Skip to content

Commit 9beb430

Browse files
committed
fix(FsRemove): enhance validation to prevent unintended directory deletion
1. Use `utils.FixAndCleanPath` to correctly identify and block invalid names. 2. Change error handling from `return` to `continue`. Signed-off-by: huyuantao <huyuantao@ultrarisc.com>
1 parent 806301b commit 9beb430

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

server/handles/fsmanage.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -282,9 +282,10 @@ func FsRemove(c *gin.Context) {
282282
return
283283
}
284284
for _, name := range req.Names {
285-
if name == "" {
286-
common.ErrorStrResp(c, "Unexpected empty item name", 400)
287-
return
285+
// Skip invalid item names (empty string, whitespace, ".", "/","\t\t","..") to prevent accidental removal of current directory
286+
if strings.TrimSpace(utils.FixAndCleanPath(name)) == "/" {
287+
utils.Log.Warnf("FsRemove: invalid item skipped: %s (parent directory: %s)\n", name, reqDir)
288+
continue
288289
}
289290
err := fs.Remove(c.Request.Context(), stdpath.Join(reqDir, name))
290291
if err != nil {

0 commit comments

Comments
 (0)