修复采购附件同源 XSS（07-17-purchase-attachment-xss-hardening）

client/tests/e2e/manual/r7e-browser-business-trialrun.spec.ts

@@ -134,6 +134,10 @@ const defaultCloseoutReimbursementId = "40876ef3-0652-4972-aa14-1aad1a855ae0";
 const defaultCloseoutReimbursementCode = "BX-20260514-0016";
 const wecomUa =
   "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 wxwork/4.1.20 MicroMessenger/8.0.1 Language/zh_CN";
+const safePurchaseAttachmentPng = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAADUlEQVR4nGP4////fwAJ+wP9KobjigAAAABJRU5ErkJggg==",
+  "base64",
+);
 
 function nowStamp() {
   return `${trialrunMarkerPrefix}-${Date.now()}`;
@@ -1029,15 +1033,15 @@ test(`${trialrunIssueId} 浏览器业务先行试运行：报销、审批、请
         await page.locator('[data-testid^="purchase-item-quantity-"]:visible').first().fill("1");
         await page.locator('[data-testid^="purchase-item-unit-price-"]:visible').first().fill("188");
 
-        const purchaseAttachmentName = `${trialrunSafePrefix.toLowerCase()}-purchase-attachment-${marker}.txt`;
+        const purchaseAttachmentName = `${trialrunSafePrefix.toLowerCase()}-purchase-attachment-${marker}.png`;
         const uploadAttachmentResponsePromise = page.waitForResponse((response) => {
           const url = new URL(response.url());
           return response.request().method() === "POST" && url.pathname === `/api/purchase-requests/${purchaseRequestId}/attachments`;
         });
         await page.getByTestId("purchase-attachment-file-input").setInputFiles({
           name: purchaseAttachmentName,
-          mimeType: "text/plain",
-          buffer: Buffer.from(`${trialrunMarkerPrefix} purchase attachment ${marker}\n`, "utf-8"),
+          mimeType: "image/png",
+          buffer: safePurchaseAttachmentPng,
         });
         const uploadAttachmentResponse = await uploadAttachmentResponsePromise;
         if (!uploadAttachmentResponse.ok()) {