diff --git a/server/api/v1/example/exa_breakpoint_continue.go b/server/api/v1/example/exa_breakpoint_continue.go index 8f39cb160..27a8a6aa3 100644 --- a/server/api/v1/example/exa_breakpoint_continue.go +++ b/server/api/v1/example/exa_breakpoint_continue.go @@ -135,6 +135,11 @@ func (b *FileUploadAndDownloadApi) RemoveChunk(c *gin.Context) { response.FailWithMessage(err.Error(), c) return } + // 路径穿越拦截 + if strings.Contains(file.FilePath, "..") || strings.Contains(file.FilePath, "../") || strings.Contains(file.FilePath, "./") || strings.Contains(file.FilePath, ".\\") { + response.FailWithMessage("非法路径,禁止删除", c) + return + } err = utils.RemoveChunk(file.FileMd5) if err != nil { global.GVA_LOG.Error("缓存切片删除失败!", zap.Error(err))