From 6a94b0626cbc7cff6ee319d52af38046b479f6e0 Mon Sep 17 00:00:00 2001 From: Wenjie Zhang Date: Fri, 2 Jan 2026 22:53:15 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E9=98=B2=E6=AD=A2=E8=B7=AF?= =?UTF-8?q?=E5=BE=84=E9=81=8D=E5=8E=86=E6=94=BB=E5=87=BB=E9=80=9A=E8=BF=87?= =?UTF-8?q?=E4=BD=BF=E7=94=A8basename=E5=A4=84=E7=90=86task=5Fid?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/services/evaluation_service.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/services/evaluation_service.py b/src/services/evaluation_service.py index c2dae9e9..89b0a241 100644 --- a/src/services/evaluation_service.py +++ b/src/services/evaluation_service.py @@ -767,7 +767,9 @@ class EvaluationService: async def get_evaluation_results_by_db( self, db_id: str, task_id: str, page: int = 1, page_size: int = 20, error_only: bool = False ) -> dict[str, Any]: - result_file_path = os.path.join(self._get_result_dir(db_id), f"{task_id}.json") + # Prevent path traversal by using basename + safe_task_id = os.path.basename(task_id) + result_file_path = os.path.join(self._get_result_dir(db_id), f"{safe_task_id}.json") if not os.path.exists(result_file_path): task = await tasker.get_task(task_id) if task: @@ -833,7 +835,9 @@ class EvaluationService: return data async def delete_evaluation_result_by_db(self, db_id: str, task_id: str) -> None: - result_file_path = os.path.join(self._get_result_dir(db_id), f"{task_id}.json") + # Prevent path traversal by using basename + safe_task_id = os.path.basename(task_id) + result_file_path = os.path.join(self._get_result_dir(db_id), f"{safe_task_id}.json") if os.path.exists(result_file_path): os.remove(result_file_path) logger.info(f"成功删除评估结果: {task_id}")