Skip to content

上传文件接口不应该暴露filePath #341

@RonnyChan96

Description

@RonnyChan96

问题摘要 / Issue Summary

上传文件接口不应该暴露filePath

版本信息 / Version Information

v1.2.0

浏览器 / Browser

No response

操作系统 / Operating System

None

发生了什么?/ What happened?

上传文件接口暴露了filePath,有可能导致被攻击

期望的行为 / Expected Behavior

上传文件后只返回fileName

重现步骤 / Steps to Reproduce

上传头像,发现调用了http://localhost:8001/api/jober/v1/api/31f20efc7e0848deab6a6bc10fc3021e/file?aipp_id=79a98da64c5d41fe9b78e34c3d799a40,返参中带有filePath,其中显示了实际存储的目录地址信息。

相关日志 / Relevant Logs

额外信息 / Additional Context

需要考虑已有调用方:前端、后端的逻辑,避免此处修改导致链路中断

确认事项 / Confirmations

  • 我已经搜索了现有的issues,确认这不是重复问题
    I have searched existing issues and confirmed this is not a duplicate

  • 我已经阅读了项目文档和 FAQ
    I have read the project documentation and FAQ

  • 我提供的信息准确完整
    The information I provided is accurate and complete

  • 我愿意协助测试问题修复 (可选)
    I'm willing to help test the bug fix (optional)

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions