feat(security): 增加XSS防护和文件上传安全校验

添加bleach和dompurify库用于HTML内容过滤
实现文件上传路径校验和类型检测
增强定时任务函数格式验证
修复文件下载路径穿越漏洞

backend/app/api/v1/module_system/notice/schema.py

@@ -10,6 +10,7 @@ from pydantic import (
 from app.common.enums import QueueEnum
 from app.core.base_schema import BaseSchema, UserBySchema
 from app.core.validator import DateTimeStr
+from app.utils.xss_util import sanitize_html
 
 
 class NoticeCreateSchema(BaseModel):
@@ -28,6 +29,11 @@ class NoticeCreateSchema(BaseModel):
             raise ValueError("公告类型仅支持 '1'(通知) 或 '2'(公告)")
         return value
 
+    @field_validator("notice_content")
+    @classmethod
+    def _sanitize_notice_content(cls, value: str) -> str:
+        return sanitize_html(value)
+
     @model_validator(mode="after")
     def _validate_after(self):
         if not self.notice_title.strip():