fix: switch Sina and Tencent endpoints to HTTPS

data_provider/akshare_fetcher.py

@@ -931,17 +931,17 @@ def _get_stock_realtime_quote_sina(self, stock_code: str) -> Optional[UnifiedRea
         优点：单股票查询，负载小，速度快
         缺点：数据字段较少，无量比/PE/PB等
 
-        接口格式：http://hq.sinajs.cn/list=sh600519,sz000001
+        接口格式：https://hq.sinajs.cn/list=sh600519,sz000001
         """
         circuit_breaker = get_realtime_circuit_breaker()
         source_key = "akshare_sina"
         symbol = _to_sina_tx_symbol(stock_code)
-        url = f"http://{SINA_REALTIME_ENDPOINT}={symbol}"
+        url = f"https://{SINA_REALTIME_ENDPOINT}={symbol}"
         api_start = time.time()
 
         try:
             headers = {
-                'Referer': 'http://finance.sina.com.cn',
+                'Referer': 'https://finance.sina.com.cn',
                 'User-Agent': random.choice(USER_AGENTS)
             }
 
@@ -1082,17 +1082,17 @@ def _get_stock_realtime_quote_tencent(self, stock_code: str) -> Optional[Unified
         优点：单股票查询，负载小，包含换手率
         缺点：无量比/PE/PB等估值数据
 
-        接口格式：http://qt.gtimg.cn/q=sh600519,sz000001
+        接口格式：https://qt.gtimg.cn/q=sh600519,sz000001
         """
         circuit_breaker = get_realtime_circuit_breaker()
         source_key = "akshare_tencent"
         symbol = _to_sina_tx_symbol(stock_code)
-        url = f"http://{TENCENT_REALTIME_ENDPOINT}={symbol}"
+        url = f"https://{TENCENT_REALTIME_ENDPOINT}={symbol}"
         api_start = time.time()
 
         try:
             headers = {
-                'Referer': 'http://finance.qq.com',
+                'Referer': 'https://finance.qq.com',
                 'User-Agent': random.choice(USER_AGENTS)
             }
 

docs/CHANGELOG.md

@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 <!-- 新条目格式：- [类型] 描述（类型取值：新功能/改进/修复/文档/测试/chore）-->
 <!-- 每条独立一行追加到本段末尾，无需分类标题，合并时冲突最小 -->
 - [改进] Docker 镜像支持非 root 用户 (`dsa`, UID 1000) 执行，并增强 `Dockerfile` 安全性与构建稳健性。
+- [修复] 将新浪 (Sina) 和腾讯 (Tencent) 实时行情接口切换至 HTTPS，提升数据传输安全性。
 - [改进] 放宽 LiteLLM 依赖约束，保留 `>=1.80.10` 最低版本并显式排除 PyPI 事故版本 `1.82.7` / `1.82.8`，允许安装后续 1.x 修复版本。
 - [改进] 补齐通知渠道 P0 基线、Actions 映射与 `--check-notify` 只读诊断，完善 AstrBot 配置入口和通知回归快照。
 - [修复] 修正 LLM 渠道测试中 `Model disabled` 被误报为网络异常的问题，并在失败提示中展示本次实际测试模型。

tests/test_akshare_realtime_logging.py

@@ -73,16 +73,21 @@ def akshare_fetcher(monkeypatch):
 
 def test_sina_realtime_success_logs_endpoint(caplog, monkeypatch, akshare_fetcher):
     breaker = _DummyCircuitBreaker()
+    captured_url = None
+
+    def _mock_get(url, *args, **kwargs):
+        nonlocal captured_url
+        captured_url = url
+        return _DummyResponse(200, _make_sina_payload())
+
     monkeypatch.setattr("data_provider.akshare_fetcher.get_realtime_circuit_breaker", lambda: breaker)
-    monkeypatch.setattr(
-        "data_provider.akshare_fetcher.requests.get",
-        lambda *args, **kwargs: _DummyResponse(200, _make_sina_payload()),
-    )
+    monkeypatch.setattr("data_provider.akshare_fetcher.requests.get", _mock_get)
 
     with caplog.at_level(logging.INFO):
         quote = akshare_fetcher._get_stock_realtime_quote_sina("601006")
 
     assert quote is not None
+    assert captured_url.startswith("https://")
     assert quote.name == "大秦铁路"
     assert quote.price == 5.19
     assert breaker.successes == ["akshare_sina"]
@@ -133,16 +138,21 @@ def test_tencent_realtime_http_status_logs_endpoint(caplog, monkeypatch, akshare
 
 def test_tencent_realtime_success_logs_endpoint(caplog, monkeypatch, akshare_fetcher):
     breaker = _DummyCircuitBreaker()
+    captured_url = None
+
+    def _mock_get(url, *args, **kwargs):
+        nonlocal captured_url
+        captured_url = url
+        return _DummyResponse(200, _make_tencent_payload())
+
     monkeypatch.setattr("data_provider.akshare_fetcher.get_realtime_circuit_breaker", lambda: breaker)
-    monkeypatch.setattr(
-        "data_provider.akshare_fetcher.requests.get",
-        lambda *args, **kwargs: _DummyResponse(200, _make_tencent_payload()),
-    )
+    monkeypatch.setattr("data_provider.akshare_fetcher.requests.get", _mock_get)
 
     with caplog.at_level(logging.INFO):
         quote = akshare_fetcher._get_stock_realtime_quote_tencent("601006")
 
     assert quote is not None
+    assert captured_url.startswith("https://")
     assert quote.name == "大秦铁路"
     assert quote.price == 5.19
     assert breaker.successes == ["akshare_tencent"]