BigPizzaV3/CodexPlusPlus · error

主题市场资源地址越界

Error message

主题市场资源地址越界

What it means

Security guard in market_asset_url: joining the relative path onto the base URL produced a URL with a different scheme or host than the base. This blocks absolute URLs or traversal tricks inside manifest fields from redirecting downloads to third-party servers.

Source

Thrown at crates/codex-plus-core/src/dream_skin_market.rs:338

    let bytes = serde_json::to_vec_pretty(&records)?;
    crate::settings::atomic_write(&state_dir.join(MARKET_INSTALLS_FILE), &bytes)
}

fn market_download_path(state_dir: &Path, id: &str, extension: &str) -> anyhow::Result<PathBuf> {
    if !valid_theme_id(id) || !matches!(extension, "png" | "jpg" | "gif" | "bmp" | "webp") {
        bail!("无效的市场主题下载文件名");
    }
    Ok(state_dir
        .join("dream-skin/market/downloads")
        .join(format!("{id}.{extension}")))
}

fn market_asset_url(base_url: &str, relative: &str) -> anyhow::Result<String> {
    validate_market_path(relative)?;
    let base = reqwest::Url::parse(base_url).context("主题市场基础地址无效")?;
    let joined = base.join(relative).context("主题市场资源地址无效")?;
    if joined.scheme() != base.scheme() || joined.host_str() != base.host_str() {
        bail!("主题市场资源地址越界");
    }
    Ok(joined.to_string())
}

fn validate_market_path(value: &str) -> anyhow::Result<()> {
    if value.is_empty()
        || value.len() > 256
        || value.starts_with('/')
        || value.contains('\\')
        || value.contains(['?', '#', '\0'])
    {
        bail!("无效的主题市场相对路径");
    }
    for segment in value.split('/') {
        if segment.is_empty()
            || matches!(segment, "." | "..")
            || !segment
                .bytes()

View on GitHub (pinned to f2074595a2)

Solutions

1. Use a plain relative path in the manifest field
2. Fix the manifest entry that embeds a foreign-host URL

When it happens

Trigger: Thrown at crates/codex-plus-core/src/dream_skin_market.rs:338 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BigPizzaV3/CodexPlusPlus@f2074595a2 (2026-08-23). Data as JSON: /api/errors/ce6c1055d02cd949. Report an issue: GitHub.