路徑看似在根內，為何實際解析仍走出去？

先核來源與已訂規則

本例記憶體樹明訂 /import/docs 是指 /outside 的符號連結。docs/a.txt 沒有 ..，字面根檢查可過，解連結後卻在外。程序沿已訂不重疊連結前綴，查重訪，再核是否根內。

已填假設輸入
紀錄	輸入 JSON
原例輸入	{"name":"docs/a.txt","links":[{"path":"/import/docs","target":"/outside"}]}

下載可編輯 CSV ↓

比較兩條實際路徑

更正暫停 resolved-path-escape。檢查只用假設樹，不把真正檔案系統當作沒有連結變動或競爭情況。

錯誤與更正路徑的輸出
路徑	輸出 JSON
錯誤路徑	{"accepted":true,"source":"docs/a.txt","destination":"/import/docs/a.txt"}
更正路徑	{"accepted":false,"error":"resolved-path-escape","source":"docs/a.txt"}

下載可編輯 CSV ↓

本地 Node.js 程序：22.23.3 或 24.14.1

import {DatabaseSync} from 'node:sqlite';
import {TextDecoder} from 'node:util';
import {inflateSync} from 'node:zlib';
import {posix} from 'node:path';
import {createHash} from 'node:crypto';
const rows=(db,sql)=>db.prepare(sql).all().map(r=>({...r}));
const failed=(action)=>{try{action();return null;}catch(e){return {code:e.errcode??e.code??e.name};}};

import assert from 'node:assert/strict';
const run=function run(i,corrected=true){
    let destination=posix.resolve('/import',i.name);const seen=new Set();
    if(corrected){for(;;){const link=i.links.find(l=>destination===l.path||destination.startsWith(l.path+'/'));if(!link)break;
        if(seen.has(link.path))return {accepted:false,error:'symlink-cycle',source:i.name};seen.add(link.path);
        destination=posix.resolve(link.target)+destination.slice(link.path.length);}
      if(!destination.startsWith('/import/'))return {accepted:false,error:'resolved-path-escape',source:i.name};}
    return {accepted:true,source:i.name,destination};
  };
const cases=[{"label":"misleading base","input":{"name":"docs/a.txt","links":[{"path":"/import/docs","target":"/outside"}]},"expected":{"accepted":true,"source":"docs/a.txt","destination":"/import/docs/a.txt"},"corrected":false},{"label":"corrected base","input":{"name":"docs/a.txt","links":[{"path":"/import/docs","target":"/outside"}]},"expected":{"accepted":false,"error":"resolved-path-escape","source":"docs/a.txt"},"corrected":true},{"label":"ordinary directory tree","input":{"name":"docs/a.txt","links":[]},"expected":{"accepted":true,"source":"docs/a.txt","destination":"/import/docs/a.txt"},"corrected":true},{"label":"synthetic symlink cycle","input":{"name":"docs/a.txt","links":[{"path":"/import/docs","target":"/import/more"},{"path":"/import/more","target":"/import/docs"}]},"expected":{"accepted":false,"error":"symlink-cycle","source":"docs/a.txt"},"corrected":true}];
for(const test of cases){
  const actual=run(test.input,test.corrected);
  assert.deepEqual(actual,test.expected,test.label);
  console.log(test.label,actual);
}

下載可執行例子 ↓

下次載入前核邊界

普通目錄可收；docs↔more 循環則在收目標前暫停。

可編輯邊界紀錄及預期輸出
情況	輸入 JSON	預期輸出 JSON
普通目錄樹	{"name":"docs/a.txt","links":[]}	{"accepted":true,"source":"docs/a.txt","destination":"/import/docs/a.txt"}
符號連結循環	{"name":"docs/a.txt","links":[{"path":"/import/docs","target":"/import/more"},{"path":"/import/more","target":"/import/docs"}]}	{"accepted":false,"error":"symlink-cycle","source":"docs/a.txt"}

下載可編輯 CSV ↓

此處沒有 ..，是否已能確認在根內？

查看參考答案

不能，本例 docs 連到 /outside。須解連結樹，再暫停該項。

先核來源與已訂規則

比較兩條實際路徑

下次載入前核邊界

相關資源