BigPizzaV3/CodexPlusPlus · error

无效的市场主题下载文件名

Error message

无效的市场主题下载文件名

What it means

Validation guard in market_download_path: the theme id fails valid_theme_id or the extension is not one of png/jpg/gif/bmp/webp. Because the id and extension are concatenated into a filesystem path, invalid values are refused to prevent path injection and unsupported file types.

Source

Thrown at crates/codex-plus-core/src/dream_skin_market.rs:326

        });
    }
    let records: MarketInstallRecords = serde_json::from_slice(&std::fs::read(path)?)?;
    if records.schema_version != market_schema_version() {
        bail!("不支持的主题市场安装记录版本");
    }
    Ok(records)
}

fn record_market_install(state_dir: &Path, id: &str, version: &str) -> anyhow::Result<()> {
    let mut records = read_install_records(state_dir)?;
    records.themes.insert(id.to_string(), version.to_string());
    let bytes = serde_json::to_vec_pretty(&records)?;
    crate::settings::atomic_write(&state_dir.join(MARKET_INSTALLS_FILE), &bytes)
}

fn market_download_path(state_dir: &Path, id: &str, extension: &str) -> anyhow::Result<PathBuf> {
    if !valid_theme_id(id) || !matches!(extension, "png" | "jpg" | "gif" | "bmp" | "webp") {
        bail!("无效的市场主题下载文件名");
    }
    Ok(state_dir
        .join("dream-skin/market/downloads")
        .join(format!("{id}.{extension}")))
}

fn market_asset_url(base_url: &str, relative: &str) -> anyhow::Result<String> {
    validate_market_path(relative)?;
    let base = reqwest::Url::parse(base_url).context("主题市场基础地址无效")?;
    let joined = base.join(relative).context("主题市场资源地址无效")?;
    if joined.scheme() != base.scheme() || joined.host_str() != base.host_str() {
        bail!("主题市场资源地址越界");
    }
    Ok(joined.to_string())
}

fn validate_market_path(value: &str) -> anyhow::Result<()> {
    if value.is_empty()

View on GitHub (pinned to f2074595a2)

Solutions

1. Ensure the theme id matches the allowed id format
2. Use a supported image extension (png, jpg, gif, bmp, webp)

When it happens

Trigger: Thrown at crates/codex-plus-core/src/dream_skin_market.rs:326 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BigPizzaV3/CodexPlusPlus@f2074595a2 (2026-08-23). Data as JSON: /api/errors/d2e8bc9c561a6b5a. Report an issue: GitHub.