fix(backend): single error body on pages paths, reject newline entry names, empty-index cache skip

2026-09-05 20:56:05 +08:00
parent 0946f6be5a
commit 8206c7a4ed
3 changed files with 13 additions and 5 deletions
@@ -15,7 +15,7 @@ var ErrNotZip = errors.New("not a readable zip")
 var ErrUnsafeZip = errors.New("unsafe zip entry")

 func unsafeEntry(n string) bool {
-	return strings.HasPrefix(n, "/") || strings.Contains(n, "..") || strings.ContainsRune(n, '\\')
+	return strings.HasPrefix(n, "/") || strings.Contains(n, "..") || strings.ContainsRune(n, '\\') || strings.ContainsAny(n, "\n\r")
 }

 func isImage(name string) bool {