Fix code scanning alert - Uncontrolled data used in path expression #36

Activity

1. houko commented on Sep 13, 2026

   

   houko

   on Sep 13, 2026

   OwnerAuthor

   More actions

   该告警已在 PR #44（fix: resolve all six CodeQL security alerts, 提交 0597a65）中修复：FileUtil 上传文件落盘前先过滤路径字符，并用 normalize() + startsWith() 把路径限制在 upload 目录内，防止目录穿越。CodeQL 复扫后该告警已标记为 fixed，关闭。
2. houko

   closed this as completedon Sep 13, 2026