fix: Mod 白名单 + Config 原子写 + 错误状态码

- ModController：下载 URL 白名单 + modId 正则校验\n- Config：Save 原子写（tmp+Move），Load 坏文件自动备份 .bak\n- ConvertController：失败路径改 4xx/5xx 而非 200

Author: Applesaber

ChuChartManager/Config.cs

@@ -21,7 +21,9 @@ public class Config
     public void Save()
     {
         Directory.CreateDirectory(AppDataDir);
-        File.WriteAllText(ConfigFilePath, JsonSerializer.Serialize(this, new JsonSerializerOptions { WriteIndented = true }));
+        var tmpPath = ConfigFilePath + ".tmp";
+        File.WriteAllText(tmpPath, JsonSerializer.Serialize(this, new JsonSerializerOptions { WriteIndented = true }));
+        File.Move(tmpPath, ConfigFilePath, overwrite: true);
     }
 
     public static Config Load()
@@ -31,8 +33,15 @@ public static Config Load()
         {
             return JsonSerializer.Deserialize<Config>(File.ReadAllText(ConfigFilePath)) ?? new Config();
         }
-        catch
+        catch (Exception ex)
         {
+            var backupPath = ConfigFilePath + ".bak";
+            try
+            {
+                File.Copy(ConfigFilePath, backupPath, overwrite: true);
+            }
+            catch { }
+            Log.Warn($"配置文件损坏，已备份到 {backupPath}: {ex.Message}");
             return new Config();
         }
     }

ChuChartManager/Controllers/ConvertController.cs

@@ -72,7 +72,7 @@ public ActionResult<ConvertResult> ConvertChart([FromBody] ConvertRequest req)
         catch (ConversionException ex)
         {
             allAlerts.AddRange(ex.Alerts);
-            return Ok(new ConvertResult
+            return BadRequest(new ConvertResult
             {
                 Success = false,
                 Output = "",
@@ -82,7 +82,7 @@ public ActionResult<ConvertResult> ConvertChart([FromBody] ConvertRequest req)
         }
         catch (Exception ex)
         {
-            return Ok(new ConvertResult
+            return StatusCode(500, new ConvertResult
             {
                 Success = false,
                 Output = "",

ChuChartManager/Controllers/ModController.cs

@@ -87,6 +87,9 @@ public async Task<ActionResult> InstallLoader([FromBody] InstallRequest? request
         if (string.IsNullOrEmpty(loaderUrl))
             return NotFound("No release found");
 
+        if (!IsAllowedDownloadUrl(loaderUrl))
+            return BadRequest("下载 URL 不在白名单内");
+
         var binPath = Path.Combine(gamePath, "bin");
         var loaderData = await Http.GetByteArrayAsync(loaderUrl);
         await System.IO.File.WriteAllBytesAsync(Path.Combine(binPath, "version.dll"), loaderData);
@@ -119,6 +122,9 @@ public async Task<ActionResult> InstallAppleChu([FromBody] InstallRequest? reque
         if (string.IsNullOrEmpty(url))
             return NotFound("No release found");
 
+        if (!IsAllowedDownloadUrl(url))
+            return BadRequest("下载 URL 不在白名单内");
+
         var data = await Http.GetByteArrayAsync(url);
         var modsDir = Path.Combine(binPath, "mods");
         Directory.CreateDirectory(modsDir);
@@ -137,6 +143,19 @@ public async Task<ActionResult> InstallAppleChu([FromBody] InstallRequest? reque
 
     public record InstallRequest(string? Url);
 
+    private static bool IsAllowedDownloadUrl(string? url)
+    {
+        if (string.IsNullOrEmpty(url)) return false;
+        return Uri.TryCreate(url, UriKind.Absolute, out var uri)
+            && uri.Host is "github.com" or "objects.githubusercontent.com" or "api.github.com"
+            && uri.AbsolutePath.StartsWith("/MuNET-OSS/", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool IsValidModId(string modId)
+    {
+        return !string.IsNullOrEmpty(modId) && System.Text.RegularExpressions.Regex.IsMatch(modId, @"^[A-Za-z0-9_-]+$");
+    }
+
     private static async Task<GitHubRelease?> GetLatestRelease(string repo, string assetName)
     {
         try
@@ -153,6 +172,9 @@ public record InstallRequest(string? Url);
     [HttpGet("manifest/{modId}")]
     public ActionResult<object> GetManifest(string modId)
     {
+        if (!IsValidModId(modId))
+            return BadRequest("无效的 modId");
+
         var source = Path.Combine(StaticSettings.ExeDir, "Resources", modId, "manifest.toml");
         if (!System.IO.File.Exists(source))
             return NotFound();
@@ -164,6 +186,8 @@ public ActionResult<object> GetManifest(string modId)
     [HttpGet("config/{modId}")]
     public ActionResult<ModConfigRequest> GetConfig(string modId)
     {
+        if (!IsValidModId(modId))
+            return BadRequest("无效的 modId");
         if (!TryResolveGameFile($"{modId}.toml", out var path))
             return BadRequest("GamePath not set");
         if (!System.IO.File.Exists(path))
@@ -181,6 +205,8 @@ public ActionResult<ModConfigRequest> GetConfig(string modId)
     [HttpPut("config/{modId}")]
     public ActionResult SaveConfig(string modId, [FromBody] ModConfigRequest request)
     {
+        if (!IsValidModId(modId))
+            return BadRequest("无效的 modId");
         if (!TryResolveGameFile($"{modId}.toml", out var path))
             return BadRequest("GamePath not set");