From 0564121dfcf5fc27a125522ada0c2fc15a442f75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= Date: Tue, 1 Sep 2026 15:28:44 +0800 Subject: [PATCH] =?UTF-8?q?=E6=8B=92=E7=BB=9D=20UI=20=E8=B5=84=E6=BA=90?= =?UTF-8?q?=E8=B7=AF=E5=BE=84=E5=8F=8D=E6=96=9C=E6=9D=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 阻止浏览器路径归一化导致的资源目录逃逸 当前资源尚未上线，不增加迁移流程 --- .../src-tauri/src/ui_editor/html_renderer/assets.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/ai-game-creator-shell/src-tauri/src/ui_editor/html_renderer/assets.rs b/apps/ai-game-creator-shell/src-tauri/src/ui_editor/html_renderer/assets.rs index 2ba1c5913..12e9a5178 100644 --- a/apps/ai-game-creator-shell/src-tauri/src/ui_editor/html_renderer/assets.rs +++ b/apps/ai-game-creator-shell/src-tauri/src/ui_editor/html_renderer/assets.rs @@ -20,6 +20,7 @@ pub(super) fn asset_url(path: &str) -> Result { let path = path.trim(); if path.is_empty() || path.starts_with('/') + || path.contains('\\') || path.split('/').any(|part| part == "..") || path.chars().any(|character| { character.is_control() || matches!(character, '\'' | '"' | '`' | '(' | ')')