checkPathSecurity 检查路径安全
(cmd string)
| 708 | |
| 709 | // checkPathSecurity 检查路径安全 |
| 710 | func (ls *LocalSandbox) checkPathSecurity(cmd string) string { |
| 711 | // 提取命令中的路径 |
| 712 | paths := ls.extractPaths(cmd) |
| 713 | |
| 714 | for _, path := range paths { |
| 715 | // 规范化路径 |
| 716 | absPath, err := filepath.Abs(path) |
| 717 | if err != nil { |
| 718 | continue |
| 719 | } |
| 720 | |
| 721 | // 检查是否访问敏感路径 |
| 722 | for _, sensitive := range sensitivePaths { |
| 723 | if strings.HasPrefix(absPath, sensitive) { |
| 724 | return "access to sensitive path: " + sensitive |
| 725 | } |
| 726 | } |
| 727 | |
| 728 | // 检查路径遍历攻击 |
| 729 | if strings.Contains(path, "..") { |
| 730 | // 检查规范化后是否超出工作目录 |
| 731 | if ls.enforceBoundary && !ls.fs.IsInside(absPath) { |
| 732 | return "path traversal detected: " + path |
| 733 | } |
| 734 | } |
| 735 | } |
| 736 | |
| 737 | return "" |
| 738 | } |
| 739 | |
| 740 | // extractPaths 从命令中提取路径 |
| 741 | func (ls *LocalSandbox) extractPaths(cmd string) []string { |
no test coverage detected