fix: prevent path traversal vulnerability in knowledge base upload filenames (#8971)

2026-09-01 15:32:49 +08:00 · 2026-06-24 15:55:01 +08:00
parent ae29a7eaf9
commit 5266d170a3
1 changed files with 3 additions and 1 deletions
@@ -495,7 +495,9 @@ class KnowledgeBaseService:

        files_to_upload = []
        for file in file_list:
-            file_name = file.filename
+            file_name = Path(str(file.filename or "document").replace("\\", "/")).name
+            if file_name in {"", ".", ".."}:
+                file_name = "document"
            temp_file_path = (
                Path(get_astrbot_temp_path()) / f"kb_upload_{uuid.uuid4()}_{file_name}"
            )