[fixed]:解决路径判断的错误 #1304

奇淼（piexlmax · 奇淼（piexlmax · commit 0627359b6e71 · 2022-12-08T19:13:31.000+08:00
diff --git a/server/utils/breakpoint_continue.go b/server/utils/breakpoint_continue.go
@@ -55,7 +55,7 @@ func CheckMd5(content []byte, chunkMd5 string) (CanUpload bool) {
 //@return: string, error
 
 func makeFileContent(content []byte, fileName string, FileDir string, contentNumber int) (string, error) {
-	if strings.Index(fileName, "./") > -1 || strings.Index(FileDir, "./") > -1 {
+	if strings.Index(fileName, "..") > -1 || strings.Index(FileDir, "..") > -1 {
 		return "", errors.New("文件名或路径不合法")
 	}
 	path := FileDir + fileName + "_" + strconv.Itoa(contentNumber)
diff --git a/server/utils/zip.go b/server/utils/zip.go
@@ -19,7 +19,7 @@ func Unzip(zipFile string, destDir string) ([]string, error) {
 	defer zipReader.Close()
 
 	for _, f := range zipReader.File {
-		if strings.Index(f.Name, "../") > -1 {
+		if strings.Index(f.Name, "..") > -1 {
 			return []string{}, fmt.Errorf("%s 文件名不合法", f.Name)
 		}
 		fpath := filepath.Join(destDir, f.Name)

Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ func CheckMd5(content []byte, chunkMd5 string) (CanUpload bool) {`
`55`	`55`	`//@return: string, error`
`56`	`56`
`57`	`57`	`func makeFileContent(content []byte, fileName string, FileDir string, contentNumber int) (string, error) {`
`58`		`- if strings.Index(fileName, "./") > -1 \|\| strings.Index(FileDir, "./") > -1 {`
	`58`	`+ if strings.Index(fileName, "..") > -1 \|\| strings.Index(FileDir, "..") > -1 {`
`59`	`59`	`return "", errors.New("文件名或路径不合法")`
`60`	`60`	`}`
`61`	`61`	`path := FileDir + fileName + "_" + strconv.Itoa(contentNumber)`
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ func Unzip(zipFile string, destDir string) ([]string, error) {`
`19`	`19`	`defer zipReader.Close()`
`20`	`20`
`21`	`21`	`for _, f := range zipReader.File {`
`22`		`- if strings.Index(f.Name, "../") > -1 {`
	`22`	`+ if strings.Index(f.Name, "..") > -1 {`
`23`	`23`	`return []string{}, fmt.Errorf("%s 文件名不合法", f.Name)`
`24`	`24`	`}`
`25`	`25`	`fpath := filepath.Join(destDir, f.Name)`