flipped-aurora/gin-vue-admin · error
路径越过根目录: %s
Error message
路径越过根目录: %s
What it means
pathWithin joins a root with user-supplied elements, absolutizes the result, and rejects it if it escapes the root (e.g. via ".." segments). This blocks path-traversal when building auto-code task paths from user input. newAutoCodeTaskLayout surfaces it verbatim.
Source
Thrown at server/service/system/auto_code_task.go:312
}
if isPathWithin(l.webRoot, target) {
return autoCodeTaskFrontend, nil
}
return "", fmt.Errorf("自动代码目标不在服务端或前端目录内: %s", target)
}
func pathWithin(root string, elems ...string) (string, error) {
root, err := filepath.Abs(root)
if err != nil {
return "", err
}
joined := filepath.Join(append([]string{root}, elems...)...)
joined, err = filepath.Abs(joined)
if err != nil {
return "", err
}
if !isPathWithin(root, joined) {
return "", fmt.Errorf("路径越过根目录: %s", joined)
}
return filepath.Clean(joined), nil
}
func isPathWithin(root, target string) bool {
rel, err := filepath.Rel(filepath.Clean(root), filepath.Clean(target))
if err != nil {
return false
}
return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) && !filepath.IsAbs(rel)
}
func hashAutoCodeTarget(target string) (string, bool, error) {
content, err := os.ReadFile(target)
if errors.Is(err, fs.ErrNotExist) {
return "", false, nil
}
if err != nil {View on GitHub (pinned to 3136500ef3)
Solutions
- Inspect the joined path in the error message; remove any '..' or absolute-path segments from the source data (DB record or request payload).
- Re-create the auto-code task/record with a relative path valid under the expected root.
- If paths come from user input, sanitize/reject them at the API layer before persisting.
- Verify the root passed to pathWithin is itself absolute and correct (AutoCode.Root + Server/Web).
Example fix
// before: elems from user input contain traversal
newAutoCodeTaskLayout(root, "../../etc/passwd")
// after: normalize and validate before calling
rel := filepath.ToSlash(filepath.Clean(userPath))
if strings.Contains(rel, "..") {
return errors.New("path must stay inside project")
}
newAutoCodeTaskLayout(root, rel) Defensive patterns
Strategy: validation
Validate before calling
func safeRelPath(p string) bool {
if filepath.IsAbs(p) || strings.Contains(p, "..") {
return false
}
return filepath.Clean(p) != "." && p != ""
} Try / catch
layout, err := newAutoCodeTaskLayout(root, elems...)
if err != nil {
if strings.Contains(err.Error(), "路径越过根目录") {
return fmt.Errorf("invalid stored path %q: %w", strings.Join(elems, "/"), err)
}
return err
} Prevention
- Store only cleaned relative paths in auto-code task records
- Reject user input containing '..' or absolute paths at the API layer
- Use filepath.Clean on any path before persisting it
When it happens
Trigger: Calling newAutoCodeTaskLayout with elements containing ../ or absolute components such that filepath.Join(root, elems...) resolves above root, e.g. elems = [".."] or a stored path captured with traversal characters.
Common situations: Malicious or buggy client input stored in an auto-code task record; joining a target file path recorded relative to a different root; copy-pasted Windows-style or absolute paths from another machine.
Related errors
AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31).
Data as JSON: /api/errors/2b798687e4f9baa9.
Report an issue: GitHub.