fix: Prevent SQL injection via orderBy parameter in WithOrderBy and WithOrderRuleBy (#11856)

Co-authored-by: maosite <naocanmonster@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: monkeycode-ai <monkeycode-ai@chaitin.com>

agent/app/api/v2/website_ssl.go

@@ -26,7 +26,7 @@ import (
 // @Router /websites/ssl/search [post]
 func (b *BaseApi) PageWebsiteSSL(c *gin.Context) {
 	var req request.WebsiteSSLSearch
-	if err := helper.CheckBind(&req, c); err != nil {
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
 		return
 	}
 	if !reflect.DeepEqual(req.PageInfo, dto.PageInfo{}) {

agent/app/repo/common.go

@@ -3,6 +3,7 @@ package repo
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"time"
 
 	"github.com/1Panel-dev/1Panel/agent/constant"
@@ -151,10 +152,15 @@ func WithByCreatedAt(startTime, endTime time.Time) DBOption {
 	}
 }
 
+var validColumnName = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
+
 func WithOrderBy(orderStr string) DBOption {
 	if orderStr == "createdAt" {
 		orderStr = "created_at"
 	}
+	if !validColumnName.MatchString(orderStr) {
+		orderStr = "created_at"
+	}
 	return func(g *gorm.DB) *gorm.DB {
 		return g.Order(orderStr)
 	}
@@ -163,6 +169,9 @@ func WithOrderRuleBy(orderBy, order string) DBOption {
 	if orderBy == "createdAt" {
 		orderBy = "created_at"
 	}
+	if !validColumnName.MatchString(orderBy) {
+		orderBy = "created_at"
+	}
 	switch order {
 	case constant.OrderDesc:
 		order = "desc"