fz-mirrors/AstrBot
1
0
Fork 0
mirror of https://github.com/AstrBotDevs/AstrBot synced 2026-07-16 01:40:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: constrain custom workspace paths

Browse Source
This commit is contained in:
Soulter
2026-07-03 22:45:35 +08:00
parent ea9e3421d9
commit 6d798908ad
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
astrbot/core/workspace.py
View File

@@ -95,24 +95,24 @@ def workspace_path_to_root(path: str) -> Path:
Args:
path: Stored workspace path. Relative values are rooted under AstrBot
workspaces. Absolute values are allowed and resolved as provided.
workspaces. Absolute values must also point inside AstrBot workspaces.
Returns:
Absolute resolved path.
Raises:
ValueError: If a relative path escapes or targets the AstrBot workspaces
ValueError: If the path escapes or targets the AstrBot workspaces
root.
"""
workspaces_root = Path(get_astrbot_workspaces_path()).resolve(strict=False)
candidate = Path(path).expanduser()
if candidate.is_absolute():
return candidate.resolve(strict=False)
resolved = (workspaces_root / candidate).resolve(strict=False)
resolved = candidate.resolve(strict=False)
else:
resolved = (workspaces_root / candidate).resolve(strict=False)
if resolved == workspaces_root or not resolved.is_relative_to(workspaces_root):
raise ValueError(
"Relative workspace path must stay within a subdirectory of AstrBot workspaces"
"Custom workspace path must stay within a subdirectory of AstrBot workspaces"
)
return resolved