figmar/wikiskill
1
0
Fork 0
mirror of https://github.com/kenhuangus/wikiskill synced 2026-09-22 23:34:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

CI fix: reject Windows drive-letter paths in _safe_root (os.path.isabs is POSIX-only on Linux runners)

Browse Source
This commit is contained in:
DistributedApps.AI
2026-08-31 11:38:02 -04:00
parent 69066b3368
commit 0363334582
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wikiskill/webapp/api.py
+4 -2
View File
@@ -31,11 +31,13 @@ def create_app(test_config=None) -> Flask:
def _safe_root(root: str) -> str:
"""Reject absolute paths and path traversal; normalize to a relative name."""
"""Reject absolute paths (POSIX + Windows drive/UNC) and path traversal;
normalize to a relative name. Must be platform-independent (tests run on Linux)."""
root = (root or "").strip().replace("\\", "/").strip("/")
if not root:
raise ValueError("workspace root must not be empty")
if os.path.isabs(root):
drive = len(root) >= 2 and root[1] == ":" and root[0].isalpha() # C:/...
if os.path.isabs(root) or drive or root.startswith("//"):
raise ValueError("workspace root must be a relative path")
if any(part == ".." for part in root.split("/")):
raise ValueError("workspace root must not contain '..'")