INNER CODE UNIT · Rust
delete_imported_novel
mouseart2025/AI-Reader-V2 · frontend/src-tauri/src/lib.rs:568
fn delete_imported_novel(app: tauri::AppHandle, slug: String) -> Result<(), String> {
let novels_dir = get_novels_dir(&app)?;
let novel_dir = novels_dir.join(&slug);
// H1 fix: Path traversal protection — ensure resolved path stays within novels_dir
let canonical_dir = novel_dir.canonicalize()
.map_err(|_| "该小说数据不存在".to_string())?;
let canonical_base = novels_dir.canonicalize()
.map_err(|e| format!("无法解析数据目录: {e}"))?;
if !canonical_dir.starts_with(&canonical_base) {
return Err("不能删除预装小说".to_string());
}
// Safety: ensure the slug only belongs to user-imported data
if is_preinstalled(&app, &slug) {
return Err("不能删除预装小说".to_string());
}