feat: dir and file check

internal/errs/errors.go

@@ -2,23 +2,15 @@ package errs
 
 import (
 	"errors"
-	pkgerr "github.com/pkg/errors"
 )
 
 var (
-	ObjectNotFound = errors.New("object not found")
-	NotImplement   = errors.New("not implement")
-	NotSupport     = errors.New("not support")
-	RelativePath   = errors.New("access using relative path is not allowed")
+	NotImplement = errors.New("not implement")
+	NotSupport   = errors.New("not support")
+	RelativePath = errors.New("access using relative path is not allowed")
 
 	MoveBetweenTwoAccounts = errors.New("can't move files between two account, try to copy")
 	UploadNotSupported     = errors.New("upload not supported")
-	NotFolder              = errors.New("not a folder")
-	NotFile                = errors.New("not a file")
 
 	MetaNotFound = errors.New("meta not found")
 )
-
-func IsObjectNotFound(err error) bool {
-	return pkgerr.Cause(err) == ObjectNotFound
-}

internal/errs/object.go

@@ -0,0 +1,16 @@
+package errs
+
+import (
+	"errors"
+	pkgerr "github.com/pkg/errors"
+)
+
+var (
+	ObjectNotFound = errors.New("object not found")
+	NotFolder      = errors.New("not a folder")
+	NotFile        = errors.New("not a file")
+)
+
+func IsObjectNotFound(err error) bool {
+	return pkgerr.Cause(err) == ObjectNotFound
+}

internal/operations/fs.go

@@ -26,6 +26,9 @@ func List(ctx context.Context, account driver.Driver, path string, refresh ...bo
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed get dir")
 	}
+	if !dir.IsDir() {
+		return nil, errors.WithStack(errs.NotFolder)
+	}
 	if account.Config().NoCache {
 		return account.List(ctx, dir)
 	}

internal/operations/path.go

@@ -1,6 +1,7 @@
 package operations
 
 import (
+	"github.com/alist-org/alist/v3/internal/errs"
 	stdpath "path"
 	"strings"
 
@@ -21,6 +22,9 @@ func ActualPath(account driver.Additional, rawPath string) string {
 // for path: remove the virtual path prefix and join the actual root folder if exists
 func GetAccountAndActualPath(rawPath string) (driver.Driver, string, error) {
 	rawPath = utils.StandardizationPath(rawPath)
+	if strings.Contains(rawPath, "..") {
+		return nil, "", errors.WithStack(errs.RelativePath)
+	}
 	account := GetBalancedAccount(rawPath)
 	if account == nil {
 		return nil, "", errors.Errorf("can't find account with rawPath: %s", rawPath)