fix(adtracking): 修复生产网关反代路由、成交态统计口径与安全加固

backend/internal/modules/order/utils.go

@@ -3,13 +3,25 @@ package order
 import (
 	"crypto/rand"
 	"errors"
+	"regexp"
 	"strconv"
+	"strings"
 
 	"gorm.io/gorm"
 	"hfb_sys/backend/internal/auditlog"
 	"hfb_sys/backend/internal/timeutil"
 )
 
+var trackCodePattern = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`)
+
+func sanitizeTrackCode(code string) string {
+	s := strings.TrimSpace(code)
+	if len(s) == 0 || len(s) > 64 || !trackCodePattern.MatchString(s) {
+		return ""
+	}
+	return s
+}
+
 func firstNonEmpty(values ...string) string {
 	for _, value := range values {
 		if value != "" {