository.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"errors"
+	"regexp"
 	"strings"
 	"time"
 
@@ -12,6 +13,16 @@ import (
 	"gorm.io/gorm/clause"
 )
 
+var trackCodePattern = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`)
+
+func sanitizeTrackCode(code string) string {
+	s := strings.TrimSpace(code)
+	if len(s) == 0 || len(s) > 64 || !trackCodePattern.MatchString(s) {
+		return ""
+	}
+	return s
+}
+
 type UserRepository struct {
 	db *gorm.DB
 }
@@ -62,7 +73,7 @@ func (r *UserRepository) FindOrCreateByPhone(ctx context.Context, phone string,
 	now := time.Now()
 	var code string
 	if len(trackCode) > 0 {
-		code = strings.TrimSpace(trackCode[0])
+		code = sanitizeTrackCode(trackCode[0])
 	}
 	user := model.User{
 		Phone:             phone,
@@ -106,7 +117,7 @@ func (r *UserRepository) RegisterWithPassword(ctx context.Context, phone string,
 	now := time.Now()
 	var code string
 	if len(trackCode) > 0 {
-		code = strings.TrimSpace(trackCode[0])
+		code = sanitizeTrackCode(trackCode[0])
 	}
 	user := model.User{
 		Phone:             phone,