fix: 校验 PDD 采集商品链接 (#28)

client/src/pdd_collect_service.py

@@ -507,9 +507,27 @@ def _raise_special_page(labels: Sequence[str]) -> None:
         raise PddCollectError("PDD_PAGE_LOGIN_REQUIRED", "PDD 登录已失效，需要人工重新登录")
 
 
-def _goods_id_from_url(goods_url: str) -> str:
-    value = parse_qs(urlparse(goods_url).query).get("goods_id", [""])[0].strip()
-    if not value:
+def _validate_goods_url(goods_url: str, task_goods_id: str) -> str:
+    parsed = urlparse(goods_url)
+    host = (parsed.hostname or "").lower()
+    allowed_host = host == "yangkeduo.com" or host.endswith(".yangkeduo.com")
+    allowed_host = allowed_host or host == "pinduoduo.com" or host.endswith(
+        ".pinduoduo.com"
+    )
+    if parsed.scheme not in ("http", "https") or not allowed_host:
+        raise PddCollectError(
+            "PDD_DATA_GOODS_URL_INVALID",
+            "商品链接不是受支持的 PDD 链接",
+        )
+
+    url_goods_id = parse_qs(parsed.query).get("goods_id", [""])[0].strip()
+    if task_goods_id and url_goods_id and task_goods_id != url_goods_id:
+        raise PddCollectError(
+            "PDD_DATA_GOODS_ID_MISMATCH",
+            "任务商品编号与商品链接中的 goods_id 不一致",
+        )
+    value = task_goods_id or url_goods_id
+    if not value or not value.isdigit():
         raise PddCollectError("PDD_DATA_GOODS_ID_MISSING", "商品链接中没有 goods_id")
     return value
 
@@ -566,7 +584,7 @@ class PddCollectService:
         if not goods_url:
             raise PddCollectError("PDD_DATA_GOODS_URL_MISSING", "采集任务缺少商品链接")
         goods_id = str(getattr(task, "goods_id", "") or "").strip()
-        goods_id = goods_id or _goods_id_from_url(goods_url)
+        goods_id = _validate_goods_url(goods_url, goods_id)
         self._check_cancelled()
 
         try: