{"record":{"id":"308245853cfe6a24","repo":"babalae/better-genshin-impact","slug":"path","errorCode":null,"errorMessage":"文件路径 '{path}' 包含非法字符","messagePattern":"文件路径 '(.+?)' 包含非法字符","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"BetterGenshinImpact/Core/Script/Utils/ScriptUtils.cs","lineNumber":23,"sourceCode":"namespace BetterGenshinImpact.Core.Script.Utils;\n\npublic class ScriptUtils\n{\n    /// <summary>\n    /// Normalize and validate a path.\n    /// </summary>\n    public static string NormalizePath(string root, string path)\n    {\n        // 校验空字符串\n        if (string.IsNullOrWhiteSpace(path))\n            throw new ArgumentException(\"文件路径不能为空\");\n\n        // 检查是否含有非法文件名字符\n        var invalidChars = Path.GetInvalidFileNameChars();\n        string fileName = Path.GetFileName(path);\n        if (fileName.Any(c => invalidChars.Contains(c)))\n        {\n            throw new ArgumentException($\"文件路径 '{path}' 包含非法字符\");\n        }\n\n        // 替换分隔符\n        path = path.Replace('\\\\', '/');\n\n        // 组合并获取绝对路径\n        var fullPath = Path.GetFullPath(Path.Combine(root, path));\n\n        // 防止越界访问\n        if (!fullPath.StartsWith(root, StringComparison.OrdinalIgnoreCase))\n        {\n            throw new ArgumentException($\"文件路径 '{path}' 越界访问!\");\n        }\n\n        return fullPath;\n    }\n}\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/babalae/better-genshin-impact/blob/a7cb36712dcb409be610257d877fcea3597e9d6b/BetterGenshinImpact/Core/Script/Utils/ScriptUtils.cs#L5-L41","documentation":"Thrown by ScriptUtils.NormalizePath when the file-name portion of the input path contains characters considered invalid for file names by the OS (Path.GetInvalidFileNameChars — e.g., <, >, |, \", :, or control chars on Windows). The check inspects only the GetFileName portion.","triggerScenarios":"NormalizePath receives a path whose final segment (Path.GetFileName) includes an OS-invalid char. Examples: 'scripts/foo<bar.js', 'a/b:c.js' on Windows (colon), 'x/y|z.txt'. The invalidChars set is platform-specific (Windows is stricter than Linux).","commonSituations":"A manifest or webview request supplies a path with shell-special or reserved characters; cross-platform mismatch (a path valid on Linux fails on Windows where ':' and others are illegal); user-typed filename with stray punctuation.","solutions":["Sanitize the path at the source: strip or replace invalid chars before calling NormalizePath.","If the path is user-supplied, validate against a whitelist pattern (e.g., ^[A-Za-z0-9._/-]+$) and reject early with a clear message.","Note GetFileName returns the whole path if no separator is present — for directory-like inputs ensure the check targets the intended segment."],"exampleFix":"// before\nvar invalidChars = Path.GetInvalidFileNameChars();\nstring fileName = Path.GetFileName(path);\nif (fileName.Any(c => invalidChars.Contains(c)))\n    throw new ArgumentException($\"文件路径 '{path}' 包含非法字符\");\n\n// after (name the offending chars)\nvar invalidChars = Path.GetInvalidFileNameChars();\nstring fileName = Path.GetFileName(path);\nvar found = fileName.Where(c => invalidChars.Contains(c)).Distinct().ToArray();\nif (found.Length > 0)\n    throw new ArgumentException(\n        $\"文件路径 '{path}' 包含非法字符: {string.Join(\", \", found.Select(c => $\"'{c}'\"))}\", nameof(path));","handlingStrategy":"validation","validationCode":"// Whitelist filenames from untrusted sources\nif (!System.Text.RegularExpressions.Regex.IsMatch(fileName, @\"^[A-Za-z0-9._-]+(\\.[A-Za-z0-9]+)?$\"))\n    throw new ArgumentException($\"文件名包含非法字符: {fileName}\");","typeGuard":"static bool HasNoInvalidChars(string fileName)\n{\n    var invalid = Path.GetInvalidFileNameChars();\n    return !fileName.Any(c => invalid.Contains(c));\n}","tryCatchPattern":"catch (ArgumentException ex) when (ex.Message.Contains(\"非法字符\"))\n{\n    Toast.Error($\"文件名非法: {ex.Message}\");\n}","preventionTips":["Whitelist filenames from webview/manifest sources.","Name the offending chars in the error.","Remember Windows outlaws ':' and others that Linux allows — validate for the runtime OS."],"tags":["validation","path","filesystem","security","windows"],"backgroundTag":null,"analyzedSha":"a7cb36712dcb409be610257d877fcea3597e9d6b","analyzedAt":"2026-08-13T16:44:57.548Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}