壓縮包項目為何會走出指定匯入資料夾？

先核來源與已訂規則

本例記憶體內的項目，只容相對檔案路徑且須在 /import 之下。../outside.txt 解清會到 /outside.txt，要暫停。絕對項目名稱在此也禁止，字面指向根內也一樣；不對主機解包。

已填假設輸入
紀錄	輸入 JSON
原例輸入	{"name":"../outside.txt"}

下載可編輯 CSV ↓

比較兩條實際路徑

更正保來源名稱及 path-escape 決定。相對段能往根目錄外走，只看拼接字樣似安全並不足夠。

錯誤與更正路徑的輸出
路徑	輸出 JSON
錯誤路徑	{"accepted":true,"source":"../outside.txt","destination":"/outside.txt"}
更正路徑	{"accepted":false,"error":"path-escape","source":"../outside.txt"}

下載可編輯 CSV ↓

本地 Node.js 程序：22.23.3 或 24.14.1

import {DatabaseSync} from 'node:sqlite';
import {TextDecoder} from 'node:util';
import {inflateSync} from 'node:zlib';
import {posix} from 'node:path';
import {createHash} from 'node:crypto';
const rows=(db,sql)=>db.prepare(sql).all().map(r=>({...r}));
const failed=(action)=>{try{action();return null;}catch(e){return {code:e.errcode??e.code??e.name};}};

import assert from 'node:assert/strict';
const run=function run(i,corrected=true){
    const destination=posix.resolve('/import',i.name);
    if(corrected&&(posix.isAbsolute(i.name)||!destination.startsWith('/import/')))return {accepted:false,error:posix.isAbsolute(i.name)?'absolute-entry':'path-escape',source:i.name};
    return {accepted:true,source:i.name,destination};
  };
const cases=[{"label":"misleading base","input":{"name":"../outside.txt"},"expected":{"accepted":true,"source":"../outside.txt","destination":"/outside.txt"},"corrected":false},{"label":"corrected base","input":{"name":"../outside.txt"},"expected":{"accepted":false,"error":"path-escape","source":"../outside.txt"},"corrected":true},{"label":"ordinary contained entry","input":{"name":"docs/a.txt"},"expected":{"accepted":true,"source":"docs/a.txt","destination":"/import/docs/a.txt"},"corrected":true},{"label":"absolute source entry rejected","input":{"name":"/import/a.txt"},"expected":{"accepted":false,"error":"absolute-entry","source":"/import/a.txt"},"corrected":true}];
for(const test of cases){
  const actual=run(test.input,test.corrected);
  assert.deepEqual(actual,test.expected,test.label);
  console.log(test.label,actual);
}

下載可執行例子 ↓

下次載入前核邊界

docs/a.txt 解到 /import 內；絕對 /import/a.txt 因明訂相對項目約定而拒。

可編輯邊界紀錄及預期輸出
情況	輸入 JSON	預期輸出 JSON
根內相對目標	{"name":"docs/a.txt"}	{"accepted":true,"source":"docs/a.txt","destination":"/import/docs/a.txt"}
禁止絕對項目名稱	{"name":"/import/a.txt"}	{"accepted":false,"error":"absolute-entry","source":"/import/a.txt"}

下載可編輯 CSV ↓

../outside.txt 解到哪裏，應否繼續？

查看參考答案

到 /outside.txt，須暫停。此約定可收的是根內相對 docs/a.txt。

先核來源與已訂規則

比較兩條實際路徑

下次載入前核邊界

相關資源