INNER CODE UNIT · JavaScript
resolveSafely
wangshengithub/staticshield · src/server.js:28
function resolveSafely(tmpDir, fileRel) {
fileRel = String(fileRel || '').replace(/^\.\//, '').replace(/\\/g, '/');
if (!fileRel || fileRel.indexOf('..') >= 0 || /^[\\/]/.test(fileRel)) throw new Error('非法文件路径');
var fp = path.join(tmpDir, fileRel);
var rel = path.relative(tmpDir, fp);
if (rel === '' || rel.indexOf('..') === 0 || path.isAbsolute(rel)) throw new Error('文件路径越界');
return fp;
}
function safeWrite(tmpDir, fileRel, content, isDataUri) {
var fp = resolveSafely(tmpDir, fileRel);
fs.mkdirSync(path.dirname(fp), { recursive: true });
if (isDataUri) { var m = /^data:[^;]*;base64,(.*)$/s.exec(content); fs.writeFileSync(fp, Buffer.from(m ? m[1] : content, 'base64')); }
else fs.writeFileSync(fp, content);
}
async function doEncrypt(body) {
if (!body || typeof body !== 'object') throw new Error('请求体格式错误');
var password = body.password, files = body.files, mode = body.mode || 'single';
if (!password) throw new Error('密码不能为空');