mock-service-cli 3.6.2 → 3.6.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/fileExplorerServer.js +24 -9
- package/package.json +1 -1
|
@@ -49,15 +49,20 @@ function init() {
|
|
|
49
49
|
dirPath = decodeURIComponent(dirPath);
|
|
50
50
|
|
|
51
51
|
let fullPath;
|
|
52
|
-
|
|
52
|
+
const resolvedRoot = path.resolve(explorerRoot);
|
|
53
|
+
|
|
54
|
+
if (explorerRoot === '/') {
|
|
55
|
+
// 根目录，可以直接使用绝对路径
|
|
53
56
|
fullPath = dirPath;
|
|
54
57
|
} else {
|
|
55
|
-
|
|
58
|
+
// 非根目录，应该将 dirPath 视为相对于 explorerRoot 的路径
|
|
59
|
+
// 如果 dirPath 以 / 开头，去掉前面的 /
|
|
60
|
+
const relativePath = dirPath.startsWith('/') ? dirPath.substring(1) : dirPath;
|
|
61
|
+
fullPath = path.resolve(explorerRoot, relativePath);
|
|
56
62
|
}
|
|
57
63
|
|
|
58
64
|
// 防止路径遍历攻击 - 确保路径不会越界
|
|
59
65
|
if (explorerRoot !== '/') {
|
|
60
|
-
const resolvedRoot = path.resolve(explorerRoot);
|
|
61
66
|
if (!fullPath.startsWith(resolvedRoot)) {
|
|
62
67
|
return res.status(403).json({ error: 'Access denied' });
|
|
63
68
|
}
|
|
@@ -127,15 +132,20 @@ function init() {
|
|
|
127
132
|
filePath = decodeURIComponent(filePath);
|
|
128
133
|
|
|
129
134
|
let fullPath;
|
|
130
|
-
|
|
135
|
+
const resolvedRoot = path.resolve(explorerRoot);
|
|
136
|
+
|
|
137
|
+
if (explorerRoot === '/') {
|
|
138
|
+
// 根目录，可以直接使用绝对路径
|
|
131
139
|
fullPath = filePath;
|
|
132
140
|
} else {
|
|
133
|
-
|
|
141
|
+
// 非根目录，应该将 filePath 视为相对于 explorerRoot 的路径
|
|
142
|
+
// 如果 filePath 以 / 开头，去掉前面的 /
|
|
143
|
+
const relativePath = filePath.startsWith('/') ? filePath.substring(1) : filePath;
|
|
144
|
+
fullPath = path.resolve(explorerRoot, relativePath);
|
|
134
145
|
}
|
|
135
146
|
|
|
136
147
|
// 防止路径遍历攻击 - 确保路径不会越界
|
|
137
148
|
if (explorerRoot !== '/') {
|
|
138
|
-
const resolvedRoot = path.resolve(explorerRoot);
|
|
139
149
|
if (!fullPath.startsWith(resolvedRoot)) {
|
|
140
150
|
return res.status(403).json({ error: 'Access denied' });
|
|
141
151
|
}
|
|
@@ -181,15 +191,20 @@ function init() {
|
|
|
181
191
|
filePath = decodeURIComponent(filePath);
|
|
182
192
|
|
|
183
193
|
let fullPath;
|
|
184
|
-
|
|
194
|
+
const resolvedRoot = path.resolve(explorerRoot);
|
|
195
|
+
|
|
196
|
+
if (explorerRoot === '/') {
|
|
197
|
+
// 根目录，可以直接使用绝对路径
|
|
185
198
|
fullPath = filePath;
|
|
186
199
|
} else {
|
|
187
|
-
|
|
200
|
+
// 非根目录，应该将 filePath 视为相对于 explorerRoot 的路径
|
|
201
|
+
// 如果 filePath 以 / 开头，去掉前面的 /
|
|
202
|
+
const relativePath = filePath.startsWith('/') ? filePath.substring(1) : filePath;
|
|
203
|
+
fullPath = path.resolve(explorerRoot, relativePath);
|
|
188
204
|
}
|
|
189
205
|
|
|
190
206
|
// 防止路径遍历攻击 - 确保路径不会越界
|
|
191
207
|
if (explorerRoot !== '/') {
|
|
192
|
-
const resolvedRoot = path.resolve(explorerRoot);
|
|
193
208
|
if (!fullPath.startsWith(resolvedRoot)) {
|
|
194
209
|
return res.status(403).json({ error: 'Access denied' });
|
|
195
210
|
}
|