@@ -49,11 +49,15 @@ const HAS_FILE_EXT = /\.\w{1,10}$/;
4949// Matches ".." as a standalone path segment (start, middle, or end).
5050const TRAVERSAL_SEGMENT_RE = /(?:^|[/\\])\.\.(?:[/\\]|$)/;
515152-function hasTraversalOrHomeDirPrefix(candidate: string): boolean {
52+function isSupportedHomeRelativePath(candidate: string): boolean {
53+return candidate.startsWith("~/") || candidate.startsWith("~\\");
54+}
55+56+function hasTraversalOrUnsupportedHomeDirPrefix(candidate: string): boolean {
5357return (
5458candidate.startsWith("../") ||
5559candidate === ".." ||
56-candidate.startsWith("~") ||
60+(candidate.startsWith("~") && !isSupportedHomeRelativePath(candidate)) ||
5761TRAVERSAL_SEGMENT_RE.test(candidate)
5862);
5963}
@@ -73,14 +77,15 @@ function looksLikeLocalFilePath(candidate: string): boolean {
7377}
74787579// Recognize safe local file path patterns for media approval, rejecting
76-// traversal and home-dir paths so they never reach downstream load/send logic.
80+// traversal and unsupported home-dir paths so they never reach downstream load/send logic.
7781function isLikelyLocalPath(candidate: string): boolean {
78-if (hasTraversalOrHomeDirPrefix(candidate)) {
82+if (hasTraversalOrUnsupportedHomeDirPrefix(candidate)) {
7983return false;
8084}
8185return (
8286candidate.startsWith("/") ||
8387candidate.startsWith("./") ||
88+isSupportedHomeRelativePath(candidate) ||
8489WINDOWS_DRIVE_RE.test(candidate) ||
8590candidate.startsWith("\\\\") ||
8691(!SCHEME_RE.test(candidate) && (candidate.includes("/") || candidate.includes("\\")))
@@ -171,9 +176,9 @@ function isValidMedia(
171176return true;
172177}
173178174-// Hard reject traversal/home-dir patterns before the bare-filename fallback
179+// Hard reject traversal/unsupported home-dir patterns before the bare-filename fallback
175180// to prevent path traversal bypasses (e.g. "../../.env" matching HAS_FILE_EXT).
176-if (hasTraversalOrHomeDirPrefix(candidate)) {
181+if (hasTraversalOrUnsupportedHomeDirPrefix(candidate)) {
177182return false;
178183}
179184此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。