From 0f8ac5759381ccd9eb436e6980271a09bdf0648b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= <kvtodev@outlook.com>
Date: Mon, 21 Sep 2026 15:14:07 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8B=92=E6=94=B6=E5=B8=A6userinfo=E7=9A=84?=
 =?UTF-8?q?=E4=BA=A7=E7=89=A9=E5=9C=B0=E5=9D=80=20-=20TripoUrl::parse=20?=
 =?UTF-8?q?=E5=8E=9F=E5=85=88=E5=8F=AA=E6=A0=A1=E9=AA=8C=20scheme=EF=BC=8C?=
 =?UTF-8?q?=E5=B8=A6=20user:password@=20=E7=9A=84=E5=9C=B0=E5=9D=80?=
 =?UTF-8?q?=E4=BC=9A=E8=A2=AB=20Debug=20/=20redacted=20=E5=8E=9F=E6=A0=B7?=
 =?UTF-8?q?=E6=89=93=E8=BF=9B=E6=97=A5=E5=BF=97=20-=20=E8=A7=A3=E6=9E=90?=
 =?UTF-8?q?=E9=98=B6=E6=AE=B5=E7=9B=B4=E6=8E=A5=E6=8B=92=E7=BB=9D=20userin?=
 =?UTF-8?q?fo=EF=BC=8C=E4=BA=A7=E7=89=A9=E5=9C=B0=E5=9D=80=E4=B8=8D?=
 =?UTF-8?q?=E9=9C=80=E8=A6=81=E5=87=AD=E6=8D=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server-rs/crates/platform-tripo/src/common/types.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server-rs/crates/platform-tripo/src/common/types.rs b/server-rs/crates/platform-tripo/src/common/types.rs
index 1a8144879..5178ac2ec 100644
--- a/server-rs/crates/platform-tripo/src/common/types.rs
+++ b/server-rs/crates/platform-tripo/src/common/types.rs
@@ -43,6 +43,13 @@ impl TripoUrl {
                 message: "URL must use http or https".into(),
             });
         }
+        // 产物地址不需要凭据；userinfo 只会在日志与调试输出里泄漏账号信息，直接拒收。
+        if !url.username().is_empty() || url.password().is_some() {
+            return Err(TripoError::OutputSchema {
+                task_id: "unknown".into(),
+                message: "URL must not contain userinfo".into(),
+            });
+        }
         Ok(Self(url))
     }