fix: 修复图像服务接口中的路径越界访问和文件不存在错误处理

This commit is contained in:
晓丰 2025-06-06 22:58:51 +08:00
parent 848f21b609
commit 101a819663

View File

@ -10,19 +10,26 @@ SCREENSHOTS_DIR = PROJECT_ROOT / "screenshots"
@app.route('/image/<path:filename>')
def serve_image(filename):
app = Flask(__name__)
PROJECT_ROOT = Path(__file__).parent.resolve()
SCREENSHOTS_DIR = PROJECT_ROOT / "screenshots"
@app.route('/image/<path:filename>')
def serve_image(filename):
file_path = SCREENSHOTS_DIR / filename
# 防止路径越界访问
try:
file_path.resolve().relative_to(SCREENSHOTS_DIR.resolve())
except ValueError:
abort(403, "禁止访问目录外文件")
abort(403, description=f"禁止访问目录外文件: {file_path.resolve()}")
if not file_path.exists():
abort(404, "文件不存在")
abort(404, description=f"文件不存在: {file_path.resolve()}")
return send_file(file_path, as_attachment=False)
if __name__ == '__main__':
app.run(host='0.0.0.0', debug=False, port=5000)
app.run(host='0.0.0.0', debug=True, port=5000)