From 4a988a9fbcdf1871f01eb87593060d7cae65cd1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=94=A6=E9=BA=9F=20=E7=8E=8B?= <Jinlin.Wang@cicc.com.cn>
Date: Fri, 20 Mar 2026 12:12:17 +0800
Subject: [PATCH] =?UTF-8?q?fix(ClientFileService):=20=E5=AE=89=E5=85=A8?=
 =?UTF-8?q?=E5=A4=84=E7=90=86=E6=96=87=E4=BB=B6=E5=90=8D=E4=BB=A5=E9=98=B2?=
 =?UTF-8?q?=E6=AD=A2=E8=B7=AF=E5=BE=84=E9=81=8D=E5=8E=86=E6=94=BB=E5=87=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 YLErpDAL/Modules/ClientModule/ClientFileService.cs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/YLErpDAL/Modules/ClientModule/ClientFileService.cs b/YLErpDAL/Modules/ClientModule/ClientFileService.cs
index b22934cd..b4eab2ac 100644
--- a/YLErpDAL/Modules/ClientModule/ClientFileService.cs
+++ b/YLErpDAL/Modules/ClientModule/ClientFileService.cs
@@ -1197,8 +1197,10 @@ namespace YLErp.Modules.ClientModule
 
                 var clientFile = req.Clone();
 
-                clientFile.FileName = file.FileName;
-                clientFile.FilePath = string.Concat(webFolder.TrimStart('~'), "/", file.FileName);
+                // 安全处理：使用 Path.GetFileName 提取纯文件名，防止路径遍历攻击
+                var safeFileName = Path.GetFileName(file.FileName);
+                clientFile.FileName = safeFileName;
+                clientFile.FilePath = string.Concat(webFolder.TrimStart('~'), "/", safeFileName);
 
                 // 提供恢复文件夹
                 var historyPath = clientFile.FilePath.Replace(clientFile.FileName, @"history");