github/deer-flow
1
0
Fork 0
mirror of https://github.com/bytedance/deer-flow.git synced 2026-09-15 00:19:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: preserve missing-upload delete contract

Browse Source
This commit is contained in:
hetaoBackend 2026-08-06 10:34:43 +08:00
parent 8a3cb391f6
commit e818efc9e8
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
backend/packages/harness/deerflow/uploads/manager.py
View File

@ -387,7 +387,12 @@ def delete_file_safe(base_dir: Path, filename: str) -> dict:
safe_name = normalize_filename(filename)
if safe_name != filename:
raise PathTraversalError("Path traversal detected")
base_dir = _validate_upload_directory(Path(base_dir))
try:
base_dir = _validate_upload_directory(Path(base_dir))
except UnsafeUploadPathError as exc:
if isinstance(exc.__cause__, FileNotFoundError):
raise FileNotFoundError(f"File not found: {filename}") from exc
raise
file_path = base_dir / safe_name
try:
file_stat = os.lstat(file_path)

4
backend/tests/test_uploads_manager.py
View File

@ -362,6 +362,10 @@ class TestDeleteFileSafe:
with pytest.raises(FileNotFoundError):
delete_file_safe(tmp_path, "nope.txt")
def test_delete_from_nonexistent_directory_raises_file_not_found(self, tmp_path):
with pytest.raises(FileNotFoundError, match="ghost.txt"):
delete_file_safe(tmp_path / "missing-uploads", "ghost.txt")
def test_delete_traversal_raises(self, tmp_path):
with pytest.raises(PathTraversalError, match="traversal"):
delete_file_safe(tmp_path, "../outside.txt")