From 370b7d0a4be5425ae5b01e892c82e4e61ab08192 Mon Sep 17 00:00:00 2001 From: ymq Date: Tue, 1 Sep 2026 13:54:58 +0800 Subject: [PATCH] =?UTF-8?q?fix(todo-form):=20=5Fsafe=5Frel=E4=BF=9D?= =?UTF-8?q?=E7=95=99=E5=B0=BE=E9=83=A8/=E2=80=94=E2=80=94=E7=9B=AE?= =?UTF-8?q?=E5=BD=95=E5=9E=8Btarget(=E5=A6=82=20docs/=E8=B5=84=E8=B4=A8/)?= =?UTF-8?q?=E4=B8=8D=E5=86=8D=E4=B8=A2=E5=8E=9F=E6=96=87=E4=BB=B6=E5=90=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- wwwroot/api/todo_form_submit.dspy | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/wwwroot/api/todo_form_submit.dspy b/wwwroot/api/todo_form_submit.dspy index f678b76..c159c74 100644 --- a/wwwroot/api/todo_form_submit.dspy +++ b/wwwroot/api/todo_form_submit.dspy @@ -103,16 +103,21 @@ if not project_dir or not os.path.isdir(project_dir): def _safe_rel(target): - """校验相对路径：禁绝对路径、禁 .. 穿越。返回规整后的相对路径或 ''。""" + """校验相对路径：禁绝对路径、禁 .. 穿越。返回规整后的相对路径或 ''。 + + 保留尾部 '/'——它是「目录 target」（保留原文件名）与「文件 target」 + （直接用 target 作路径）的区分标志，归一化时不能丢。 + """ t = (target or '').strip() if not t: return '' if t.startswith('/'): return '' + is_dir = t.endswith('/') parts = [p for p in t.split('/') if p not in ('', '.')] if '..' in parts: return '' - return '/'.join(parts) + return '/'.join(parts) + ('/' if is_dir else '') uploaded = [] # [(name, rel_path)]