From 29bdfcfb1848664886ffe37625d4b758e40b2ddc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=88=98=E8=88=AA=E5=AE=87?= <3364451258@qq.com>
Date: Fri, 10 Jul 2026 15:27:27 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=9B=BF=E6=8D=A2=E8=BF=87=E6=97=B6?=
 =?UTF-8?q?=E7=9A=84=20X-XSS-Protection=20=E4=B8=BA=20Content-Security-Pol?=
 =?UTF-8?q?icy?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/core/embedder.py       |  2 --
 src/core/splitters/epub.py | 11 ++++++++---
 src/server/app.py          |  2 +-
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/core/embedder.py b/src/core/embedder.py
index ff35556..f8271f0 100644
--- a/src/core/embedder.py
+++ b/src/core/embedder.py
@@ -22,8 +22,6 @@ import threading
 import logging
 from typing import Protocol
 
-import requests  # noqa: F401 — DashscopeEmbedder 使用
-
 from src.core.config import EmbedConfig
 
 logger = logging.getLogger("md-vector-db")
diff --git a/src/core/splitters/epub.py b/src/core/splitters/epub.py
index 0c4b247..b7f6f14 100644
--- a/src/core/splitters/epub.py
+++ b/src/core/splitters/epub.py
@@ -40,11 +40,16 @@ class EPUBSplitter:
         extracted_chapters = []
         for item in book.get_items_of_type(ebooklib.ITEM_DOCUMENT):
             try:
-                # ebooklib 的 get_content() 返回 bytes
                 content = item.get_content().decode("utf-8")
             except UnicodeDecodeError:
-                logger.warning("EPUB 跳过一个无法解码的章节: %s", item.get_name())
-                continue
+                try:
+                    content = item.get_content().decode("utf-8-sig")
+                except UnicodeDecodeError:
+                    try:
+                        content = item.get_content().decode("latin-1")
+                    except UnicodeDecodeError:
+                        logger.warning("EPUB 跳过一个无法解码的章节: %s", item.get_name())
+                        continue
 
             # 用 BeautifulSoup 去标签（如果可用），否则保留原样
             try:
diff --git a/src/server/app.py b/src/server/app.py
index 54a0f99..5097c9a 100644
--- a/src/server/app.py
+++ b/src/server/app.py
@@ -79,7 +79,7 @@ async def security_headers_middleware(request: Request, call_next):
     response = await call_next(request)
     response.headers["X-Content-Type-Options"] = "nosniff"
     response.headers["X-Frame-Options"] = "DENY"
-    response.headers["X-XSS-Protection"] = "1; mode=block"
+    response.headers["Content-Security-Policy"] = "default-src 'self'"
     response.headers["Referrer-Policy"] = "no-referrer"
     return response