修复：严格校验测试批次请求头

shierfeng-fastapi-backend/module_business/dependency/test_batch_dependency.py

@@ -14,10 +14,9 @@ def parse_optional_positive_batch_id(raw: str | None) -> int | None:
     """解析可选的测试批次请求头。"""
     if raw is None:
         return None
-    try:
+    if not isinstance(raw, str) or not raw or not raw.isascii() or not raw.isdigit():
-        batch_id = int(raw)
+        raise ServiceWarning('', '测试批次标识必须为正整数')
-    except (TypeError, ValueError):
+    batch_id = int(raw)
-        raise ServiceWarning('', '测试批次标识必须为正整数') from None
     if batch_id <= 0:
         raise ServiceWarning('', '测试批次标识必须为正整数')
     return batch_id

shierfeng-fastapi-backend/tests/module_business/test_test_batch_access.py

@@ -82,6 +82,11 @@ class TestBatchHeaderTest(unittest.TestCase):
             with self.subTest(raw=raw), self.assertRaisesRegex(ServiceWarning, '测试批次标识必须为正整数'):
                 parse_optional_positive_batch_id(raw)
 
+    def test_python_coercible_values_are_not_valid_ascii_decimal_literals(self) -> None:
+        for raw in (' 7', '7 ', '+7', '1_0', '７', True, 7, b'7'):
+            with self.subTest(raw=raw), self.assertRaisesRegex(ServiceWarning, '测试批次标识必须为正整数'):
+                parse_optional_positive_batch_id(raw)
+
 
 class TestBatchAccessTest(unittest.IsolatedAsyncioTestCase):
     async def asyncSetUp(self) -> None: