fix(adtracking): 修复生产网关反代路由、成交态统计口径与安全加固

backend/internal/modules/order/lifecycle.go

@@ -3,7 +3,6 @@ package order
 import (
 	"context"
 	"encoding/json"
-	"strings"
 	"time"
 
 	"hfb_sys/backend/internal/model"
@@ -71,11 +70,11 @@ func (r *Repository) Create(ctx context.Context, renterID uint64, req CreateRequ
 		if err != nil {
 			return err
 		}
-		sourceTrackCode := strings.TrimSpace(req.TrackCode)
+		sourceTrackCode := sanitizeTrackCode(req.TrackCode)
 		if sourceTrackCode == "" {
 			var u model.User
 			if err := tx.Select("register_track_code").First(&u, renterID).Error; err == nil && u.RegisterTrackCode != "" {
-				sourceTrackCode = u.RegisterTrackCode
+				sourceTrackCode = sanitizeTrackCode(u.RegisterTrackCode)
 			}
 		}
 		order := model.RentalOrder{

backend/internal/modules/order/utils.go

@@ -3,13 +3,25 @@ package order
 import (
 	"crypto/rand"
 	"errors"
+	"regexp"
 	"strconv"
+	"strings"
 
 	"gorm.io/gorm"
 	"hfb_sys/backend/internal/auditlog"
 	"hfb_sys/backend/internal/timeutil"
 )
 
+var trackCodePattern = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`)
+
+func sanitizeTrackCode(code string) string {
+	s := strings.TrimSpace(code)
+	if len(s) == 0 || len(s) > 64 || !trackCodePattern.MatchString(s) {
+		return ""
+	}
+	return s
+}
+
 func firstNonEmpty(values ...string) string {
 	for _, value := range values {
 		if value != "" {