From ee8d8d7e04d9c38a35a6969f20e75213e84f57c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?piexlMax=28=E5=A5=87=E6=B7=BC?=
 <qimiaojiangjizhao@gmail.com>
Date: Mon, 1 Dec 2025 16:44:32 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=B7=BB=E5=8A=A0=E8=B7=AF=E5=BE=84?=
 =?UTF-8?q?=E7=A9=BF=E8=B6=8A=E6=8B=A6=E6=88=AA=EF=BC=8C=E7=A6=81=E6=AD=A2?=
 =?UTF-8?q?=E9=9D=9E=E6=B3=95=E8=B7=AF=E5=BE=84=E5=88=A0=E9=99=A4=E5=88=87?=
 =?UTF-8?q?=E7=89=87?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/api/v1/example/exa_breakpoint_continue.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server/api/v1/example/exa_breakpoint_continue.go b/server/api/v1/example/exa_breakpoint_continue.go
index 8f39cb160..27a8a6aa3 100644
--- a/server/api/v1/example/exa_breakpoint_continue.go
+++ b/server/api/v1/example/exa_breakpoint_continue.go
@@ -135,6 +135,11 @@ func (b *FileUploadAndDownloadApi) RemoveChunk(c *gin.Context) {
 		response.FailWithMessage(err.Error(), c)
 		return
 	}
+	// 路径穿越拦截
+	if strings.Contains(file.FilePath, "..") || strings.Contains(file.FilePath, "../") || strings.Contains(file.FilePath, "./") || strings.Contains(file.FilePath, ".\\") {
+		response.FailWithMessage("非法路径，禁止删除", c)
+		return
+	}
 	err = utils.RemoveChunk(file.FileMd5)
 	if err != nil {
 		global.GVA_LOG.Error("缓存切片删除失败!", zap.Error(err))