fix asset bug (#150)

This commit is contained in:
patterniha authored and GitHub committed 2025-05-03 08:40:25 +08:00
1 parent bafb45ffcf
commit 443ae5f577
1 file changed
+4 -18
+4 -18
View File
@@ -78,25 +78,11 @@ func InitCoreEnv(envPath string, key string) {
// Custom file reader with path validation
corefilesystem.NewFileReader = func(path string) (io.ReadCloser, error) {
// G304 Fix - Path sanitization
baseDir := envPath
cleanPath := filepath.Clean(path)
fullPath := filepath.Join(baseDir, cleanPath)
// Prevent directory traversal
if baseDir != "" && !strings.HasPrefix(fullPath, baseDir) {
return nil, fmt.Errorf("unauthorized path: %s", path)
if _, err := os.Stat(path); os.IsNotExist(err) {
_, file := filepath.Split(path)
return mobasset.Open(file)
}
// Check file existence
if _, err := os.Stat(fullPath); os.IsNotExist(err) {
_, file := filepath.Split(fullPath)
return mobasset.Open(file) // Fallback to assets
} else if err != nil {
return nil, fmt.Errorf("file access error: %w", err)
}
return os.Open(fullPath) // #nosec G304 - Validated path
return os.Open(path)
}
}