fix: 添加 glob 函数 pattern 参数的安全验证

2026-03-10 09:34:57 +08:00 · 2026-03-10 09:34:57 +08:00 · 9a4ff4713a
commit 9a4ff4713a
parent ac21126d2b
1 changed files with 5 additions and 0 deletions
--- a/internal/room/tools/executor.go
+++ b/internal/room/tools/executor.go
@ -66,6 +66,11 @@ func (e *Executor) glob(args string) (string, error) {
 		return "", err
 	}

+	_, err := e.safePath(a.Pattern)
+	if err != nil {
+		return "", err
+	}
+
 	pattern := filepath.Join(e.workspaceDir, a.Pattern)
 	files, err := filepath.Glob(pattern)
 	if err != nil {