fix: prevent cloud storage download path traversal

2026-09-05 07:27:15 +08:00 · 2026-06-05 17:43:06 +08:00
parent 871d1ec0d8
commit a0b3800f6b
6 changed files with 275 additions and 5 deletions
@@ -340,7 +340,9 @@ class Rclone(StorageBase):
        """
        带实时进度显示的下载
        """
-        local_path = (path or settings.TEMP_PATH) / fileitem.name
+        local_path = self._build_download_path(fileitem, path or settings.TEMP_PATH)
+        if not local_path:
+            return None
        
        # 初始化进度条
        logger.info(f"【rclone】开始下载: {fileitem.name} -> {local_path}")