@wenbin_wb/dsh-bridge 2.10.1 → 2.10.3

package/lib/platform/conversation-bridge.js

@@ -21,7 +21,7 @@ import { randomUUID } from 'node:crypto'
 import { stat } from 'node:fs/promises'
 import { normalize } from 'node:path'
 import { resolveFilePath } from './message-split.js'
-import { splitForIM, textOfAssistantMessage, extractAndStripSendFileDirectives, extractFilePathsFromText } from './message-split.js'
+import { splitForIM, textOfAssistantMessage, extractAndStripSendFileDirectives, extractFilePathsFromText, isPathAllowedForSend } from './message-split.js'
 import { routeCommand } from './commands.js'
 import { listSessions, listWorkspaces, validateWorkspacePath, renderSessions, sessionsInDisplayOrder, describeTurnEnd, helpText, fmtTime, fmtSessionId, sessionLabel } from './session-catalog.js'
 
@@ -665,9 +665,14 @@ export class ConversationBridge {
             const uniqueFilesToSend = []
             for (const f of rawFiles) {
               const resolved = resolveFilePath(f, cwd)
-              if (resolved && !uniqueFilesToSend.includes(resolved)) {
-                uniqueFilesToSend.push(resolved)
+              if (!resolved || uniqueFilesToSend.includes(resolved)) continue
+              // 发送白名单：仅允许会话 cwd（及其子目录）内、且不命中敏感路径的文件，
+              // 防止模型被提示注入后借 [SEND_FILE] 外发 .ssh/.credentials/.env 等任意本地文件。
+              if (!isPathAllowedForSend(resolved, cwd)) {
+                this.logger?.warn?.(`[dsh-bridge ${this.platform.id}] blocked SEND_FILE outside allowed workspace: ${resolved}`)
+                continue
               }
+              uniqueFilesToSend.push(resolved)
             }
             for (const resolved of uniqueFilesToSend) {
               try {

package/lib/platform/message-split.js

@@ -2,7 +2,7 @@
 // 自 conversation-bridge.js 拆出：按平台 maxMessageChars 分块、保留 fenced code block、
 // [SEND_FILE: ...] 显式指令提取与路径解析。
 import { statSync } from 'node:fs'
-import { isAbsolute, normalize, resolve } from 'node:path'
+import { isAbsolute, normalize, relative, resolve } from 'node:path'
 
 const FENCE_RE = /^```([^\n`]*)\s*$/
 
@@ -149,6 +149,44 @@ export function resolveFilePath(rawPath, cwd = process.cwd()) {
   return null
 }
 
+/**
+ * 判断解析后的文件路径是否允许经 [SEND_FILE] 发送给 IM。
+ * 安全约束（防止模型被诱导后外发任意本地文件）：
+ *   1. 必须位于 allowedRoots 中的某个根目录（含子目录）内 —— 默认仅会话 cwd；
+ *   2. 路径任何一段不得命中敏感名单（.ssh/.gnupg/.aws/.git/.env/.credentials 等）。
+ * @param {string} resolvedPath 已解析的绝对路径
+ * @param {string|string[]} allowedRoots 允许的根目录（绝对路径）；默认 process.cwd()
+ * @returns {boolean}
+ */
+export function isPathAllowedForSend(resolvedPath, allowedRoots = process.cwd()) {
+  if (typeof resolvedPath !== 'string' || !resolvedPath) return false
+  const roots = Array.isArray(allowedRoots) ? allowedRoots : [allowedRoots]
+  if (roots.length === 0) return false
+
+  const normalized = resolve(resolvedPath)
+  const pathParts = normalized.split(/[\\/]/).filter(Boolean)
+  const SENSITIVE_PARTS = new Set([
+    '.ssh', '.gnupg', '.aws', '.azure', '.kube', '.git', '.svn', '.hg',
+    '.bash_history', '.zsh_history', '.profile', '.bash_profile', '.bashrc',
+    '.zshrc', '.netrc', '.env', '.npmrc', '.credentials', 'id_rsa', 'id_ed25519',
+    'id_ecdsa', 'id_dsa', 'shadow', 'passwd',
+  ])
+  for (const part of pathParts) {
+    if (SENSITIVE_PARTS.has(part.toLowerCase())) return false
+  }
+
+  for (const root of roots) {
+    if (typeof root !== 'string' || !root) continue
+    const normRoot = resolve(root)
+    if (normalized === normRoot) return true
+    // 用 relative 判断是否位于根内：越界时 rel 为 '..' 或以 '../' 开头
+    // （Windows 跨盘则 rel 是绝对路径，isAbsolute 拦截）。跨平台正确处理 \ 与 / 差异。
+    const rel = relative(normRoot, normalized)
+    if (rel && !rel.startsWith('..') && !isAbsolute(rel)) return true
+  }
+  return false
+}
+
 /**
  * 提取并过滤文本中的 [SEND_FILE: <path>] 显式发送指令
  * 由 AI 根据用户意图显式决定何时向用户发送文件附件，杜绝底层盲目扫描与误发。