diff --git a/app/api/routers/rbac_operator.py b/app/api/routers/rbac_operator.py
index e84fc83..005c176 100644
--- a/app/api/routers/rbac_operator.py
+++ b/app/api/routers/rbac_operator.py
@@ -6,6 +6,7 @@
 from __future__ import annotations
 
 import json
+import re
 
 from fastapi import APIRouter, Depends, File, HTTPException, Request, Response, UploadFile
 from pydantic import BaseModel
@@ -635,8 +636,16 @@ def _split_host_list(raw: str | None) -> list[str]:
 
 def _normalize_host(host: str) -> str:
     h = host.strip().lower()
+    # 正则形态 /pattern/（如 /\.gov\.cn$/）：编译校验后原样保留
+    if h.startswith("/") and h.endswith("/") and len(h) > 2:
+        try:
+            re.compile(h[1:-1])
+        except re.error:
+            raise HTTPException(status_code=422, detail="正则表达式格式不正确")
+        return h
     h = h.replace("https://", "").replace("http://", "")
     h = h.split("/")[0].split(":")[0].strip()
+    # 通配符形态 *.gov.cn 保留 *；其余为普通域名
     if not h or any(ch.isspace() for ch in h):
         raise HTTPException(status_code=422, detail="域名格式不正确")
     return h
@@ -651,9 +660,9 @@ async def _get_url_rules(db: Database) -> dict:
 
 async def _save_url_rules(db: Database, rules: dict) -> None:
     await db.config.set(URL_WHITELIST_KEY, ",".join(rules["whitelist"]),
-                        description="应用内网页容器白名单（域名）")
+                        description="应用内网页容器白名单（域名 / 通配 *.x / 正则 /pattern/）")
     await db.config.set(URL_BLACKLIST_KEY, ",".join(rules["blacklist"]),
-                        description="应用内网页容器黑名单（域名，命中禁止打开）")
+                        description="应用内网页容器黑名单（域名 / 通配 *.x / 正则 /pattern/，命中禁止打开）")
 
 
 @router.get("/site/url-rules", summary="站点 URL 白名单/黑名单列表")