mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-29 04:27:17 +00:00
The generator joins a table's package, table and business names into the paths it writes, and wrote them with os.MkdirAll and os.WriteFile. A name carrying "..", or a symlink under the target directory pointing elsewhere, took the write wherever it led. Every file is now written through os.Root: backend files under the working directory, frontend files under gen.frontpath. A path that resolves outside its root is refused, symlinks included, and the request reports the write failure without writing anything outside.