From 6d798908ad8a60f0822caf490933e7c4bcf92c14 Mon Sep 17 00:00:00 2001
From: Soulter <905617992@qq.com>
Date: Fri, 3 Jul 2026 22:45:35 +0800
Subject: [PATCH] fix: constrain custom workspace paths

---
 astrbot/core/workspace.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/astrbot/core/workspace.py b/astrbot/core/workspace.py
index 00ff5c5f0..822f6da04 100644
--- a/astrbot/core/workspace.py
+++ b/astrbot/core/workspace.py
@@ -95,24 +95,24 @@ def workspace_path_to_root(path: str) -> Path:
 
     Args:
         path: Stored workspace path. Relative values are rooted under AstrBot
-            workspaces. Absolute values are allowed and resolved as provided.
+            workspaces. Absolute values must also point inside AstrBot workspaces.
 
     Returns:
         Absolute resolved path.
 
     Raises:
-        ValueError: If a relative path escapes or targets the AstrBot workspaces
+        ValueError: If the path escapes or targets the AstrBot workspaces
             root.
     """
     workspaces_root = Path(get_astrbot_workspaces_path()).resolve(strict=False)
     candidate = Path(path).expanduser()
     if candidate.is_absolute():
-        return candidate.resolve(strict=False)
-
-    resolved = (workspaces_root / candidate).resolve(strict=False)
+        resolved = candidate.resolve(strict=False)
+    else:
+        resolved = (workspaces_root / candidate).resolve(strict=False)
     if resolved == workspaces_root or not resolved.is_relative_to(workspaces_root):
         raise ValueError(
-            "Relative workspace path must stay within a subdirectory of AstrBot workspaces"
+            "Custom workspace path must stay within a subdirectory of AstrBot workspaces"
         )
     return resolved