Skip to content

Commit d685bbf

Browse files
datao2001PIKACHUIM
andauthored
fix(api/remove): add validation for empty items in delete file list (OpenListTeam#1617)
* fix(FsRemove): add validation for empty items in delete file list If Req.Names contains an empty string item, the whole directory will be removed. As a result we need add a simple guard to prevent such cases. Signed-off-by: huyuantao <huyuantao@ultrarisc.com> * fix(FsRemove): enhance validation to prevent unintended directory deletion 1. Use `utils.FixAndCleanPath` to correctly identify and block invalid names. 2. Change error handling from `return` to `continue`. Signed-off-by: huyuantao <huyuantao@ultrarisc.com> --------- Signed-off-by: huyuantao <huyuantao@ultrarisc.com> Co-authored-by: Pikachu Ren <40362270+PIKACHUIM@users.noreply.github.com>
1 parent 27732cc commit d685bbf

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

server/handles/fsmanage.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,11 @@ func FsRemove(c *gin.Context) {
282282
return
283283
}
284284
for _, name := range req.Names {
285+
// Skip invalid item names (empty string, whitespace, ".", "/","\t\t","..") to prevent accidental removal of current directory
286+
if strings.TrimSpace(utils.FixAndCleanPath(name)) == "/" {
287+
utils.Log.Warnf("FsRemove: invalid item skipped: %s (parent directory: %s)\n", name, reqDir)
288+
continue
289+
}
285290
err := fs.Remove(c.Request.Context(), stdpath.Join(reqDir, name))
286291
if err != nil {
287292
common.ErrorResp(c, err, 500)

0 commit comments

Comments
 (0)