* 安全路径校验
(path: string)
| 59 | * 安全路径校验 |
| 60 | */ |
| 61 | function validatePath(path: string): string { |
| 62 | if (path.startsWith("/")) { |
| 63 | throw new Error("Absolute paths not allowed"); |
| 64 | } |
| 65 | if (path.includes("..")) { |
| 66 | throw new Error("Path traversal not allowed"); |
| 67 | } |
| 68 | const fullPath = join(CUSTOM_DIR, path); |
| 69 | if (!fullPath.startsWith(CUSTOM_DIR)) { |
| 70 | throw new Error("Path traversal detected"); |
| 71 | } |
| 72 | return fullPath; |
| 73 | } |
| 74 | |
| 75 | export const luaRuntime: LuaRuntime = { |
| 76 | async initialize(): Promise<void> { |