fix(通知管理): 禁止远程邮件附件地址

Closes: #770

Author: zhou-hao

jetlinks-components/notify-component/notify-email/src/main/java/org/jetlinks/community/notify/email/embedded/DefaultEmailNotifier.java

@@ -41,7 +41,6 @@
 import org.springframework.core.io.ByteArrayResource;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.InputStreamSource;
-import org.springframework.core.io.Resource;
 import org.springframework.core.io.buffer.DataBufferUtils;
 import org.springframework.http.MediaType;
 import org.springframework.mail.javamail.JavaMailSender;
@@ -96,8 +95,6 @@ public class DefaultEmailNotifier extends AbstractNotifier<EmailTemplate> {
 
     private final FileManager fileManager;
 
-    private final WebClient webClient;
-
     public DefaultEmailNotifier(NotifierProperties properties,
                                 TemplateManager templateManager,
                                 FileManager fileManager,
@@ -128,7 +125,6 @@ public DefaultEmailNotifier(String id,
         this.username = properties.getUsername();
         this.javaMailSender = mailSender;
         this.fileManager = fileManager;
-        this.webClient = builder.build();
     }
 
     @Nonnull
@@ -212,11 +208,8 @@ protected Mono<Void> doSend(ParsedEmailTemplate template) {
 
     protected Mono<? extends InputStreamSource> convertResource(String resource) {
         if (resource.startsWith("http")) {
-            return webClient
-                .get()
-                .uri(resource)
-                .accept(MediaType.APPLICATION_OCTET_STREAM)
-                .exchangeToMono(res -> res.bodyToMono(Resource.class));
+            // 邮件模板属于发送时输入，远程地址不能触发服务端主动下载。
+            return Mono.error(() -> new UnsupportedOperationException("不支持远程附件地址:" + resource));
         } else if (resource.startsWith("data:") && resource.contains(";base64,")) {
             String base64 = resource.substring(resource.indexOf(";base64,") + 8);
             return Mono.just(

jetlinks-components/notify-component/notify-email/src/test/java/org/jetlinks/community/notify/email/embedded/DefaultEmailNotifierTest.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2026 JetLinks https://www.jetlinks.cn
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jetlinks.community.notify.email.embedded;
+
+import org.jetlinks.community.io.file.FileManager;
+import org.jetlinks.community.notify.template.TemplateManager;
+import org.junit.jupiter.api.Test;
+import org.springframework.web.reactive.function.client.WebClient;
+import reactor.test.StepVerifier;
+
+import static org.mockito.Mockito.mock;
+
+class DefaultEmailNotifierTest {
+
+    @Test
+    void shouldRejectRemoteAttachment() {
+        DefaultEmailProperties properties = new DefaultEmailProperties();
+        properties.setHost("localhost");
+        properties.setPort(25);
+        properties.setSender("test@example.com");
+
+        DefaultEmailNotifier notifier = new DefaultEmailNotifier(
+            "test",
+            properties,
+            mock(TemplateManager.class),
+            mock(FileManager.class),
+            WebClient.builder()
+        );
+
+        StepVerifier
+            .create(notifier.convertResource("http://127.0.0.1/internal"))
+            .expectError(UnsupportedOperationException.class)
+            .verify();
+    }
+}