GetSkillFileInfo returns file metadata for streaming preview
(ctx context.Context, eid, skillID int64, filePath string)
| 886 | |
| 887 | // GetSkillFileInfo returns file metadata for streaming preview |
| 888 | func (s *SkillLibraryService) GetSkillFileInfo(ctx context.Context, eid, skillID int64, filePath string) (*SkillFileInfo, error) { |
| 889 | skill, err := model.GetSkillLibraryByID(skillID) |
| 890 | if err != nil { |
| 891 | return nil, err |
| 892 | } |
| 893 | |
| 894 | if skill.Eid != 0 && skill.Eid != eid { |
| 895 | return nil, ErrSkillNotVisible |
| 896 | } |
| 897 | |
| 898 | installPath := skill.InstallPath |
| 899 | if installPath == "" { |
| 900 | return nil, errors.New("skill install path is empty") |
| 901 | } |
| 902 | |
| 903 | cleanPath := filepath.Clean(filePath) |
| 904 | if strings.Contains(cleanPath, "..") { |
| 905 | return nil, ErrSkillScanZipPathTraversal |
| 906 | } |
| 907 | if filepath.IsAbs(cleanPath) { |
| 908 | return nil, ErrSkillScanZipPathTraversal |
| 909 | } |
| 910 | |
| 911 | fullPath := filepath.Join(installPath, cleanPath) |
| 912 | fullPath = filepath.Clean(fullPath) |
| 913 | if !strings.HasPrefix(fullPath, installPath+string(filepath.Separator)) && fullPath != installPath { |
| 914 | return nil, ErrSkillScanZipPathTraversal |
| 915 | } |
| 916 | |
| 917 | info, err := os.Stat(fullPath) |
| 918 | if err != nil { |
| 919 | return nil, err |
| 920 | } |
| 921 | if info.IsDir() { |
| 922 | return nil, errors.New("path is a directory, not a file") |
| 923 | } |
| 924 | |
| 925 | const maxFileSize = 10 * 1024 * 1024 |
| 926 | if info.Size() > maxFileSize { |
| 927 | return nil, errors.New("file size exceeds maximum limit (10MB)") |
| 928 | } |
| 929 | |
| 930 | return &SkillFileInfo{ |
| 931 | FullPath: fullPath, |
| 932 | Size: info.Size(), |
| 933 | ModTime: info.ModTime(), |
| 934 | }, nil |
| 935 | } |
| 936 | |
| 937 | // buildSkillFileTree walks the directory and builds file tree |
| 938 | func buildSkillFileTree(rootPath string) ([]SkillFileItem, error) { |
no test coverage detected