[Bug] post/admin/api/workspace/default/tool接口导入一个.tool文件，然后抓包工具里修改文件后缀为.php，.php也能导入，看来maxkb后端没有文件格式校验

[qijingyu0727]

Contact Information

648844981@qq.com

MaxKB Version

2.2.1

Problem Description

post/admin/api/workspace/default/tool接口导入一个.tool文件，然后抓包工具里修改文件后缀为.php，也能正常导入，看来maxkb后端没有文件格式校验

485c22aac081629b27b6ad91cd6d3903.mp4

Steps to Reproduce

.

The expected correct result

No response

Related log output

Additional Information

No response

[liuruibin]

导出导入是将tool文件序列化成bytes，能正常反序列化成tool就认为是正常的bytes

[shaohuzhang1]

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

Export and import serialize tool files into bytes. If they can be deserialized into tools normally, they are considered normal bytes.