拒绝保留路径段的 Skill 名称

在 DirectProject Skill 校验中拒绝 . 与 .. 阻止 Skill 路径解析通过父目录段逃逸配置根目录
2026-09-15 19:56:50 +08:00
parent 1b8d4d3b94
commit e5f40df216
1 changed files with 1 additions and 0 deletions
@@ -40,6 +40,7 @@ pub(crate) fn validate_direct_codex_user_item(
                let name = name.trim();
                if name.is_empty()
                    || name.chars().count() > 120
+                    || matches!(name, "." | "..")
                    || name.chars().any(|character| {
                        character.is_control()
                            || character.is_whitespace()